# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Jan 15 2020 08:26:44 # Log Creation Date: 21.01.2020 05:39:10.017 Process: id = "1" image_name = "winrar.exe" filename = "c:\\users\\fd1hvy\\desktop\\winrar.exe" page_root = "0x4c593000" os_pid = "0x60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x740" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000faa5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x131c [0042.504] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0042.505] LoadLibraryExW (lpLibFileName="?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0042.603] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x95f218 | out: lpCharType=0x95f218) returned 1 [0042.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95f818, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95f818, cbMultiByte=256, lpWideCharStr=0x95ef58, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0042.603] LoadLibraryExW (lpLibFileName="?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0042.604] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x95ed48, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0042.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x95f718, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ²\x9cª!Tù\x95", lpUsedDefaultChar=0x0) returned 256 [0042.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95f818, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95f818, cbMultiByte=256, lpWideCharStr=0x95ef68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0042.604] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0042.604] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x95ed58, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0042.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x95f618, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ²\x9cª!Tù\x95", lpUsedDefaultChar=0x0) returned 256 [0042.604] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x80) returned 0x114c38 [0042.604] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xd802b8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winrar.exe")) returned 0x22 [0042.604] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x2b) returned 0x118cf8 [0042.604] RtlInitializeSListHead (in: ListHead=0xd7feb0 | out: ListHead=0xd7feb0) [0042.604] GetLastError () returned 0x0 [0042.604] SetLastError (dwErrCode=0x0) [0042.604] GetEnvironmentStringsW () returned 0x11fdc0* [0042.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0042.604] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x565) returned 0x120898 [0042.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x120898, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0042.604] FreeEnvironmentStringsW (penv=0x11fdc0) returned 1 [0042.604] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x94) returned 0x114e60 [0042.604] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1f) returned 0x114bf8 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x28) returned 0x114e10 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x37) returned 0x11d938 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3c) returned 0x1149b0 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x31) returned 0x11db40 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x14) returned 0x11a118 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x24) returned 0x11a138 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xd) returned 0x1181c8 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x17) returned 0x114538 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x2b) returned 0x118d30 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x15) returned 0x114558 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x17) returned 0x120008 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x22) returned 0x1202e0 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xe) returned 0x118270 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xc1) returned 0x118e80 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3e) returned 0x118908 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1b) returned 0x118950 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1d) returned 0x114578 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x48) returned 0x115038 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x12) returned 0x11fee8 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x18) returned 0x11ffa8 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1b) returned 0x115088 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x24) returned 0x1203a0 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x29) returned 0x118b70 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x114770 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x6b) returned 0x118790 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x17) returned 0x1200a8 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xf) returned 0x118330 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x16) returned 0x120028 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x28) returned 0x1202b0 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x27) returned 0x120520 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x12) returned 0x120048 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x21) returned 0x120460 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x10) returned 0x1182d0 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1c) returned 0x114798 [0042.605] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x12) returned 0x11fe48 [0042.605] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x120898 | out: hHeap=0x110000) returned 1 [0042.606] QueryPerformanceFrequency (in: lpFrequency=0x95f994 | out: lpFrequency=0x95f994*=100000000) returned 1 [0042.606] QueryPerformanceCounter (in: lpPerformanceCount=0x95f98c | out: lpPerformanceCount=0x95f98c*=20112244058) returned 1 [0042.606] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x800) returned 0x1205d0 [0042.606] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0042.606] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xd3e64f) returned 0x0 [0042.607] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x95f980 | out: lpCPInfo=0x95f980) returned 1 [0042.612] GetCurrentProcess () returned 0xffffffff [0042.612] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x95f944, lpSystemAffinityMask=0x95f940 | out: lpProcessAffinityMask=0x95f944, lpSystemAffinityMask=0x95f940) returned 1 [0042.613] GetCurrentProcess () returned 0xffffffff [0042.613] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x95f958, lpSystemAffinityMask=0x95f954 | out: lpProcessAffinityMask=0x95f958, lpSystemAffinityMask=0x95f954) returned 1 [0042.613] GetStartupInfoW (in: lpStartupInfo=0x95f974 | out: lpStartupInfo=0x95f974*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0042.615] GetModuleHandleW (lpModuleName="kernel32") returned 0x74030000 [0042.615] GetProcAddress (hModule=0x74030000, lpProcName="SetDllDirectoryW") returned 0x74082580 [0042.615] SetDllDirectoryW (lpPathName="") returned 1 [0042.615] GetProcAddress (hModule=0x74030000, lpProcName="SetDefaultDllDirectories") returned 0x772ed900 [0042.615] SetDefaultDllDirectories (DirectoryFlags=0x800) returned 1 [0042.615] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x9547fc, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winrar.exe")) returned 0x22 [0042.615] GetVersionExW (in: lpVersionInformation=0x9543cc*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xf, dwMinorVersion=0xf0000, dwBuildNumber=0x9, dwPlatformId=0x74030000, szCSDVersion="\x09") | out: lpVersionInformation=0x9543cc*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0042.615] GetSystemDirectoryW (in: lpBuffer=0x9534dc, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0042.615] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\version.dll") returned 0x73b80000 [0042.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="version.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0042.710] GetSystemDirectoryW (in: lpBuffer=0x9534dc, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0042.710] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\DXGIDebug.dll") returned 0x0 [0042.710] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DXGIDebug.dll" (normalized: "c:\\users\\fd1hvy\\desktop\\dxgidebug.dll")) returned 0xffffffff [0042.710] GetSystemDirectoryW (in: lpBuffer=0x9534dc, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0042.710] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\sfc_os.dll") returned 0x73b70000 [0042.795] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="sfc_os.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0042.795] GetSystemDirectoryW (in: lpBuffer=0x9534dc, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0042.795] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\SSPICLI.DLL") returned 0x73e60000 [0042.795] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="SSPICLI.DLL", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0042.795] GetSystemDirectoryW (in: lpBuffer=0x9534dc, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0042.795] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\rsaenh.dll") returned 0x73b40000 [0043.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="rsaenh.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0043.055] GetSystemDirectoryW (in: lpBuffer=0x9534dc, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0043.055] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\UXTheme.dll") returned 0x73d30000 [0043.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="UXTheme.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0043.417] GetSystemDirectoryW (in: lpBuffer=0x9534dc, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0043.417] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\dwmapi.dll") returned 0x73d00000 [0043.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="dwmapi.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 1 [0043.601] GetSystemDirectoryW (in: lpBuffer=0x9534dc, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0043.601] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\cryptbase.dll") returned 0x73e50000 [0043.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="cryptbase.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 1 [0043.601] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0xd675f8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0043.601] GetSystemDirectoryW (in: lpBuffer=0x95e894, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0043.601] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\riched20.dll") returned 0x73aa0000 [0044.618] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x760e0000 [0045.477] GetProcAddress (hModule=0x760e0000, lpProcName="OleInitialize") returned 0x76113e50 [0045.477] OleInitialize (pvReserved=0x0) returned 0x0 [0045.782] LoadLibraryExA (lpLibFileName="COMCTL32.dll", hFile=0x0, dwFlags=0x0) returned 0x73830000 [0046.547] GetProcAddress (hModule=0x73830000, lpProcName="InitCommonControlsEx") returned 0x738aa480 [0046.547] InitCommonControlsEx (picce=0x95f8b8) returned 1 [0046.550] GdiplusStartup (in: token=0x95f8c0, input=0x95f8a8, output=0x0 | out: token=0x95f8c0, output=0x0) returned 0x0 [0046.557] LoadLibraryExA (lpLibFileName="SHELL32.dll", hFile=0x0, dwFlags=0x0) returned 0x74a80000 [0051.635] GetProcAddress (hModule=0x74a80000, lpProcName="SHGetMalloc") returned 0x74bedf80 [0051.636] SHGetMalloc (in: ppMalloc=0xd675c0 | out: ppMalloc=0xd675c0*=0x7488d000) returned 0x0 [0051.637] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x95f8b0 | out: lpCPInfo=0x95f8b0) returned 1 [0051.638] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe\" " [0051.638] SetEnvironmentVariableW (lpName="sfxcmd", lpValue="\"C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe\" ") returned 1 [0051.638] SetEnvironmentVariableW (lpName="sfxpar", lpValue="") returned 1 [0051.638] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd7ce18, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winrar.exe")) returned 0x22 [0051.638] SetEnvironmentVariableW (lpName="sfxname", lpValue="C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe") returned 1 [0051.638] GetLocalTime (in: lpSystemTime=0x95f8d8 | out: lpSystemTime=0x95f8d8*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x2, wDay=0x15, wHour=0x6, wMinute=0x28, wSecond=0x0, wMilliseconds=0x3a)) [0051.638] GetLastError () returned 0x0 [0051.638] SetLastError (dwErrCode=0x0) [0051.639] SetEnvironmentVariableW (lpName="sfxstime", lpValue="2020-01-21-06-40-00-058") returned 1 [0051.639] GetModuleHandleW (lpModuleName=0x0) returned 0xd20000 [0051.639] LoadLibraryExA (lpLibFileName="USER32.dll", hFile=0x0, dwFlags=0x0) returned 0x769e0000 [0051.639] GetProcAddress (hModule=0x769e0000, lpProcName="LoadIconW") returned 0x76a08420 [0051.639] LoadIconW (hInstance=0xd20000, lpIconName=0x64) returned 0x80131 [0051.641] GetProcAddress (hModule=0x769e0000, lpProcName="LoadBitmapW") returned 0x76a02b80 [0051.641] LoadBitmapW (hInstance=0xd20000, lpBitmapName=0x65) returned 0x0 [0051.641] FindResourceW (hModule=0xd20000, lpName=0x65, lpType="PNG") returned 0xd82400 [0051.642] SizeofResource (hModule=0xd20000, hResInfo=0xd82400) returned 0xb45 [0051.642] LoadResource (hModule=0xd20000, hResInfo=0xd82400) returned 0xd82644 [0051.642] LockResource (hResData=0xd82644) returned 0xd82644 [0051.642] GlobalLock (hMem=0x4d0004) returned 0x131500 [0051.642] GetProcAddress (hModule=0x760e0000, lpProcName="CreateStreamOnHGlobal") returned 0x74752af0 [0051.642] CreateStreamOnHGlobal (in: hGlobal=0x4d0004, fDeleteOnRelease=0, ppstm=0x95f8a0 | out: ppstm=0x95f8a0*=0x129c20) returned 0x0 [0051.646] GdipAlloc (size=0x10) returned 0x291f08 [0051.647] GdipCreateBitmapFromStream (stream=0x129c20, bitmap=0x95f860) returned 0x0 [0051.985] IUnknown:Release (This=0x129c20) returned 0x2 [0051.986] GdipCreateHBITMAPFromBitmap (bitmap=0x291f20, hbmReturn=0x95f898, background=0xffffff) returned 0x0 [0052.039] GdipDisposeImage (image=0x291f20) returned 0x0 [0052.039] GdipFree (ptr=0x291f08) [0052.039] GlobalUnlock (hMem=0x4d0004) returned 0 [0052.039] LoadLibraryExA (lpLibFileName="GDI32.dll", hFile=0x0, dwFlags=0x0) returned 0x760b0000 [0052.040] GetProcAddress (hModule=0x760b0000, lpProcName="GetObjectW") returned 0x760b6d60 [0052.040] GetObjectW (in: h=0x24050516, c=24, pv=0x95f8ac | out: pv=0x95f8ac) returned 24 [0052.040] GetProcAddress (hModule=0x769e0000, lpProcName="GetDC") returned 0x76a133c0 [0052.040] GetDC (hWnd=0x0) returned 0x60100ce [0052.040] GetProcAddress (hModule=0x760b0000, lpProcName="GetDeviceCaps") returned 0x760b5c60 [0052.040] GetDeviceCaps (hdc=0x60100ce, index=88) returned 96 [0052.040] GetProcAddress (hModule=0x769e0000, lpProcName="ReleaseDC") returned 0x76a0a480 [0052.040] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0052.040] GetDC (hWnd=0x0) returned 0x60100ce [0052.040] GetDeviceCaps (hdc=0x60100ce, index=90) returned 96 [0052.040] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0052.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winrar.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x22c [0052.041] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x80) returned 0x128ac8 [0052.041] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x80) returned 0x12aad8 [0052.041] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x128ac8, Size=0x120) returned 0x110ae0 [0052.041] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x12aad8, Size=0x120) returned 0x110c08 [0052.041] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x110ae0, Size=0x1e8) returned 0x110d30 [0052.041] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x110c08, Size=0x1e8) returned 0x110f20 [0052.041] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x0 [0052.041] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.041] SetFilePointer (in: hFile=0x22c, lDistanceToMove=8176, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x1ff0 [0052.041] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x1ff0 [0052.042] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.042] SetFilePointer (in: hFile=0x22c, lDistanceToMove=16352, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x3fe0 [0052.042] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x3fe0 [0052.042] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.042] SetFilePointer (in: hFile=0x22c, lDistanceToMove=24528, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x5fd0 [0052.042] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x5fd0 [0052.042] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.042] SetFilePointer (in: hFile=0x22c, lDistanceToMove=32704, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x7fc0 [0052.042] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x7fc0 [0052.042] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.042] SetFilePointer (in: hFile=0x22c, lDistanceToMove=40880, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x9fb0 [0052.042] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x9fb0 [0052.042] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.043] SetFilePointer (in: hFile=0x22c, lDistanceToMove=49056, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0xbfa0 [0052.043] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0xbfa0 [0052.043] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.043] SetFilePointer (in: hFile=0x22c, lDistanceToMove=57232, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0xdf90 [0052.043] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0xdf90 [0052.043] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.043] SetFilePointer (in: hFile=0x22c, lDistanceToMove=65408, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0xff80 [0052.043] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0xff80 [0052.043] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.043] SetFilePointer (in: hFile=0x22c, lDistanceToMove=73584, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x11f70 [0052.043] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x11f70 [0052.043] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.043] SetFilePointer (in: hFile=0x22c, lDistanceToMove=81760, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x13f60 [0052.043] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x13f60 [0052.044] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.044] SetFilePointer (in: hFile=0x22c, lDistanceToMove=89936, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x15f50 [0052.044] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x15f50 [0052.044] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.044] SetFilePointer (in: hFile=0x22c, lDistanceToMove=98112, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x17f40 [0052.044] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x17f40 [0052.044] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.044] SetFilePointer (in: hFile=0x22c, lDistanceToMove=106288, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x19f30 [0052.044] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x19f30 [0052.044] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.044] SetFilePointer (in: hFile=0x22c, lDistanceToMove=114464, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x1bf20 [0052.044] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x1bf20 [0052.044] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.044] SetFilePointer (in: hFile=0x22c, lDistanceToMove=122640, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x1df10 [0052.045] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x1df10 [0052.045] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.045] SetFilePointer (in: hFile=0x22c, lDistanceToMove=130816, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x1ff00 [0052.045] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x1ff00 [0052.045] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.045] SetFilePointer (in: hFile=0x22c, lDistanceToMove=138992, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x21ef0 [0052.045] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x21ef0 [0052.045] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.045] SetFilePointer (in: hFile=0x22c, lDistanceToMove=147168, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x23ee0 [0052.045] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x23ee0 [0052.045] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.045] SetFilePointer (in: hFile=0x22c, lDistanceToMove=155344, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x25ed0 [0052.045] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x25ed0 [0052.045] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.046] SetFilePointer (in: hFile=0x22c, lDistanceToMove=163520, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x27ec0 [0052.046] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x27ec0 [0052.046] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.046] SetFilePointer (in: hFile=0x22c, lDistanceToMove=171696, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x29eb0 [0052.046] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x29eb0 [0052.046] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.046] SetFilePointer (in: hFile=0x22c, lDistanceToMove=179872, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x2bea0 [0052.046] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x2bea0 [0052.046] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.046] SetFilePointer (in: hFile=0x22c, lDistanceToMove=188048, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x2de90 [0052.046] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x2de90 [0052.046] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.046] SetFilePointer (in: hFile=0x22c, lDistanceToMove=196224, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x2fe80 [0052.046] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x2fe80 [0052.047] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.047] SetFilePointer (in: hFile=0x22c, lDistanceToMove=204400, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x31e70 [0052.047] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x31e70 [0052.047] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.047] SetFilePointer (in: hFile=0x22c, lDistanceToMove=212576, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x33e60 [0052.047] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x33e60 [0052.047] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.047] SetFilePointer (in: hFile=0x22c, lDistanceToMove=220752, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x35e50 [0052.047] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x35e50 [0052.047] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.047] SetFilePointer (in: hFile=0x22c, lDistanceToMove=228928, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x37e40 [0052.047] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x37e40 [0052.047] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.047] SetFilePointer (in: hFile=0x22c, lDistanceToMove=237104, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x39e30 [0052.047] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x39e30 [0052.048] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.048] SetFilePointer (in: hFile=0x22c, lDistanceToMove=245280, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x3be20 [0052.048] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x3be20 [0052.048] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.048] SetFilePointer (in: hFile=0x22c, lDistanceToMove=253456, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x3de10 [0052.048] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x3de10 [0052.048] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.048] SetFilePointer (in: hFile=0x22c, lDistanceToMove=261632, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x3fe00 [0052.048] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x3fe00 [0052.048] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.048] SetFilePointer (in: hFile=0x22c, lDistanceToMove=269808, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x41df0 [0052.048] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x41df0 [0052.048] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.048] SetFilePointer (in: hFile=0x22c, lDistanceToMove=277984, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x43de0 [0052.049] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x43de0 [0052.049] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.049] SetFilePointer (in: hFile=0x22c, lDistanceToMove=286160, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x45dd0 [0052.049] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x45dd0 [0052.049] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.049] SetFilePointer (in: hFile=0x22c, lDistanceToMove=294336, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x47dc0 [0052.049] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x47dc0 [0052.049] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.049] SetFilePointer (in: hFile=0x22c, lDistanceToMove=302512, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x49db0 [0052.049] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x49db0 [0052.049] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.049] SetFilePointer (in: hFile=0x22c, lDistanceToMove=310688, lpDistanceToMoveHigh=0x95b598*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x95b598*=0) returned 0x4bda0 [0052.049] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x95b5a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x95b5a8*=0) returned 0x4bda0 [0052.049] ReadFile (in: hFile=0x22c, lpBuffer=0x95b5bc, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x95b578, lpOverlapped=0x0 | out: lpBuffer=0x95b5bc*, lpNumberOfBytesRead=0x95b578*=0x2000, lpOverlapped=0x0) returned 1 [0052.050] CloseHandle (hObject=0x22c) returned 1 [0052.050] GetModuleHandleW (lpModuleName=0x0) returned 0xd20000 [0052.050] FindResourceW (hModule=0xd20000, lpName="RTL", lpType=0x5) returned 0x0 [0052.050] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xc) returned 0x123b88 [0052.050] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xc) returned 0x123c48 [0052.050] GetProcAddress (hModule=0x769e0000, lpProcName="DialogBoxParamW") returned 0x76a321c0 [0052.101] DialogBoxParamW (hInstance=0xd20000, lpTemplateName="STARTDLG", hWndParent=0x0, lpDialogFunc=0xd3a62c, dwInitParam=0x0) returned 0x1 [0052.403] GetLastError () returned 0x0 [0052.403] SetLastError (dwErrCode=0x0) [0052.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$STARTDLG:", cchWideChar=-1, lpMultiByteStr=0x94ce90, cbMultiByte=80, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$STARTDLG:", lpUsedDefaultChar=0x0) returned 11 [0052.403] GetLastError () returned 0x0 [0052.403] SetLastError (dwErrCode=0x0) [0052.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$STARTDLG:SIZE", cchWideChar=-1, lpMultiByteStr=0x94c9b4, cbMultiByte=80, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$STARTDLG:SIZE", lpUsedDefaultChar=0x0) returned 15 [0052.403] GetProcAddress (hModule=0x769e0000, lpProcName="GetWindowRect") returned 0x76a06c50 [0052.404] GetWindowRect (in: hWnd=0x502c0, lpRect=0x94ce5c | out: lpRect=0x94ce5c) returned 1 [0052.404] GetProcAddress (hModule=0x769e0000, lpProcName="GetClientRect") returned 0x769f9650 [0052.404] GetClientRect (in: hWnd=0x502c0, lpRect=0x94ce80 | out: lpRect=0x94ce80) returned 1 [0052.404] GetLastError () returned 0x0 [0052.404] SetLastError (dwErrCode=0x0) [0052.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$STARTDLG:CAPTION", cchWideChar=-1, lpMultiByteStr=0x94cdc8, cbMultiByte=80, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$STARTDLG:CAPTION", lpUsedDefaultChar=0x0) returned 18 [0052.404] GetProcAddress (hModule=0x769e0000, lpProcName="GetSystemMetrics") returned 0x76a0ddc0 [0052.404] GetSystemMetrics (nIndex=8) returned 3 [0052.404] GetProcAddress (hModule=0x769e0000, lpProcName="GetWindow") returned 0x76a0d880 [0052.404] GetWindow (hWnd=0x502c0, uCmd=0x5) returned 0x5002c [0052.404] GetProcAddress (hModule=0x769e0000, lpProcName="SendMessageW") returned 0x769f07d0 [0052.404] SendMessageW (hWnd=0x502c0, Msg=0x80, wParam=0x1, lParam=0x80131) returned 0x0 [0052.409] GetProcAddress (hModule=0x769e0000, lpProcName="SendDlgItemMessageW") returned 0x769e9370 [0052.409] SendDlgItemMessageW (hDlg=0x502c0, nIDDlgItem=108, Msg=0x172, wParam=0x0, lParam=0x24050516) returned 0x0 [0052.412] GetProcAddress (hModule=0x769e0000, lpProcName="GetDlgItem") returned 0x769e93b0 [0052.412] GetDlgItem (hDlg=0x502c0, nIDDlgItem=104) returned 0x60138 [0052.412] SendMessageW (hWnd=0x60138, Msg=0x435, wParam=0x0, lParam=0x400000) returned 0x0 [0052.412] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0x95e2fc | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0052.413] GetProcAddress (hModule=0x769e0000, lpProcName="GetDlgItem") returned 0x769e93b0 [0052.413] GetDlgItem (hDlg=0x502c0, nIDDlgItem=102) returned 0x7005a [0052.413] GetProcAddress (hModule=0x769e0000, lpProcName="SetWindowTextW") returned 0x769ed0c0 [0052.413] SetWindowTextW (hWnd=0x7005a, lpString="C:\\Users\\FD1HVy\\Desktop") returned 1 [0052.413] GetProcAddress (hModule=0x769e0000, lpProcName="GetClassNameW") returned 0x76a10310 [0052.413] GetClassNameW (in: hWnd=0x7005a, lpClassName=0x94d708, nMaxCount=80 | out: lpClassName="ComboBox") returned 8 [0052.413] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="ComboBox", cchCount1=-1, lpString2="EDIT", cchCount2=-1) returned 1 [0052.414] GetProcAddress (hModule=0x769e0000, lpProcName="FindWindowExW") returned 0x76a02840 [0052.414] FindWindowExW (hWndParent=0x7005a, hWndChildAfter=0x0, lpszClass="EDIT", lpszWindow=0x0) returned 0x5002a [0052.414] LoadLibraryExA (lpLibFileName="SHLWAPI.dll", hFile=0x0, dwFlags=0x0) returned 0x74640000 [0052.414] GetProcAddress (hModule=0x74640000, lpProcName="SHAutoComplete") returned 0x74666580 [0052.415] SHAutoComplete (hwndEdit=0x5002a, dwFlags=0x10) returned 0x0 [0053.260] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10c0) returned 0x148da8 [0053.261] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10c0) returned 0x149e70 [0053.261] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x82e8) returned 0x152880 [0053.261] GetCurrentProcess () returned 0xffffffff [0053.262] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x945a10, lpSystemAffinityMask=0x945a0c | out: lpProcessAffinityMask=0x945a10, lpSystemAffinityMask=0x945a0c) returned 1 [0053.262] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winrar.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x2a0 [0053.262] ReadFile (in: hFile=0x2a0, lpBuffer=0x947c70, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x9459e0, lpOverlapped=0x0 | out: lpBuffer=0x947c70*, lpNumberOfBytesRead=0x9459e0*=0x7, lpOverlapped=0x0) returned 1 [0053.262] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x200000) returned 0x3d1f020 [0053.267] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x945a10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x945a10*=0) returned 0x7 [0053.267] ReadFile (in: hFile=0x2a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0x1ffff0, lpNumberOfBytesRead=0x9459e0, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x9459e0*=0x4ed8b, lpOverlapped=0x0) returned 1 [0053.295] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=310784, lpDistanceToMoveHigh=0x945a00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x945a00*=0) returned 0x4be00 [0053.296] ReadFile (in: hFile=0x2a0, lpBuffer=0x947c70, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x9459e0, lpOverlapped=0x0 | out: lpBuffer=0x947c70*, lpNumberOfBytesRead=0x9459e0*=0x7, lpOverlapped=0x0) returned 1 [0053.296] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x3d1f020 | out: hHeap=0x110000) returned 1 [0053.305] ReadFile (in: hFile=0x2a0, lpBuffer=0x947c77, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x9459e0, lpOverlapped=0x0 | out: lpBuffer=0x947c77*, lpNumberOfBytesRead=0x9459e0*=0x1, lpOverlapped=0x0) returned 1 [0053.305] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x945a08*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x945a08*=0) returned 0x4be08 [0053.305] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x129ab8 [0053.305] ReadFile (in: hFile=0x2a0, lpBuffer=0x129ab8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x9438c8, lpOverlapped=0x0 | out: lpBuffer=0x129ab8*, lpNumberOfBytesRead=0x9438c8*=0x7, lpOverlapped=0x0) returned 1 [0053.305] ReadFile (in: hFile=0x2a0, lpBuffer=0x129abf, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x9438c8, lpOverlapped=0x0 | out: lpBuffer=0x129abf*, lpNumberOfBytesRead=0x9438c8*=0xa, lpOverlapped=0x0) returned 1 [0053.305] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x129ab8 | out: hHeap=0x110000) returned 1 [0053.305] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=310809, lpDistanceToMoveHigh=0x9459fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x9459fc*=0) returned 0x4be19 [0053.305] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x945a10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x945a10*=0) returned 0x4be19 [0053.306] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x945a08*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x945a08*=0) returned 0x4be19 [0053.306] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x129ab8 [0053.306] ReadFile (in: hFile=0x2a0, lpBuffer=0x129ab8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x9438c8, lpOverlapped=0x0 | out: lpBuffer=0x129ab8*, lpNumberOfBytesRead=0x9438c8*=0x7, lpOverlapped=0x0) returned 1 [0053.306] ReadFile (in: hFile=0x2a0, lpBuffer=0x129abf, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x9438c8, lpOverlapped=0x0 | out: lpBuffer=0x129abf*, lpNumberOfBytesRead=0x9438c8*=0x11, lpOverlapped=0x0) returned 1 [0053.306] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x129ab8 | out: hHeap=0x110000) returned 1 [0053.306] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=310970, lpDistanceToMoveHigh=0x9459fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x9459fc*=0) returned 0x4beba [0053.306] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x945a08*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x945a08*=0) returned 0x4beba [0053.306] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x129bf8 [0053.306] ReadFile (in: hFile=0x2a0, lpBuffer=0x129bf8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x9438c8, lpOverlapped=0x0 | out: lpBuffer=0x129bf8*, lpNumberOfBytesRead=0x9438c8*=0x7, lpOverlapped=0x0) returned 1 [0053.306] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x129bf8, Size=0x48) returned 0x12a190 [0053.306] ReadFile (in: hFile=0x2a0, lpBuffer=0x12a197, nNumberOfBytesToRead=0x21, lpNumberOfBytesRead=0x9438c8, lpOverlapped=0x0 | out: lpBuffer=0x12a197*, lpNumberOfBytesRead=0x9438c8*=0x21, lpOverlapped=0x0) returned 1 [0053.306] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a190 | out: hHeap=0x110000) returned 1 [0053.306] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=310809, lpDistanceToMoveHigh=0x9459d8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x9459d8*=0) returned 0x4be19 [0053.306] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x945a34*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x945a34*=0) returned 0x4be19 [0053.306] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=310809, lpDistanceToMoveHigh=0x945a20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x945a20*=0) returned 0x4be19 [0053.306] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x945a14*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x945a14*=0) returned 0x4be19 [0053.306] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x129ab8 [0053.306] ReadFile (in: hFile=0x2a0, lpBuffer=0x129ab8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x9438d4, lpOverlapped=0x0 | out: lpBuffer=0x129ab8*, lpNumberOfBytesRead=0x9438d4*=0x7, lpOverlapped=0x0) returned 1 [0053.306] ReadFile (in: hFile=0x2a0, lpBuffer=0x129abf, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x9438d4, lpOverlapped=0x0 | out: lpBuffer=0x129abf*, lpNumberOfBytesRead=0x9438d4*=0x11, lpOverlapped=0x0) returned 1 [0053.306] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x129ab8 | out: hHeap=0x110000) returned 1 [0053.307] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x8003) returned 0x15ab70 [0053.307] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x8003) returned 0x162b80 [0053.308] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40000) returned 0x16ab90 [0053.313] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x89) returned 0x145b58 [0053.313] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xb54) returned 0x1aab98 [0053.313] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x100000) returned 0x3d1d020 [0053.315] ReadFile (in: hFile=0x2a0, lpBuffer=0x3d1d020, nNumberOfBytesToRead=0x89, lpNumberOfBytesRead=0x937268, lpOverlapped=0x0 | out: lpBuffer=0x3d1d020*, lpNumberOfBytesRead=0x937268*=0x89, lpOverlapped=0x0) returned 1 [0053.316] GetProcAddress (hModule=0x769e0000, lpProcName="PeekMessageW") returned 0x76a0d180 [0053.316] PeekMessageW (in: lpMsg=0x937270, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x937270) returned 1 [0053.316] GetProcAddress (hModule=0x769e0000, lpProcName="GetMessageW") returned 0x76a0fea0 [0053.316] GetMessageW (in: lpMsg=0x937270, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x937270) returned 1 [0053.316] GetProcAddress (hModule=0x769e0000, lpProcName="TranslateMessage") returned 0x76a0f900 [0053.316] TranslateMessage (lpMsg=0x937270) returned 0 [0053.316] GetProcAddress (hModule=0x769e0000, lpProcName="DispatchMessageW") returned 0x76a04840 [0053.316] DispatchMessageW (lpMsg=0x937270) returned 0x0 [0053.318] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0053.318] PeekMessageW (in: lpMsg=0x937274, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x937274) returned 1 [0053.318] GetMessageW (in: lpMsg=0x937274, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x937274) returned 1 [0053.318] TranslateMessage (lpMsg=0x937274) returned 0 [0053.318] DispatchMessageW (lpMsg=0x937274) returned 0x0 [0053.319] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0053.319] PeekMessageW (in: lpMsg=0x937268, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x937268) returned 0 [0053.319] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0053.319] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x3d1d020 | out: hHeap=0x110000) returned 1 [0053.321] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x16ab90 | out: hHeap=0x110000) returned 1 [0053.321] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x162b80 | out: hHeap=0x110000) returned 1 [0053.323] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x15ab70 | out: hHeap=0x110000) returned 1 [0053.325] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x145b58, Size=0xcb) returned 0x145b58 [0053.325] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x114) returned 0x1ab6f8 [0053.325] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x145b58 | out: hHeap=0x110000) returned 1 [0053.325] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=310809, lpDistanceToMoveHigh=0x9459fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x9459fc*=0) returned 0x4be19 [0053.325] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xda) returned 0x145b58 [0053.325] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1ab6f8 | out: hHeap=0x110000) returned 1 [0053.325] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x152880 | out: hHeap=0x110000) returned 1 [0053.327] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x148da8 | out: hHeap=0x110000) returned 1 [0053.327] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x149e70 | out: hHeap=0x110000) returned 1 [0053.327] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1aab98 | out: hHeap=0x110000) returned 1 [0053.328] CloseHandle (hObject=0x2a0) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0053.329] ExpandEnvironmentStringsW (in: lpSrc="1.exe", lpDst=0x92faec, nSize=0x1000 | out: lpDst="1.exe") returned 0x6 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0053.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 2 [0053.330] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x92faec, nSize=0x1000 | out: lpDst="1") returned 0x2 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0053.330] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x92faec, nSize=0x1000 | out: lpDst="1") returned 0x2 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0053.330] ExpandEnvironmentStringsW (in: lpSrc="D, PasswordIskk2511, , , 1.exe, ", lpDst=0x92faec, nSize=0x1000 | out: lpDst="D, PasswordIskk2511, , , 1.exe, ") returned 0x21 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 2 [0053.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0053.331] ExpandEnvironmentStringsW (in: lpSrc="1.exe", lpDst=0x92faec, nSize=0x1000 | out: lpDst="1.exe") returned 0x6 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0053.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 2 [0053.332] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x92faec, nSize=0x1000 | out: lpDst="1") returned 0x2 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0053.332] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x92faec, nSize=0x1000 | out: lpDst="1") returned 0x2 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0053.332] ExpandEnvironmentStringsW (in: lpSrc="D, PasswordIskk2511, , , 1.exe, ", lpDst=0x92faec, nSize=0x1000 | out: lpDst="D, PasswordIskk2511, , , 1.exe, ") returned 0x21 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 2 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0053.333] ExpandEnvironmentStringsW (in: lpSrc="1.exe", lpDst=0x92faec, nSize=0x1000 | out: lpDst="1.exe") returned 0x6 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0053.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0053.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0053.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0053.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 2 [0053.334] GetTempPathW (in: nBufferLength=0x800, lpBuffer=0x945b1c | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0053.334] GetLastError () returned 0x0 [0053.334] SetLastError (dwErrCode=0x0) [0053.334] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0")) returned 0xffffffff [0053.334] GetProcAddress (hModule=0x769e0000, lpProcName="CharUpperW") returned 0x76a10f70 [0053.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0")) returned 0xffffffff [0053.334] GetProcAddress (hModule=0x769e0000, lpProcName="SetDlgItemTextW") returned 0x769e9490 [0053.334] SetDlgItemTextW (hDlg=0x502c0, nIDDlgItem=102, lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0") returned 1 [0053.346] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x92faec, nSize=0x1000 | out: lpDst="1") returned 0x2 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0053.346] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x92faec, nSize=0x1000 | out: lpDst="1") returned 0x2 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0053.346] ExpandEnvironmentStringsW (in: lpSrc="D, PasswordIskk2511, , , 1.exe, ", lpDst=0x92faec, nSize=0x1000 | out: lpDst="D, PasswordIskk2511, , , 1.exe, ") returned 0x21 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0053.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0053.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0053.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0053.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 2 [0053.347] GetDlgItem (hDlg=0x502c0, nIDDlgItem=103) returned 0x202e2 [0053.347] GetProcAddress (hModule=0x769e0000, lpProcName="EnableWindow") returned 0x76a00a60 [0053.347] EnableWindow (hWnd=0x202e2, bEnable=0) returned 0 [0053.347] GetDlgItem (hDlg=0x502c0, nIDDlgItem=102) returned 0x7005a [0053.347] EnableWindow (hWnd=0x7005a, bEnable=0) returned 0 [0053.350] SendMessageW (hWnd=0x502c0, Msg=0x111, wParam=0x1, lParam=0x0) returned 0x0 [0053.350] GetProcAddress (hModule=0x769e0000, lpProcName="GetDlgItemTextW") returned 0x769e9340 [0053.350] GetDlgItemTextW (in: hDlg=0x502c0, nIDDlgItem=102, lpString=0x94b34c, cchMax=2048 | out: lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0") returned 0x2a [0053.350] GetDlgItem (hDlg=0x502c0, nIDDlgItem=104) returned 0x60138 [0053.350] SendMessageW (hWnd=0x60138, Msg=0xb1, wParam=0x0, lParam=0xffffffff) returned 0x0 [0053.350] SendMessageW (hWnd=0x60138, Msg=0xc2, wParam=0x0, lParam=0xd522e4) returned 0x0 [0053.350] GetProcAddress (hModule=0x769e0000, lpProcName="SetFocus") returned 0x76a13d10 [0053.350] SetFocus (hWnd=0x60138) returned 0x0 [0054.358] GetProcAddress (hModule=0x769e0000, lpProcName="LoadStringW") returned 0x76a10480 [0054.358] LoadStringW (in: hInstance=0xd20000, uID=0xba, lpBuffer=0xd60928, cchBufferMax=1024 | out: lpBuffer="正解压文件到临时文件夹") returned 0xb [0054.358] GetDlgItem (hDlg=0x502c0, nIDDlgItem=104) returned 0x60138 [0054.358] GetProcAddress (hModule=0x769e0000, lpProcName="ShowWindow") returned 0x76a13ee0 [0054.358] ShowWindow (hWnd=0x60138, nCmdShow=5) returned 1 [0054.359] SendMessageW (hWnd=0x60138, Msg=0xb1, wParam=0x0, lParam=0xffffffff) returned 0x0 [0054.359] SendMessageW (hWnd=0x60138, Msg=0xc2, wParam=0x0, lParam=0xd522e4) returned 0x0 [0054.359] SendMessageW (hWnd=0x60138, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x0 [0054.360] SendMessageW (hWnd=0x60138, Msg=0x43a, wParam=0x0, lParam=0x93b79c) returned 0xf800003f [0054.360] SendMessageW (hWnd=0x60138, Msg=0x444, wParam=0x1, lParam=0x93b79c) returned 0x1 [0054.360] SendMessageW (hWnd=0x60138, Msg=0xc2, wParam=0x0, lParam=0xd60928) returned 0xb [0054.444] SendMessageW (hWnd=0x60138, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0xb [0054.445] SendMessageW (hWnd=0x60138, Msg=0xc2, wParam=0x0, lParam=0xd5304c) returned 0x1 [0054.445] CreateDirectoryW (lpPathName="C:\\Users" (normalized: "c:\\users"), lpSecurityAttributes=0x0) returned 0 [0054.447] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0054.447] GetLastError () returned 0xb7 [0054.447] CreateDirectoryW (lpPathName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy"), lpSecurityAttributes=0x0) returned 0 [0054.447] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy")) returned 0x10 [0054.447] GetLastError () returned 0xb7 [0054.447] CreateDirectoryW (lpPathName="C:\\Users\\FD1HVy\\AppData" (normalized: "c:\\users\\fd1hvy\\appdata"), lpSecurityAttributes=0x0) returned 0 [0054.447] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData" (normalized: "c:\\users\\fd1hvy\\appdata")) returned 0x12 [0054.447] GetLastError () returned 0xb7 [0054.447] CreateDirectoryW (lpPathName="C:\\Users\\FD1HVy\\AppData\\Local" (normalized: "c:\\users\\fd1hvy\\appdata\\local"), lpSecurityAttributes=0x0) returned 0 [0054.447] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local" (normalized: "c:\\users\\fd1hvy\\appdata\\local")) returned 0x10 [0054.448] GetLastError () returned 0xb7 [0054.448] CreateDirectoryW (lpPathName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp"), lpSecurityAttributes=0x0) returned 0 [0054.448] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp")) returned 0x10 [0054.448] GetLastError () returned 0xb7 [0054.448] CreateDirectoryW (lpPathName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0"), lpSecurityAttributes=0x0) returned 1 [0054.454] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0", dwFileAttributes=0x0) returned 1 [0054.454] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0")) returned 1 [0054.454] GetTickCount () returned 0x115e849 [0054.454] GetLastError () returned 0xb7 [0054.454] SetLastError (dwErrCode=0xb7) [0054.454] CreateFileW (lpFileName="__tmp_rar_sfx_access_check_18212937" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0\\__tmp_rar_sfx_access_check_18212937"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c [0054.456] CloseHandle (hObject=0x7c) returned 1 [0054.457] DeleteFileW (lpFileName="__tmp_rar_sfx_access_check_18212937" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0\\__tmp_rar_sfx_access_check_18212937")) returned 1 [0054.457] GetDlgItem (hDlg=0x502c0, nIDDlgItem=103) returned 0x202e2 [0054.457] ShowWindow (hWnd=0x202e2, nCmdShow=0) returned 1 [0054.457] GetDlgItem (hDlg=0x502c0, nIDDlgItem=102) returned 0x7005a [0054.457] ShowWindow (hWnd=0x7005a, nCmdShow=0) returned 1 [0054.458] LoadStringW (in: hInstance=0xd20000, uID=0xe6, lpBuffer=0xd61128, cchBufferMax=1024 | out: lpBuffer="暂停") returned 0x2 [0054.458] SetDlgItemTextW (hDlg=0x502c0, nIDDlgItem=1, lpString="暂停") returned 1 [0054.458] GetDlgItem (hDlg=0x502c0, nIDDlgItem=105) returned 0x402dc [0054.458] ShowWindow (hWnd=0x402dc, nCmdShow=9) returned 0 [0054.458] SetDlgItemTextW (hDlg=0x502c0, nIDDlgItem=101, lpString="") returned 1 [0054.458] GetDlgItem (hDlg=0x502c0, nIDDlgItem=101) returned 0x60068 [0054.459] GetProcAddress (hModule=0x769e0000, lpProcName="GetWindowLongW") returned 0x76a037e0 [0054.459] GetWindowLongW (hWnd=0x60068, nIndex=-16) returned 1342341120 [0054.459] GetProcAddress (hModule=0x769e0000, lpProcName="SetWindowLongW") returned 0x76a058c0 [0054.459] SetWindowLongW (hWnd=0x60068, nIndex=-16, dwNewLong=1342341248) returned 1342341120 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0054.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0054.466] ExpandEnvironmentStringsW (in: lpSrc="1.exe", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="1.exe") returned 0x6 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 2 [0054.466] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0054.466] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0054.466] ExpandEnvironmentStringsW (in: lpSrc="D, PasswordIskk2511, , , 1.exe, ", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="D, PasswordIskk2511, , , 1.exe, ") returned 0x21 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 2 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0054.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0054.468] ExpandEnvironmentStringsW (in: lpSrc="1.exe", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="1.exe") returned 0x6 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 2 [0054.468] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0054.468] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0054.468] ExpandEnvironmentStringsW (in: lpSrc="D, PasswordIskk2511, , , 1.exe, ", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="D, PasswordIskk2511, , , 1.exe, ") returned 0x21 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0054.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0054.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0054.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0054.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0054.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0054.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 2 [0054.469] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x13f5e0 [0054.469] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x46) returned 0x153530 [0054.469] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10c0) returned 0x15b720 [0054.469] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10c0) returned 0x15c7e8 [0054.469] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xe6e0) returned 0x15d8b0 [0054.469] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x8003) returned 0x16bf98 [0054.470] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x8003) returned 0x173fa8 [0054.471] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1b8) returned 0x148878 [0054.471] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x7c [0054.471] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x330 [0054.471] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe", lpFindFileData=0x937410 | out: lpFindFileData=0x937410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1909cf80, ftCreationTime.dwHighDateTime=0x1d5d01d, ftLastAccessTime.dwLowDateTime=0x19a26600, ftLastAccessTime.dwHighDateTime=0x1d5d01d, ftLastWriteTime.dwLowDateTime=0x17400c00, ftLastWriteTime.dwHighDateTime=0x1d5d01d, nFileSizeHigh=0x0, nFileSizeLow=0x4ed92, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinRAR.exe", cAlternateFileName="")) returned 0x14db50 [0054.471] FindClose (in: hFindFile=0x14db50 | out: hFindFile=0x14db50) returned 1 [0054.471] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10c0) returned 0x17bfb8 [0054.471] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10c0) returned 0x17d080 [0054.471] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winrar.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x334 [0054.472] ReadFile (in: hFile=0x334, lpBuffer=0x930b1c, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x92e8a0, lpOverlapped=0x0 | out: lpBuffer=0x930b1c*, lpNumberOfBytesRead=0x92e8a0*=0x7, lpOverlapped=0x0) returned 1 [0054.472] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x200000) returned 0x4614020 [0054.477] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e8d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e8d0*=0) returned 0x7 [0054.477] ReadFile (in: hFile=0x334, lpBuffer=0x4614020, nNumberOfBytesToRead=0x1ffff0, lpNumberOfBytesRead=0x92e8a0, lpOverlapped=0x0 | out: lpBuffer=0x4614020*, lpNumberOfBytesRead=0x92e8a0*=0x4ed8b, lpOverlapped=0x0) returned 1 [0054.512] SetFilePointer (in: hFile=0x334, lDistanceToMove=310784, lpDistanceToMoveHigh=0x92e8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x92e8c0*=0) returned 0x4be00 [0054.512] ReadFile (in: hFile=0x334, lpBuffer=0x930b1c, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x92e8a0, lpOverlapped=0x0 | out: lpBuffer=0x930b1c*, lpNumberOfBytesRead=0x92e8a0*=0x7, lpOverlapped=0x0) returned 1 [0054.512] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x4614020 | out: hHeap=0x110000) returned 1 [0054.521] ReadFile (in: hFile=0x334, lpBuffer=0x930b23, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x92e8a0, lpOverlapped=0x0 | out: lpBuffer=0x930b23*, lpNumberOfBytesRead=0x92e8a0*=0x1, lpOverlapped=0x0) returned 1 [0054.522] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e8c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e8c8*=0) returned 0x4be08 [0054.522] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x159550 [0054.522] ReadFile (in: hFile=0x334, lpBuffer=0x159550, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x92c788, lpOverlapped=0x0 | out: lpBuffer=0x159550*, lpNumberOfBytesRead=0x92c788*=0x7, lpOverlapped=0x0) returned 1 [0054.522] ReadFile (in: hFile=0x334, lpBuffer=0x159557, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x92c788, lpOverlapped=0x0 | out: lpBuffer=0x159557*, lpNumberOfBytesRead=0x92c788*=0xa, lpOverlapped=0x0) returned 1 [0054.522] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x159550 | out: hHeap=0x110000) returned 1 [0054.522] SetFilePointer (in: hFile=0x334, lDistanceToMove=310809, lpDistanceToMoveHigh=0x92e8bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x92e8bc*=0) returned 0x4be19 [0054.522] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e8d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e8d0*=0) returned 0x4be19 [0054.522] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e8c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e8c8*=0) returned 0x4be19 [0054.522] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x159438 [0054.522] ReadFile (in: hFile=0x334, lpBuffer=0x159438, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x92c788, lpOverlapped=0x0 | out: lpBuffer=0x159438*, lpNumberOfBytesRead=0x92c788*=0x7, lpOverlapped=0x0) returned 1 [0054.522] ReadFile (in: hFile=0x334, lpBuffer=0x15943f, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x92c788, lpOverlapped=0x0 | out: lpBuffer=0x15943f*, lpNumberOfBytesRead=0x92c788*=0x11, lpOverlapped=0x0) returned 1 [0054.522] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x159438 | out: hHeap=0x110000) returned 1 [0054.522] SetFilePointer (in: hFile=0x334, lDistanceToMove=310970, lpDistanceToMoveHigh=0x92e8bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x92e8bc*=0) returned 0x4beba [0054.522] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e8c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e8c8*=0) returned 0x4beba [0054.522] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x159230 [0054.522] ReadFile (in: hFile=0x334, lpBuffer=0x159230, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x92c788, lpOverlapped=0x0 | out: lpBuffer=0x159230*, lpNumberOfBytesRead=0x92c788*=0x7, lpOverlapped=0x0) returned 1 [0054.522] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x159230, Size=0x48) returned 0x153580 [0054.522] ReadFile (in: hFile=0x334, lpBuffer=0x153587, nNumberOfBytesToRead=0x21, lpNumberOfBytesRead=0x92c788, lpOverlapped=0x0 | out: lpBuffer=0x153587*, lpNumberOfBytesRead=0x92c788*=0x21, lpOverlapped=0x0) returned 1 [0054.523] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x153580 | out: hHeap=0x110000) returned 1 [0054.523] SetFilePointer (in: hFile=0x334, lDistanceToMove=310809, lpDistanceToMoveHigh=0x92e898*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x92e898*=0) returned 0x4be19 [0054.523] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e8d4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e8d4*=0) returned 0x4be19 [0054.523] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e8c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x92e8c4*=0) returned 0x4ed92 [0054.523] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e8d4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e8d4*=0) returned 0x4ed92 [0054.523] SetFilePointer (in: hFile=0x334, lDistanceToMove=310809, lpDistanceToMoveHigh=0x92e89c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x92e89c*=0) returned 0x4be19 [0054.523] GetSystemTime (in: lpSystemTime=0x92e8e8 | out: lpSystemTime=0x92e8e8*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x2, wDay=0x15, wHour=0x5, wMinute=0x28, wSecond=0x2, wMilliseconds=0x3b5)) [0054.523] SystemTimeToFileTime (in: lpSystemTime=0x92e8e8, lpFileTime=0x92e8f8 | out: lpFileTime=0x92e8f8) returned 1 [0054.524] LoadStringW (in: hInstance=0xd20000, uID=0x8d, lpBuffer=0xd61928, cchBufferMax=1024 | out: lpBuffer="正在从 %s 中提取") returned 0xa [0054.524] GetLastError () returned 0x0 [0054.524] SetLastError (dwErrCode=0x0) [0054.524] GetDlgItem (hDlg=0x502c0, nIDDlgItem=104) returned 0x60138 [0054.524] SendMessageW (hWnd=0x60138, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0xc [0054.524] SendMessageW (hWnd=0x60138, Msg=0x43a, wParam=0x0, lParam=0x92d49c) returned 0xf800003f [0054.524] SendMessageW (hWnd=0x60138, Msg=0x444, wParam=0x1, lParam=0x92d49c) returned 0x1 [0054.524] SendMessageW (hWnd=0x60138, Msg=0xc2, wParam=0x0, lParam=0x92d504) returned 0x12 [0054.529] SendMessageW (hWnd=0x60138, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x1e [0054.530] SendMessageW (hWnd=0x60138, Msg=0xc2, wParam=0x0, lParam=0xd5304c) returned 0x1 [0054.530] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e8c0*=0) returned 0x4be19 [0054.530] SetFilePointer (in: hFile=0x334, lDistanceToMove=310809, lpDistanceToMoveHigh=0x92e8ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x92e8ac*=0) returned 0x4be19 [0054.531] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e8a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e8a0*=0) returned 0x4be19 [0054.531] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x159500 [0054.531] ReadFile (in: hFile=0x334, lpBuffer=0x159500, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x92c760, lpOverlapped=0x0 | out: lpBuffer=0x159500*, lpNumberOfBytesRead=0x92c760*=0x7, lpOverlapped=0x0) returned 1 [0054.531] ReadFile (in: hFile=0x334, lpBuffer=0x159507, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x92c760, lpOverlapped=0x0 | out: lpBuffer=0x159507*, lpNumberOfBytesRead=0x92c760*=0x11, lpOverlapped=0x0) returned 1 [0054.531] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x159500 | out: hHeap=0x110000) returned 1 [0054.531] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x8003) returned 0x17e148 [0054.531] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x8003) returned 0x186158 [0054.532] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40000) returned 0x18e168 [0054.536] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x89) returned 0x15b2e8 [0054.536] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xb54) returned 0x1ce170 [0054.536] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x100000) returned 0x4610020 [0054.539] ReadFile (in: hFile=0x334, lpBuffer=0x4610020, nNumberOfBytesToRead=0x89, lpNumberOfBytesRead=0x9200f4, lpOverlapped=0x0 | out: lpBuffer=0x4610020*, lpNumberOfBytesRead=0x9200f4*=0x89, lpOverlapped=0x0) returned 1 [0054.539] PeekMessageW (in: lpMsg=0x9200fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x9200fc) returned 1 [0054.540] GetMessageW (in: lpMsg=0x9200fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x9200fc) returned 1 [0054.540] TranslateMessage (lpMsg=0x9200fc) returned 0 [0054.540] DispatchMessageW (lpMsg=0x9200fc) returned 0x0 [0054.540] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0054.540] PeekMessageW (in: lpMsg=0x920100, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x920100) returned 1 [0054.713] GetMessageW (in: lpMsg=0x920100, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x920100) returned 1 [0054.714] TranslateMessage (lpMsg=0x920100) returned 0 [0054.714] DispatchMessageW (lpMsg=0x920100) returned 0x0 [0054.714] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0054.714] PeekMessageW (in: lpMsg=0x9200f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x9200f4) returned 1 [0054.714] GetMessageW (in: lpMsg=0x9200f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x9200f4) returned 1 [0054.714] TranslateMessage (lpMsg=0x9200f4) returned 0 [0054.714] DispatchMessageW (lpMsg=0x9200f4) returned 0x0 [0054.714] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0054.714] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x4610020 | out: hHeap=0x110000) returned 1 [0054.717] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x18e168 | out: hHeap=0x110000) returned 1 [0054.717] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x186158 | out: hHeap=0x110000) returned 1 [0054.717] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x17e148 | out: hHeap=0x110000) returned 1 [0054.719] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x15b2e8, Size=0xcb) returned 0x15b3e8 [0054.719] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x114) returned 0x1128a8 [0054.719] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x15b3e8 | out: hHeap=0x110000) returned 1 [0054.719] SetFilePointer (in: hFile=0x334, lDistanceToMove=310809, lpDistanceToMoveHigh=0x92e888*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x92e888*=0) returned 0x4be19 [0054.719] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1128a8 | out: hHeap=0x110000) returned 1 [0054.719] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e910*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e910*=0) returned 0x4be19 [0054.719] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x159258 [0054.719] ReadFile (in: hFile=0x334, lpBuffer=0x159258, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x92c7d0, lpOverlapped=0x0 | out: lpBuffer=0x159258*, lpNumberOfBytesRead=0x92c7d0*=0x7, lpOverlapped=0x0) returned 1 [0054.719] ReadFile (in: hFile=0x334, lpBuffer=0x15925f, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x92c7d0, lpOverlapped=0x0 | out: lpBuffer=0x15925f*, lpNumberOfBytesRead=0x92c7d0*=0x11, lpOverlapped=0x0) returned 1 [0054.719] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x159258 | out: hHeap=0x110000) returned 1 [0054.719] SetFilePointer (in: hFile=0x334, lDistanceToMove=310970, lpDistanceToMoveHigh=0x92973c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x92973c*=0) returned 0x4beba [0054.719] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e910*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e910*=0) returned 0x4beba [0054.719] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x1596b8 [0054.719] ReadFile (in: hFile=0x334, lpBuffer=0x1596b8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x92c7d0, lpOverlapped=0x0 | out: lpBuffer=0x1596b8*, lpNumberOfBytesRead=0x92c7d0*=0x7, lpOverlapped=0x0) returned 1 [0054.719] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x1596b8, Size=0x48) returned 0x153580 [0054.719] ReadFile (in: hFile=0x334, lpBuffer=0x153587, nNumberOfBytesToRead=0x21, lpNumberOfBytesRead=0x92c7d0, lpOverlapped=0x0 | out: lpBuffer=0x153587*, lpNumberOfBytesRead=0x92c7d0*=0x21, lpOverlapped=0x0) returned 1 [0054.719] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x153580 | out: hHeap=0x110000) returned 1 [0054.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="1.exe", cchCount2=1) returned 1 [0054.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="1.exe", cchCount2=-1) returned 1 [0054.719] SetFilePointer (in: hFile=0x334, lDistanceToMove=311010, lpDistanceToMoveHigh=0x929740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x929740*=0) returned 0x4bee2 [0054.720] LoadStringW (in: hInstance=0xd20000, uID=0x65, lpBuffer=0xd62128, cchBufferMax=1024 | out: lpBuffer="正在解压 %s") returned 0x7 [0054.720] GetLastError () returned 0x0 [0054.720] SetLastError (dwErrCode=0x0) [0054.720] SetDlgItemTextW (hDlg=0x502c0, nIDDlgItem=101, lpString="正在解压 1.exe") returned 1 [0054.720] PeekMessageW (in: lpMsg=0x92831c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x92831c) returned 1 [0054.720] GetMessageW (in: lpMsg=0x92831c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x92831c) returned 1 [0054.720] TranslateMessage (lpMsg=0x92831c) returned 0 [0054.720] DispatchMessageW (lpMsg=0x92831c) returned 0x0 [0054.723] GetFileAttributesW (lpFileName="1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0\\1.exe")) returned 0xffffffff [0054.723] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x9266d4 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0") returned 0x2a [0054.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0\\1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0\\1.exe")) returned 0xffffffff [0054.723] CreateFileW (lpFileName="1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0\\1.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0054.723] GetFileType (hFile=0x33c) returned 0x1 [0054.723] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xb54) returned 0x1cf4d8 [0054.723] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xb54) returned 0x1d0038 [0054.723] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40000) returned 0x17e148 [0054.770] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x400400) returned 0x461c020 [0054.853] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x25724) returned 0x4a20048 [0054.856] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x30c00) returned 0x4a45778 [0054.856] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x30c00) returned 0x4a76380 [0054.857] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x30c00) returned 0x4aa6f88 [0054.858] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x30c00) returned 0x4ad7b90 [0054.858] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x30c00) returned 0x4b20048 [0054.859] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x30c00) returned 0x4b50c50 [0054.860] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x30c00) returned 0x4b81858 [0054.860] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x30c00) returned 0x4bb2460 [0054.861] ReadFile (in: hFile=0x334, lpBuffer=0x461c020, nNumberOfBytesToRead=0x2e64, lpNumberOfBytesRead=0x9295b0, lpOverlapped=0x0 | out: lpBuffer=0x461c020*, lpNumberOfBytesRead=0x9295b0*=0x2e64, lpOverlapped=0x0) returned 1 [0054.861] SendDlgItemMessageW (hDlg=0x502c0, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x0 [0054.864] PeekMessageW (in: lpMsg=0x929554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x929554) returned 1 [0054.864] GetMessageW (in: lpMsg=0x929554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x929554) returned 1 [0054.864] TranslateMessage (lpMsg=0x929554) returned 0 [0054.864] DispatchMessageW (lpMsg=0x929554) returned 0x0 [0054.864] PeekMessageW (in: lpMsg=0x9295b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x9295b8) returned 1 [0054.864] GetMessageW (in: lpMsg=0x9295b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x9295b8) returned 1 [0054.865] TranslateMessage (lpMsg=0x9295b8) returned 0 [0054.865] DispatchMessageW (lpMsg=0x9295b8) returned 0x0 [0054.865] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0054.865] SendDlgItemMessageW (hDlg=0x502c0, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x63 [0054.866] PeekMessageW (in: lpMsg=0x929554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x929554) returned 1 [0054.867] GetMessageW (in: lpMsg=0x929554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x929554) returned 1 [0054.867] TranslateMessage (lpMsg=0x929554) returned 0 [0054.867] DispatchMessageW (lpMsg=0x929554) returned 0x0 [0054.868] PeekMessageW (in: lpMsg=0x9295b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x9295b8) returned 1 [0054.868] GetMessageW (in: lpMsg=0x9295b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x9295b8) returned 1 [0054.868] TranslateMessage (lpMsg=0x9295b8) returned 0 [0054.868] DispatchMessageW (lpMsg=0x9295b8) returned 0x0 [0054.869] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0054.869] WriteFile (in: hFile=0x33c, lpBuffer=0x17e148*, nNumberOfBytesToWrite=0x3400, lpNumberOfBytesWritten=0x929588, lpOverlapped=0x0 | out: lpBuffer=0x17e148*, lpNumberOfBytesWritten=0x929588*=0x3400, lpOverlapped=0x0) returned 1 [0054.870] PeekMessageW (in: lpMsg=0x92955c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x92955c) returned 1 [0054.870] GetMessageW (in: lpMsg=0x92955c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x92955c) returned 1 [0054.870] TranslateMessage (lpMsg=0x92955c) returned 0 [0054.870] DispatchMessageW (lpMsg=0x92955c) returned 0x0 [0054.870] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0054.870] SetFilePointer (in: hFile=0x334, lDistanceToMove=322886, lpDistanceToMoveHigh=0x92973c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x92973c*=0) returned 0x4ed46 [0054.870] SetFileTime (hFile=0x33c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x929730) returned 1 [0054.871] CloseHandle (hObject=0x33c) returned 1 [0054.872] SetFileAttributesW (lpFileName="1.exe", dwFileAttributes=0x20) returned 1 [0054.872] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e910*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e910*=0) returned 0x4ed46 [0054.873] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x159668 [0054.873] ReadFile (in: hFile=0x334, lpBuffer=0x159668, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x92c7d0, lpOverlapped=0x0 | out: lpBuffer=0x159668*, lpNumberOfBytesRead=0x92c7d0*=0x7, lpOverlapped=0x0) returned 1 [0054.873] ReadFile (in: hFile=0x334, lpBuffer=0x15966f, nNumberOfBytesToRead=0xc, lpNumberOfBytesRead=0x92c7d0, lpOverlapped=0x0 | out: lpBuffer=0x15966f*, lpNumberOfBytesRead=0x92c7d0*=0xc, lpOverlapped=0x0) returned 1 [0054.873] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x159668 | out: hHeap=0x110000) returned 1 [0054.873] SetFilePointer (in: hFile=0x334, lDistanceToMove=322954, lpDistanceToMoveHigh=0x92973c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x92973c*=0) returned 0x4ed8a [0054.873] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x92e910*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x92e910*=0) returned 0x4ed8a [0054.873] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x1592a8 [0054.873] ReadFile (in: hFile=0x334, lpBuffer=0x1592a8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x92c7d0, lpOverlapped=0x0 | out: lpBuffer=0x1592a8*, lpNumberOfBytesRead=0x92c7d0*=0x7, lpOverlapped=0x0) returned 1 [0054.873] ReadFile (in: hFile=0x334, lpBuffer=0x1592af, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x92c7d0, lpOverlapped=0x0 | out: lpBuffer=0x1592af*, lpNumberOfBytesRead=0x92c7d0*=0x1, lpOverlapped=0x0) returned 1 [0054.873] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1592a8 | out: hHeap=0x110000) returned 1 [0054.873] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x17bfb8 | out: hHeap=0x110000) returned 1 [0054.873] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x17d080 | out: hHeap=0x110000) returned 1 [0054.873] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1ce170 | out: hHeap=0x110000) returned 1 [0054.873] CloseHandle (hObject=0x334) returned 1 [0054.873] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WinRAR.exe", lpFindFileData=0x937410 | out: lpFindFileData=0x937410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1909cf80, ftCreationTime.dwHighDateTime=0x1d5d01d, ftLastAccessTime.dwLowDateTime=0x19a26600, ftLastAccessTime.dwHighDateTime=0x1d5d01d, ftLastWriteTime.dwLowDateTime=0x17400c00, ftLastWriteTime.dwHighDateTime=0x1d5d01d, nFileSizeHigh=0x0, nFileSizeLow=0x4ed92, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinRAR.exe", cAlternateFileName="")) returned 0x14d950 [0054.873] FindClose (in: hFindFile=0x14d950 | out: hFindFile=0x14d950) returned 1 [0054.873] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x17e148 | out: hHeap=0x110000) returned 1 [0054.875] ReleaseSemaphore (in: hSemaphore=0x7c, lReleaseCount=32, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0054.875] CloseHandle (hObject=0x7c) returned 1 [0054.876] CloseHandle (hObject=0x330) returned 1 [0054.876] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x148878 | out: hHeap=0x110000) returned 1 [0054.876] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x461c020 | out: hHeap=0x110000) returned 1 [0054.895] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x4bb2460 | out: hHeap=0x110000) returned 1 [0054.895] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x4b81858 | out: hHeap=0x110000) returned 1 [0054.897] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x4b50c50 | out: hHeap=0x110000) returned 1 [0054.899] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x4b20048 | out: hHeap=0x110000) returned 1 [0054.900] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x4ad7b90 | out: hHeap=0x110000) returned 1 [0054.901] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x4aa6f88 | out: hHeap=0x110000) returned 1 [0054.902] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x4a76380 | out: hHeap=0x110000) returned 1 [0054.905] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x4a45778 | out: hHeap=0x110000) returned 1 [0054.905] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x4a20048 | out: hHeap=0x110000) returned 1 [0054.905] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x173fa8 | out: hHeap=0x110000) returned 1 [0054.906] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x16bf98 | out: hHeap=0x110000) returned 1 [0054.908] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x15d8b0 | out: hHeap=0x110000) returned 1 [0054.910] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x15b720 | out: hHeap=0x110000) returned 1 [0054.910] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x15c7e8 | out: hHeap=0x110000) returned 1 [0054.911] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1cf4d8 | out: hHeap=0x110000) returned 1 [0054.911] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1d0038 | out: hHeap=0x110000) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0054.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0054.913] ExpandEnvironmentStringsW (in: lpSrc="1.exe", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="1.exe") returned 0x6 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0054.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 2 [0054.914] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0054.914] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.914] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.914] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.914] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0054.914] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0054.914] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0054.914] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.914] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.914] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0054.915] ExpandEnvironmentStringsW (in: lpSrc="D, PasswordIskk2511, , , 1.exe, ", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="D, PasswordIskk2511, , , 1.exe, ") returned 0x21 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0054.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 2 [0054.915] GetFileAttributesW (lpFileName="PasswordIskk2511" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0\\passwordiskk2511")) returned 0xffffffff [0054.915] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x91db2c | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0") returned 0x2a [0054.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0\\PasswordIskk2511" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0\\passwordiskk2511")) returned 0xffffffff [0054.915] GetFullPathNameW (in: lpFileName="PasswordIskk2511", nBufferLength=0x800, lpBuffer=0x91db48, lpFilePart=0x91db44 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0\\PasswordIskk2511", lpFilePart=0x91db44*="PasswordIskk2511") returned 0x3b [0054.915] SHGetMalloc (in: ppMalloc=0x91fb40 | out: ppMalloc=0x91fb40*=0x7488d000) returned 0x0 [0054.916] GetProcAddress (hModule=0x74a80000, lpProcName="SHGetFolderLocation") returned 0x74b64530 [0054.916] SHGetFolderLocation (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, ppidl=0x91fb44 | out: ppidl=0x91fb44) returned 0x0 [0055.389] GetProcAddress (hModule=0x74a80000, lpProcName="SHGetPathFromIDListW") returned 0x74b8bda0 [0055.389] SHGetPathFromIDListW (in: pidl=0x1d4428, pszPath=0x938bb4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0055.390] IMalloc:Free (This=0x7488d000, pv=0x1d4428) [0055.390] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=".exe", cchCount1=-1, lpString2=".lnk", cchCount2=-1) returned 1 [0055.390] CreateDirectoryW (lpPathName="C:\\Users" (normalized: "c:\\users"), lpSecurityAttributes=0x0) returned 0 [0055.390] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0055.390] GetLastError () returned 0xb7 [0055.390] CreateDirectoryW (lpPathName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy"), lpSecurityAttributes=0x0) returned 0 [0055.390] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy")) returned 0x10 [0055.390] GetLastError () returned 0xb7 [0055.390] CreateDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop"), lpSecurityAttributes=0x0) returned 0 [0055.390] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0055.390] GetLastError () returned 0xb7 [0055.391] GetProcAddress (hModule=0x760e0000, lpProcName="CoCreateInstance") returned 0x74737490 [0055.391] CoCreateInstance (in: rclsid=0xd5416c*(Data1=0x21401, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xd5407c*(Data1=0x214f9, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x91fb30 | out: ppv=0x91fb30*=0x1d4670) returned 0x0 [0055.393] ShellLink:IUnknown:QueryInterface (in: This=0x1d4670, riid=0xd5415c*(Data1=0x10b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x91fb2c | out: ppvObject=0x91fb2c*=0x1d467c) returned 0x0 [0055.395] ShellLink:IShellLinkW:SetPath (This=0x1d4670, pszFile="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0\\PasswordIskk2511") returned 0x0 [0055.405] ShellLink:IShellLinkW:SetIconLocation (This=0x1d4670, pszIconPath="", iIcon=0) returned 0x0 [0055.405] ShellLink:IShellLinkW:SetWorkingDirectory (This=0x1d4670, pszDir="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0") returned 0x0 [0055.405] ShellLink:IPersistFile:Save (This=0x1d467c, pszFileName="C:\\Users\\FD1HVy\\Desktop\\1.exe.lnk", fRemember=1) returned 0x0 [0055.439] ShellLink:IUnknown:Release (This=0x1d467c) returned 0x1 [0055.439] ShellLink:IUnknown:Release (This=0x1d4670) returned 0x0 [0055.439] GetProcAddress (hModule=0x74a80000, lpProcName="SHChangeNotify") returned 0x74bab180 [0055.439] SHChangeNotify (wEventId=4096, uFlags=0x5, dwItem1=0x92eb64, dwItem2=0x0) [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";下面的注释包含自解压脚本命令", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0055.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0055.443] ExpandEnvironmentStringsW (in: lpSrc="1.exe", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="1.exe") returned 0x6 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0055.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=".exe", cchCount1=-1, lpString2=".inf", cchCount2=-1) returned 1 [0055.443] GetFileAttributesW (lpFileName="1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0\\1.exe")) returned 0x20 [0055.443] GetFullPathNameW (in: lpFileName="1.exe", nBufferLength=0x800, lpBuffer=0x91cae8, lpFilePart=0x91cae4 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0\\1.exe", lpFilePart=0x91cae4*="1.exe") returned 0x30 [0055.443] GetProcAddress (hModule=0x74a80000, lpProcName="ShellExecuteExW") returned 0x74be4730 [0055.443] ShellExecuteExW (in: pExecInfo=0x91eb0c*(cbSize=0x3c, fMask=0x1c0, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0\\1.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x91eb0c*(cbSize=0x3c, fMask=0x1c0, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0\\1.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x530)) returned 1 [0061.224] GetProcAddress (hModule=0x769e0000, lpProcName="IsWindowVisible") returned 0x769f77b0 [0061.224] IsWindowVisible (hWnd=0x502c0) returned 0 [0061.224] GetProcAddress (hModule=0x769e0000, lpProcName="WaitForInputIdle") returned 0x76a5aee0 [0061.226] WaitForInputIdle (hProcess=0x530, dwMilliseconds=0x7d0) returned 0x0 [0062.475] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.491] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.491] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.499] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.500] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.515] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.515] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.530] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.530] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.546] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.546] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.561] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.562] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.578] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.578] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.593] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.593] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.608] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.608] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.624] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.624] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.639] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.640] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.656] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.656] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.671] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.671] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.686] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.686] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.780] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.781] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.796] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.796] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.811] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.812] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.827] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0062.827] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.845] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.845] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.875] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.875] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.890] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.890] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.906] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.906] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.921] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0062.921] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.939] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.939] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0062.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.968] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0062.968] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.983] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.983] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0062.999] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0062.999] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.014] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.015] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.030] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.030] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.046] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.046] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.062] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.062] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.121] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.122] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.126] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.126] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.139] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.140] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.155] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.155] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.202] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.202] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.218] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.218] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.233] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.233] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.249] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.249] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.265] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.265] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.296] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.296] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.311] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.311] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.327] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.327] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.343] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.343] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.359] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.359] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.376] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.376] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.391] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.391] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.405] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.405] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.421] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.422] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.436] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.436] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.452] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.452] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.468] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.468] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.492] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.492] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.499] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.499] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.515] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.515] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.531] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.531] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.546] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.546] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.564] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.564] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.578] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.578] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.608] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.608] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.626] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.626] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.640] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.640] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.656] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.656] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.674] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.674] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.694] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.694] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.753] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.753] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.764] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.765] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.780] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.780] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.796] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.796] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.811] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.812] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.827] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.827] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.843] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.843] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.858] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.858] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.874] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.874] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.890] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.890] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.905] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.905] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.921] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.921] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.936] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.936] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.952] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.952] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.968] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.968] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0063.984] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0063.999] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0063.999] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.018] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.046] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.046] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.061] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.062] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.077] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.077] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.093] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.093] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.108] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.108] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.124] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.124] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.140] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.140] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.155] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.155] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.171] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.171] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.186] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.187] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.202] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.202] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.218] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.218] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.233] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.233] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.249] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.249] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.264] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.264] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.280] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.280] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.296] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.296] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.312] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.312] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.327] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.327] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.343] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.344] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.374] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.374] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.390] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.390] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.405] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.405] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.420] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.420] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.441] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.441] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.457] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.457] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.473] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.473] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.532] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.532] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.535] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.535] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.551] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.551] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.566] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.582] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.582] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.598] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.598] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.614] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.614] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.630] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.645] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.645] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.660] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.660] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.676] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.676] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.691] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.691] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.707] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.707] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.722] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.722] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.785] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.785] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.801] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.801] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.816] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.816] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.832] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.832] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.847] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.847] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.863] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.863] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.879] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.879] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.894] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.894] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.926] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.926] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.941] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.941] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.957] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.957] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.972] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0064.972] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0064.988] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0064.988] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.004] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.004] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.020] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.020] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.035] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.035] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.051] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.066] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.066] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.082] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.082] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.097] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.097] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.129] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.129] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.144] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.144] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.160] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.160] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.176] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.176] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.191] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.191] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.207] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.207] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.222] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.222] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.238] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.238] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.254] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.254] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.270] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.270] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.287] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.316] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.317] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.332] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.332] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.348] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.348] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.363] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.363] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.379] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.379] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.395] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.410] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.410] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.426] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.426] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.441] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.441] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.457] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.457] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.472] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.473] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.520] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.520] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.535] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.535] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.550] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.551] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.567] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.567] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.582] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.582] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.598] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.598] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.614] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.629] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.629] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.644] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.645] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.661] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.661] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.691] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.691] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.716] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.716] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.731] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.732] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.772] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.772] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.857] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.857] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0065.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0065.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0065.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.049] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.049] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.106] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.106] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.137] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.226] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.226] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.369] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.369] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0066.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.934] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.934] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.982] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.982] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0066.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0066.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.296] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.296] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.403] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.404] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.461] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.461] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.816] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.816] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0067.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0067.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0067.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0068.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0068.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0068.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.309] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.409] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.419] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.436] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.436] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0068.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0068.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0068.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0068.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0068.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.899] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.899] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0068.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0068.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0068.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0068.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.152] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.200] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.200] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.225] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.225] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.352] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.369] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.369] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.430] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.430] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.461] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.461] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.476] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.476] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.523] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.523] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.539] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.539] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.554] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.554] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.570] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.586] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.586] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.601] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.601] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.617] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.617] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.633] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.633] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.648] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.648] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.690] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.690] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.695] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.695] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.711] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.711] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.727] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.727] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.742] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.742] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.758] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.758] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.852] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.852] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.867] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.867] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.883] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.883] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.898] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.898] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.914] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.914] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.930] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0069.930] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0069.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0069.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.007] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.008] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.024] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.063] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.063] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.071] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.086] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.086] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.101] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.102] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.117] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.117] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.133] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.133] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.148] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.148] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.164] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.164] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.179] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.180] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.211] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.211] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.226] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.226] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.242] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.242] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.258] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.258] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.273] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.273] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.289] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.289] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.304] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.305] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.320] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.320] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.336] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.336] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.351] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.352] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.392] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.392] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.398] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.398] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.414] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.414] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.430] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.430] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.445] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.445] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.461] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.461] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.476] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.476] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.523] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.523] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.539] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.539] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.559] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.559] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.584] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.584] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.586] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.586] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.601] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.601] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.617] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.617] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.633] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.633] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.649] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.649] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.664] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.664] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.695] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.695] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.727] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.727] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.758] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.758] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.831] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.831] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.836] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.836] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.851] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.851] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.867] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.867] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.883] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.883] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.904] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.904] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.914] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.914] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.930] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.930] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.961] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0070.961] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0070.992] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0070.992] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.008] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.008] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.024] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.039] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.039] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.054] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.055] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.117] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.117] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.133] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.133] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.148] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.148] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.164] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.164] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.195] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.195] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.212] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.212] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.238] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.238] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.257] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.258] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.298] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.298] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.336] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.336] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.351] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.352] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.367] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.367] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.389] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.389] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.398] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.398] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.414] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.414] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.429] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.430] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.476] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.476] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.528] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.528] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.566] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.582] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.586] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.586] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.601] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.602] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.617] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.617] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.633] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.633] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.649] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.649] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.664] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.664] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.680] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.680] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.695] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0071.695] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.930] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.930] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.977] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.977] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0071.992] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0071.992] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.008] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.008] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.023] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.023] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.051] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.055] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.055] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.159] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.160] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.164] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.165] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.180] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.180] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.195] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.195] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.211] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.211] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.272] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.272] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.274] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.274] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.289] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.289] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.305] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.305] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.320] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.320] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.336] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.336] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.373] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.373] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.383] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.383] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.414] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.414] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.429] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.429] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.445] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.445] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.461] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.461] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.477] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.477] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.523] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.523] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.554] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.555] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.586] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.586] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.601] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.601] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.617] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.617] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.633] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.633] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.648] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.648] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.664] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.664] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.680] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.680] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.695] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.695] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.711] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.711] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.726] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.726] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.758] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.758] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.820] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.820] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.836] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.836] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.851] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.851] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.914] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.914] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.929] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.930] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.945] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.945] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.961] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0072.961] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.977] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.977] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0072.992] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0072.992] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.008] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.008] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.023] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.023] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.039] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.039] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.054] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.055] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.070] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.070] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.086] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.086] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.102] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.102] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.117] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.117] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.133] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.133] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.148] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.148] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.164] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.164] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.179] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.179] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.195] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.195] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.211] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.211] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.226] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.226] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.243] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.289] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.289] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.304] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.305] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.435] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.435] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.445] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.445] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.461] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.461] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.476] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.476] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.497] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.498] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.523] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.523] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.539] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.539] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.570] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.570] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.598] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.598] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.602] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.602] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.617] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.617] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.632] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.632] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.649] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.649] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.664] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.664] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.680] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.680] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.695] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.695] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.711] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.726] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.726] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.805] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.805] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.820] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.820] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.836] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.836] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.851] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.851] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.867] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.867] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.883] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.883] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.898] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.898] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.914] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.914] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.930] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.930] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.945] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.945] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.961] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.961] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.976] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0073.976] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0073.992] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0073.992] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.008] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0074.008] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.023] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.023] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.039] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.039] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.055] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0074.055] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.070] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.070] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.272] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.272] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.273] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.273] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.306] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.321] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.321] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.336] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.336] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.351] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.351] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.367] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.367] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.383] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.383] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.398] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0074.398] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.429] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.429] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.458] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.476] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.477] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.498] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.498] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.523] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.524] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.539] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.539] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.554] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0074.555] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.570] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.570] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.586] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.586] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.601] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0074.601] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.617] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.617] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.632] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0074.632] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.648] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0074.648] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.758] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.758] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.835] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.835] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.865] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.867] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.867] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.921] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.921] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.936] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.936] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.945] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.945] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.961] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.961] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.986] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.986] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0074.992] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0074.992] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.008] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.008] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.068] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.101] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.101] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.117] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.117] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.133] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.133] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.148] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.148] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.164] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.165] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.195] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.195] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.211] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.211] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.226] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.226] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.274] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.274] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.289] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.289] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.305] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.306] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.320] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.320] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.336] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.336] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.351] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.351] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.367] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.367] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.383] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.383] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.414] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.414] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.430] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.430] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.445] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.445] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.461] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.461] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.477] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.477] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.500] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.500] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.508] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.508] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.523] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.524] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.539] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.539] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.554] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.555] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.586] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.586] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.601] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.601] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.618] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.618] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.633] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.633] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.649] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.649] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.680] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.680] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.695] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.695] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.711] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.711] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.726] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.726] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.800] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.800] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.801] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.801] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.817] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.817] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.832] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.832] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.895] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.895] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0075.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0075.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0075.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.122] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.122] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.369] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.369] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.502] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.502] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.801] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.801] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0076.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0076.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0076.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.028] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.029] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.046] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.046] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.369] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.369] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.487] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.487] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.727] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.727] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.811] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.811] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.887] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.887] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0077.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0077.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0077.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.502] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.502] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.691] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.691] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.703] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.703] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.793] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.793] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.951] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.951] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0078.984] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0078.999] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0078.999] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.131] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.132] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.511] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.511] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.798] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.799] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.829] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.829] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.871] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.871] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0079.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0079.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0079.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0080.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.121] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.121] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.137] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0080.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.215] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0080.230] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0080.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.262] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.512] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.512] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.611] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.623] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.623] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0080.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.732] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.732] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.794] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.794] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0080.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.840] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.840] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.887] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.887] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0080.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0080.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.965] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0080.965] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0080.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0080.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.043] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.076] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.076] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.121] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.121] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.152] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.218] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.218] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.230] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.310] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.311] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.403] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.403] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.434] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.434] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.511] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.511] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.574] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.574] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.699] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.842] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.842] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.857] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.860] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.872] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.872] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.890] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.892] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.919] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0081.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0081.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0081.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.079] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.098] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.152] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.215] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.215] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.230] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.279] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.279] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.444] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.445] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.504] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.504] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.511] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.511] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.574] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.606] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.606] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.793] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.793] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.949] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0082.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0082.997] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0082.997] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0083.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.140] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.140] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.155] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.155] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.195] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.195] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.215] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.215] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.230] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.246] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0083.246] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.262] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.311] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.311] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.333] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.343] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0083.343] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.366] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.366] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.379] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.379] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.419] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.419] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0083.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.452] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.452] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.465] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.465] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.504] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.574] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.574] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0083.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.716] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.717] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0083.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.820] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.820] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0083.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0083.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.965] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0083.965] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0083.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0083.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0084.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.043] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0084.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0084.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0084.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.121] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.170] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.170] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0084.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0084.230] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0084.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0084.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0084.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0084.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0084.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.543] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.543] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.617] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.617] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.631] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.631] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.694] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.709] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.724] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0084.724] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.740] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.740] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.899] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.899] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0084.950] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0084.961] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.032] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.055] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.055] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.067] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.067] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.099] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.130] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.130] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.146] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.146] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.161] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.177] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.208] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.208] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.224] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.224] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.239] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.239] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.255] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.255] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.271] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.271] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.302] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.317] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.317] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.333] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.364] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.364] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.396] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.396] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.411] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.427] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.427] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.442] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.442] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.459] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.506] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.506] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.537] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.537] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.552] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.654] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.654] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.661] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.661] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.710] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.711] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.804] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.804] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.817] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.817] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.832] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.832] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.863] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.863] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.879] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.879] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.894] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0085.894] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.910] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.910] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.926] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0085.926] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0085.970] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.039] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.051] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.101] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.101] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.369] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.369] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.717] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.717] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.817] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.817] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.825] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.826] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0086.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0086.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0086.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.196] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.344] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.344] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.369] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.369] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.809] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.810] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0087.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0087.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0087.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.413] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.595] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.595] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.742] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.742] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0088.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0088.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0088.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.074] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.369] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.369] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.575] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.575] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.637] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.653] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.715] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.715] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.772] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.772] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.871] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.871] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.949] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0089.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0089.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0089.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.074] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.075] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.230] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.340] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.511] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.511] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.543] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.590] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.590] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.768] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.768] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.812] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.812] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.858] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.858] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.872] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.920] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.920] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.951] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0090.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0090.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0090.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.074] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.091] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.108] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.108] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.230] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.246] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.246] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.294] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.294] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.465] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.514] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.514] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.567] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.606] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.606] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.670] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.670] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.852] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.852] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.905] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.906] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0091.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.949] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0091.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0091.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.121] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.121] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.170] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.170] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.189] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.230] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.387] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.387] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.520] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.520] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.574] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0092.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.949] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0092.999] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0092.999] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.044] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.044] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.157] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.157] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.169] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.169] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.215] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.216] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.246] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.246] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.279] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.279] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.450] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.451] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.481] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.481] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.498] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.498] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.519] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.519] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.566] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.810] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.810] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.950] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.950] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0093.981] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0093.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0093.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.121] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.137] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.152] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.230] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.246] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.246] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.296] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.296] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.333] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.519] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.519] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.528] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.528] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.600] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.601] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.614] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.614] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.630] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.645] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.645] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.661] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.661] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.692] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.692] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.708] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.723] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.723] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.817] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.817] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.833] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.848] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.848] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.864] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.864] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.895] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.895] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.911] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.926] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.926] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.942] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.958] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.974] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0094.974] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0094.989] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0094.989] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.005] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.022] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.022] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.036] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.036] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.051] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.067] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.067] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.098] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.098] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.130] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.130] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.146] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.146] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.161] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.178] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.178] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.208] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.208] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.223] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.224] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.239] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.239] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.255] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.255] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.271] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.271] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.301] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.333] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.348] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.364] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.364] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.395] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.395] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.411] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.427] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.427] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.442] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.442] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.470] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.472] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.492] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.505] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.521] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.521] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.555] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.570] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.608] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.608] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.614] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.614] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.630] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.708] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.708] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.723] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.723] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.833] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.848] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.848] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.864] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.864] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.895] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.895] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.911] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.928] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0095.928] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.942] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.959] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0095.989] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0095.989] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.006] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.065] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.065] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.067] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.067] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.092] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.092] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.101] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.102] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.116] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.116] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.157] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.157] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.238] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.238] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.254] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.254] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.269] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.269] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.285] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.285] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.300] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.300] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.316] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.316] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.331] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.331] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.347] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.347] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.363] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.363] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.378] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.378] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.394] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.410] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.410] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.425] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.425] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.441] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.441] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.456] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.456] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.472] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.472] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.488] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.488] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.528] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.528] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.535] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.535] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.550] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.550] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.566] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.581] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.581] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.597] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.597] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.613] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.613] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.628] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.628] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.691] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.691] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.707] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.707] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.722] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.722] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.737] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.737] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.754] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.754] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.769] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.769] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.830] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.830] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.831] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.831] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.847] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.847] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.863] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.863] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.878] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.878] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.894] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.894] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.909] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.910] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.925] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.925] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.941] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.941] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.956] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.956] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.973] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0096.973] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0096.988] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0096.988] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.003] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.003] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.019] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.020] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.034] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.035] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.066] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.066] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.081] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.097] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.097] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.113] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.113] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.128] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.128] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.144] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.144] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.160] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.160] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.175] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.175] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.194] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.194] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.207] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.207] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.224] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.224] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.238] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.238] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.253] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.253] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.270] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.270] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.295] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.295] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.301] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.301] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.316] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.316] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.332] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.332] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.347] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.347] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.379] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.379] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.394] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.409] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.409] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.425] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.426] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.472] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.472] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.488] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.488] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.530] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.530] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.535] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.535] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.550] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.550] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.566] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.581] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.581] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.597] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.597] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.618] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.628] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.629] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.644] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.644] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.660] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.660] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.675] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.675] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.691] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.692] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.706] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.706] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.722] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.722] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.738] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.738] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.753] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.754] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.770] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0097.770] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.831] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.831] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.919] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.920] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.925] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.925] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.941] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.941] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.956] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.957] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.972] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.972] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0097.988] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0097.988] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.003] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.003] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.019] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.019] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.035] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.035] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.066] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.066] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.081] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.097] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.097] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.113] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.113] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.129] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.129] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.144] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.144] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.160] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.160] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.177] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.191] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.191] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.206] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.207] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.222] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.222] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.239] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.239] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.253] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.253] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.269] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.269] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.285] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.285] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.300] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.300] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.316] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.316] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.331] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.332] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.347] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.347] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.363] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.363] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.379] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.379] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.394] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.410] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.410] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.425] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.425] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.441] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.441] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.456] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.456] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.483] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.483] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.528] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.528] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.534] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.535] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.550] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.550] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.566] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.581] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.581] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.597] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.597] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.613] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.613] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.628] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.628] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.644] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.644] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.660] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.675] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.675] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.691] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.691] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.706] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.706] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.722] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.722] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.738] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.738] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.758] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.758] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.769] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.769] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.785] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.785] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.831] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.832] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.847] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.847] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.863] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.863] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.878] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.878] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.894] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.894] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.910] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.910] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.925] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.925] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.941] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.941] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.956] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0098.957] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.973] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.973] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0098.988] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0098.988] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.003] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.003] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.019] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.019] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.066] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.066] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.081] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.097] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.097] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.113] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.113] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.128] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.128] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.144] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.144] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.160] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.160] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.175] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.175] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.191] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.191] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.206] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.207] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.222] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.222] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.241] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.241] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.254] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.254] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.269] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.269] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.285] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.285] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.300] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.300] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.316] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.316] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.331] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.332] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.347] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.347] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.363] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.363] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.379] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.382] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.394] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.410] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.410] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.425] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.425] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.441] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.441] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.457] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.457] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.472] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.472] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.488] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.488] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.506] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.506] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.529] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.529] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.534] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.535] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.550] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.550] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.566] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.615] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.631] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.631] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.647] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.678] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.678] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.704] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.704] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.709] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.736] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.736] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.740] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.740] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.756] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.757] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.772] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.772] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.844] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.844] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.865] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.881] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.881] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.896] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.896] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.912] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.928] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.928] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.944] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.944] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.959] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0099.959] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.975] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.975] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0099.997] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0099.997] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.006] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.006] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.053] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.053] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.076] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.077] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.084] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.084] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.099] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.117] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.117] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.131] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.131] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.159] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.159] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.162] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.162] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.178] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.178] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.193] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.193] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.224] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.224] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.256] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.256] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.273] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.273] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.303] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.303] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.334] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.334] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.350] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.365] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.365] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.381] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.381] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.397] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.397] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.412] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.428] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.428] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.459] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.459] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.475] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.475] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.490] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.490] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.506] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.506] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.530] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.530] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.537] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.537] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.553] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.553] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.584] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.584] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.599] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.600] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.615] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.631] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.631] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.678] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.678] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.709] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.725] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.740] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.740] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.757] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.757] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.842] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.842] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.865] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.882] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.882] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.897] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.897] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.928] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.928] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.943] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.943] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.959] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.959] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.975] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0100.975] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0100.990] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0100.990] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.007] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.007] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.022] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.022] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.053] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.053] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.068] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.069] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.085] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.085] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.100] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.115] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.131] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.131] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.147] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.147] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.162] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.162] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.178] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.178] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.193] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.193] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.209] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.209] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.224] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.224] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.256] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.256] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.272] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.272] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.287] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.287] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.303] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.303] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.334] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.334] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.350] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.350] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.365] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.365] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.381] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.381] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.398] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.398] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.412] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.428] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.428] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.459] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.459] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.475] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.491] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.491] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.506] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.506] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.532] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.532] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.537] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.537] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.553] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.553] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.584] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.584] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.600] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.600] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.615] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.631] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.631] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.678] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.678] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.694] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.694] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.709] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.725] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.740] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.740] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.757] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.757] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.834] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.834] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.865] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.881] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.881] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.897] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.897] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.912] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.928] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.928] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.943] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.943] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.959] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.959] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.974] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0101.975] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0101.990] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0101.990] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.006] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.006] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.063] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.063] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.068] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.084] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.084] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.100] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.115] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.131] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.131] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.148] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.148] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.186] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.186] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.209] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.209] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.225] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.225] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.256] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.256] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.271] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.271] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.287] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.287] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.303] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.303] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.334] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.335] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.350] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.350] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.365] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.365] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.381] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.381] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.396] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.396] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.412] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.428] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.428] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.459] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.459] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.475] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.475] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.490] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.490] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.506] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.506] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.530] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.530] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.553] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.553] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.670] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.670] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.678] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.678] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.709] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.724] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.741] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.741] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.772] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.813] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.813] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.835] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.835] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.865] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.881] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.881] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.897] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.897] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.912] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.929] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.929] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.959] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.959] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.974] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0102.974] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0102.990] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0102.990] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.006] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.006] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.053] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.053] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.068] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.084] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.084] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.100] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.115] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.131] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.131] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.146] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.147] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.162] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.162] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.178] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.178] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.193] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.193] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.220] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.220] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.224] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.224] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.256] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.256] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.271] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.272] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.287] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.287] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.303] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.303] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.319] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.319] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.351] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.351] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.365] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.365] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.381] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.397] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.398] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.428] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.428] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.459] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.459] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.490] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.490] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.506] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.506] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.531] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.532] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.537] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.537] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.553] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.553] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.569] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.584] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.584] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.600] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.600] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.615] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.631] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.631] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.678] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.678] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0103.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.710] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.710] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.741] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.741] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.781] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.781] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.842] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.864] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.865] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.882] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.882] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.912] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.928] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.928] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0103.970] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0103.970] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.012] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.012] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.044] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.045] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.071] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.084] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.084] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.101] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.101] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.146] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.146] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.164] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.164] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.178] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.193] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.193] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.209] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.209] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.224] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.224] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.256] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.256] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.271] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.272] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.287] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.287] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.303] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.303] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.334] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.334] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.365] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.366] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.381] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.381] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.396] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.396] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.412] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.428] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.428] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.459] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.459] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.475] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.490] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.491] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.506] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.506] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.530] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.530] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.553] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.569] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.569] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.599] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.599] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.645] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.645] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.672] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.672] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.687] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.687] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.703] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.703] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.719] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.719] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.734] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.734] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.750] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.750] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.765] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.765] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.782] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.782] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.796] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.796] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.859] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.859] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.875] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.875] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.890] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.890] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.906] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.906] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.921] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.921] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.937] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.937] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.970] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0104.984] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0104.999] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0104.999] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.015] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.015] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.031] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.031] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.046] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.046] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.062] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.062] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.093] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.093] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.110] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.110] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.125] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.125] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.171] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.187] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.187] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.203] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.203] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.219] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.219] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.234] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.234] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.249] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.250] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.266] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.266] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.297] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.297] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.312] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.312] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.328] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.328] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.343] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.343] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.359] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.359] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.375] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.375] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.390] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.390] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.406] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.406] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.421] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.421] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.437] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.437] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.453] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.453] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.468] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.468] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.484] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.484] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.500] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.500] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.515] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.515] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.531] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.531] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.546] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.547] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.562] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.562] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.578] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.578] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.595] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.595] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.609] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.609] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.624] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.624] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.644] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.644] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.660] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.660] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.675] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.675] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.691] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.691] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.707] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.707] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.722] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.722] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.738] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.738] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.754] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.754] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.769] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.769] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.850] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.850] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.884] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.899] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.899] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0105.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0105.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0105.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.134] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.134] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.165] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.212] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.212] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.243] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.306] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.337] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.337] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.493] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.493] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.532] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.532] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.634] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.634] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.665] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.712] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.884] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0106.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0106.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0106.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0107.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0107.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0107.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.134] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0107.134] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.157] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0107.157] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.185] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.185] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.210] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.211] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.237] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.419] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.528] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.529] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0107.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.638] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.712] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.757] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0107.757] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0107.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0107.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.848] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.872] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.872] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.935] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.935] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0107.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0107.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.049] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.113] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.113] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.134] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.134] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.165] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.196] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.306] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.321] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.321] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.337] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.337] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.369] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.369] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.493] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.493] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.634] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.634] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.665] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.665] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.712] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.712] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.884] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.899] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0108.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0108.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0108.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.165] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.165] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.196] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.212] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.212] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.306] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.321] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.337] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.337] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.493] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.493] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.532] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.532] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.618] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0109.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.700] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.701] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.732] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.732] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.792] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0109.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0109.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0110.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0110.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.511] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0110.511] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.533] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.533] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.561] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.561] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0110.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0110.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0110.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0110.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.792] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.845] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.845] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.863] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0110.863] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0110.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.935] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.935] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0110.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0110.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0110.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.435] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.435] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.536] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.608] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.608] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.656] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.657] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.731] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.762] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.777] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.777] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.846] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.846] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0111.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0111.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0111.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.018] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.031] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.031] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.093] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.107] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.123] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.123] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.137] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.169] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.538] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.538] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.792] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.860] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.861] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.889] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.889] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0112.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0112.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0112.984] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0113.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0113.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0113.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.264] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0113.264] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.314] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.314] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.356] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.356] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0113.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.391] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.391] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0113.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.548] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.548] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.575] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.575] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.612] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.612] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.672] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.725] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.754] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.754] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.887] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.887] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0113.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0113.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0113.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0113.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.465] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.466] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.511] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.550] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.550] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.679] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.679] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.777] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.777] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.784] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.785] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.800] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.801] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.884] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.912] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.926] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.926] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.945] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.945] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.957] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.957] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.977] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0114.977] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0114.991] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0114.991] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.003] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.003] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0115.024] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.035] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0115.035] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.055] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.055] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.069] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.069] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.086] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.086] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.258] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.258] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.269] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.269] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.285] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.285] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.301] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.301] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.319] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.319] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.335] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.335] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.351] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.362] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0115.362] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.382] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.382] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.394] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.413] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.414] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.430] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.430] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.441] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0115.441] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.460] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0115.460] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.472] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.472] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.491] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.491] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0115.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.523] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.523] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.538] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.539] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.567] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.567] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.582] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0115.582] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.597] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0115.597] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.613] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.613] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.632] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.803] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.803] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.842] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.842] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.878] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.878] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.884] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.924] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.924] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0115.985] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0115.985] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.000] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.000] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.016] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.016] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.031] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.031] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.063] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.063] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.177] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.188] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.188] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.203] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.203] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.219] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.219] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.234] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.234] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.250] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.251] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.268] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.268] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.298] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.299] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.313] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.313] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.328] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.328] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.344] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.344] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.359] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.359] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.376] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.376] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.393] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.393] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.406] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.406] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.426] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.426] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.440] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.440] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.453] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.453] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.470] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.470] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.485] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.485] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.500] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.500] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.516] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.516] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.532] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.532] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.563] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.563] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.578] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.578] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.594] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.594] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.612] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.612] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.637] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.640] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.641] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.657] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.657] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.672] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.672] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.688] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.688] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.703] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.703] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.719] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.719] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.735] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.736] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.766] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.766] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.781] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.781] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.813] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.813] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.829] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.829] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.851] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.851] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.891] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.891] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.914] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.914] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.926] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.926] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.937] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.938] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.957] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.957] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0116.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0116.990] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0116.990] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.002] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.002] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.016] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.016] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.034] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.034] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.049] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.049] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.063] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.063] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.094] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.094] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.111] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.111] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.125] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.125] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.157] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.157] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.187] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.188] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.203] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.203] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.219] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.219] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.235] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.235] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.250] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.250] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.266] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.267] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.297] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.297] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.344] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.344] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.360] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.360] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.378] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.378] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.398] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.398] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.406] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.406] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.422] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.422] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.482] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.482] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.486] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.486] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.500] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.500] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.516] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.516] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.534] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.535] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.555] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.563] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.563] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.579] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.579] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.596] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.597] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.625] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.625] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.641] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.641] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.657] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.657] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.672] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.672] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.688] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.688] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.703] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.703] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.722] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.722] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.736] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.736] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.750] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.750] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.766] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.766] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.781] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.781] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.813] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.813] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.828] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.828] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.846] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.846] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.891] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.891] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.909] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.909] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.922] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.922] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.939] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.939] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0117.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0117.985] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0117.985] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.005] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.081] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.096] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.096] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.111] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.111] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.125] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.125] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.156] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.157] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.188] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.188] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.203] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.203] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.219] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.219] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.234] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.234] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.250] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.250] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.266] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.266] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.300] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.300] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.314] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.314] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.329] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.329] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.345] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.345] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.359] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.360] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.378] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.378] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.395] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.406] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.406] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.430] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.430] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.438] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.438] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.455] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.455] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.469] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.469] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.487] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.487] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.502] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.502] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.518] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.518] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.533] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.533] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.576] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.576] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.580] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.580] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.594] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.594] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.610] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.610] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.626] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.626] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.641] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.641] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.659] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.672] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.672] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.691] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.691] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.708] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.708] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.719] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.719] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.735] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.735] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.758] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.758] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.766] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.766] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.785] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.785] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.814] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.814] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.829] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.829] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.922] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.922] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.937] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.937] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0118.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0118.985] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0118.985] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.000] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.000] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.019] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.033] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.033] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.063] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.063] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.099] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.110] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.110] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.127] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.127] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.143] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.143] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.158] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.158] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.188] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.188] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.206] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.206] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.272] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.273] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.297] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.297] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.313] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.313] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.329] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.329] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.347] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.347] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.359] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.359] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.376] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.377] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.391] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.391] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.406] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.407] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.422] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.423] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.437] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.438] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.456] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.456] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.469] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.469] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.486] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.487] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.500] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.500] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.516] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.516] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.537] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.537] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.563] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.563] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.595] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.595] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.609] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.610] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.628] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.628] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.641] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.641] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.671] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.671] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.672] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.672] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.690] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.690] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.709] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.719] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.719] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.734] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.734] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.750] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.750] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.766] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.766] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.781] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.781] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.813] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.813] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.828] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.828] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.844] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.844] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.881] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.882] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.890] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.891] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.906] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.906] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.922] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.922] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.937] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.938] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0119.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0119.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0119.984] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.000] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.000] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.015] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.016] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.031] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.031] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.063] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.063] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.094] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.094] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.110] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.110] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.125] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.125] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.140] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.156] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.156] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.187] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.187] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.203] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.203] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.219] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.219] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.243] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.250] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.250] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.266] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.266] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.288] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.288] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.297] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.297] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.314] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.314] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.328] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.328] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.344] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.344] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.359] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.361] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.375] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.375] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.390] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.391] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.454] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.454] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.469] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.469] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.484] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.484] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.502] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.502] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.516] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.516] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.531] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.531] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.562] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.562] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.578] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.578] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.594] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.594] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.609] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.609] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.625] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.626] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.640] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.640] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.656] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.656] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.672] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.672] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.688] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.688] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.703] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.703] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.719] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.719] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.734] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.734] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.750] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.750] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.767] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.767] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.813] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.813] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.828] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.828] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.843] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.843] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.890] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.891] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.908] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.908] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.937] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.937] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0120.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0120.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0120.984] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.000] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.000] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.015] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.016] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.031] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.031] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.062] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.062] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.094] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.094] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.111] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.111] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.156] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.156] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.187] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.187] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.203] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.203] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.219] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.219] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.235] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.235] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.250] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.250] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.265] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.266] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.297] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.297] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.321] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.321] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.331] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.331] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.343] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.344] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.359] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.359] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.375] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.375] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.390] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.390] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.406] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.406] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.422] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.422] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.437] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.437] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.453] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.453] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.469] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.469] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.484] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.484] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.500] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.500] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.521] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.521] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.736] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.736] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.750] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.750] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.765] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.766] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.781] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.781] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.812] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.812] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.828] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.828] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.844] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.844] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.893] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.893] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.906] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.906] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.922] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0121.922] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.937] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.938] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0121.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0121.984] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.001] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.001] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.018] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.031] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.031] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.049] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.049] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.063] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.063] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.094] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.094] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.109] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.109] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.125] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.125] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.140] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.140] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.156] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.157] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.187] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.187] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.203] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.203] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.219] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.219] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.234] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.234] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.252] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.252] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.265] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.266] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.297] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.297] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.312] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.313] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.331] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.331] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.347] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.347] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.375] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.375] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.391] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.391] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.407] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.407] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.422] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.422] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.437] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.437] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.453] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.453] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.469] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.469] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.484] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.484] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.500] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.500] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.516] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.516] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.531] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.531] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.564] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.564] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.590] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.594] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.594] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.610] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.610] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.625] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.625] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.642] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.642] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.656] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.656] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.674] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.674] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.688] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.688] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.703] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.703] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.719] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.719] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.737] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.737] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.768] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.768] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.784] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.784] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.813] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.813] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.828] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.828] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.844] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.844] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.906] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.906] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.922] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.922] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.937] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.938] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.970] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0122.970] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0122.986] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0122.987] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.001] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.002] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.016] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.016] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.034] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.034] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0123.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.063] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0123.063] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.095] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0123.096] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.109] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.109] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.153] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.154] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.158] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.158] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.194] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.194] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.204] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.204] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.267] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.267] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.297] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0123.297] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.313] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.313] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.424] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.424] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.437] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.438] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.453] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.453] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.483] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.483] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.484] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.484] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.500] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.500] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.518] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.518] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.562] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.562] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.578] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0123.578] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.594] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.594] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.609] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.609] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.625] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.625] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.648] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.648] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.656] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.657] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.672] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.672] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.688] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.688] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.705] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0123.705] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.735] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.735] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.756] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0123.756] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.766] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.766] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.781] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.782] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.815] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0123.815] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.828] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.828] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.891] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.891] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.908] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.908] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.937] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.938] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0123.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0123.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0123.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0123.985] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.000] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.000] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.016] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.016] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.031] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.031] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.063] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.063] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.094] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.094] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.110] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.110] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.125] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.125] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.140] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.156] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.156] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.187] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.188] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.226] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.226] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.234] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.234] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.250] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.250] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.266] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.266] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.284] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.284] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.300] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.300] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.328] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.329] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.344] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.344] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.359] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.359] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.375] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.375] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.390] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.391] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.406] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.406] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.422] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.422] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.437] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.437] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.453] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.453] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.470] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.470] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.487] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.487] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.502] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.502] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.516] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.516] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.531] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.531] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.559] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.559] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.562] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.562] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.578] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.578] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.594] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.594] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.610] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.610] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.625] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.625] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.640] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.641] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.656] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.656] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.672] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.672] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.689] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.689] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.705] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.705] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.720] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.720] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.740] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.770] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.802] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.802] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.817] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.817] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.833] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.881] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.881] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.895] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.895] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.913] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.913] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.927] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.927] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.942] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0124.958] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.974] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.974] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0124.989] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0124.989] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.005] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.020] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.036] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.036] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.052] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.052] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.067] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.067] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.099] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.130] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.130] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.225] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.225] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.239] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.239] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.255] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.255] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.271] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.271] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.302] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.317] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.317] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.333] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.364] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.364] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.395] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.396] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.411] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.427] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.427] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.442] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.442] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.458] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.473] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.473] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.519] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.519] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.534] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.534] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.581] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.581] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.597] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.597] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.612] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.612] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.628] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.628] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.644] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.644] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.659] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.712] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.712] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.852] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.952] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.954] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0125.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0125.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0125.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.102] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.102] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.134] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.134] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.149] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.165] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.165] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.196] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.212] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.212] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.227] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.306] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.321] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.321] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.337] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.337] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.399] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.446] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.477] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.493] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.493] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.524] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.524] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.634] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.634] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.649] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.649] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.665] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.712] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.712] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.774] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.774] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.920] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.920] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0126.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.977] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.977] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0126.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0126.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.024] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.071] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.134] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.134] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.149] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.149] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.165] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.165] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.196] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.243] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.274] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.306] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.321] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.321] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.337] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.337] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.399] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.399] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.493] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.493] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.566] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.606] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.606] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.634] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.634] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.649] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.712] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.712] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.921] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.921] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0127.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.977] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.977] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0127.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0127.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.024] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.071] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.212] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.219] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.306] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.321] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.321] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.337] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.337] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.493] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.493] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.524] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.524] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.565] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.565] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.602] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.623] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.623] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.734] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.734] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.774] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.912] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0128.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0128.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0128.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.035] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.035] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.256] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.256] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.315] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.315] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.321] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0129.321] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.337] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.337] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0129.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.399] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0129.399] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.424] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0129.424] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.438] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.438] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0129.446] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.498] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.498] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.530] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.530] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.567] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0129.567] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.634] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0129.634] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0129.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.727] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.774] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0129.774] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.800] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.800] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.815] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.815] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.830] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.831] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.846] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0129.846] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.862] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.862] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.877] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0129.877] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.971] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.971] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0129.987] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0129.987] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.002] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.002] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.018] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.034] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0130.034] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.065] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.065] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.080] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.080] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.096] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0130.096] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.112] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.112] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.127] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.127] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.143] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0130.143] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.159] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.159] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.174] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.174] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.190] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.190] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.205] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.206] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.221] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0130.221] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.237] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0130.237] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.252] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.252] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.268] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0130.268] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.284] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0130.284] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.300] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.300] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.315] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.315] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.330] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0130.330] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.346] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.346] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.362] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0130.362] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.377] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.378] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.393] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.393] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.409] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.409] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.700] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.700] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.705] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.705] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.721] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.721] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.737] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.737] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.752] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.752] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.768] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.768] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.784] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.784] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.799] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.799] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.847] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.847] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.940] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.940] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0130.973] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0130.973] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.004] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.004] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.018] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.034] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.034] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.081] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.097] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.097] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.112] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.112] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.131] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.131] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.143] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.143] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.158] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.158] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.174] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.175] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.205] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.205] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.233] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.233] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.239] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.239] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.253] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.253] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.269] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.270] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.283] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.283] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.300] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.300] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.315] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.315] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.330] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.330] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.346] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.346] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.362] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.362] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.378] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.378] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.393] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.393] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.409] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.409] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.424] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.424] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.440] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.440] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.456] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.456] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.471] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.471] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.506] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.506] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.518] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.518] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.549] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.549] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.592] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.592] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.602] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.602] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.613] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.614] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.664] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.664] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.712] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.712] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.727] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.757] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.757] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.772] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.772] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.852] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.852] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.863] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.863] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.893] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.893] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.924] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0131.924] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.943] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.944] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0131.990] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0131.990] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.005] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.018] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.049] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.049] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.069] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0132.069] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.158] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.159] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.175] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.175] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.280] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.280] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.460] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.460] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.471] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.471] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.487] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.487] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.502] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.502] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.518] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.518] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.533] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.534] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.549] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.549] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0132.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.596] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.596] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.612] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.612] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.628] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.628] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.643] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.643] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.661] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.661] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.674] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.674] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.702] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.702] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.705] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.705] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.721] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0132.721] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.737] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.737] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.753] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.753] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.768] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0132.768] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.784] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.784] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.799] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0132.799] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.815] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.815] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.831] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.831] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.847] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0132.847] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.862] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.862] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.877] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.878] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.893] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0132.893] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.909] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0132.909] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.924] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.924] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.940] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.940] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0132.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0132.958] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.018] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.033] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.034] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.049] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.049] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.065] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.065] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.080] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.096] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.096] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.112] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.112] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.127] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.127] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.143] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.143] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.158] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.159] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.175] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.175] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.190] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.190] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.206] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.206] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.234] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.234] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.263] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.263] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.268] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.268] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.284] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.284] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.299] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.300] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.315] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.315] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.392] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.392] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.396] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.398] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.409] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.409] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.424] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.424] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.442] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.442] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.467] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.467] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.519] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.519] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.534] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.534] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.549] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.549] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.565] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.565] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.580] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.580] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.596] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.596] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.612] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.612] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.695] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.695] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.706] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.706] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.722] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.722] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.768] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.768] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.784] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.784] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.804] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.804] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.815] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.815] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.845] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.845] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.846] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.846] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.875] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.878] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.893] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.893] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.909] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.909] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.924] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.924] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.940] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.940] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.956] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.956] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.971] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0133.971] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0133.987] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0133.987] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.033] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.033] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.033] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.034] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.049] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.049] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.065] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.065] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.080] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.096] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.096] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.115] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.131] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.131] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.159] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.159] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.174] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.174] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.190] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.190] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.206] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.206] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.224] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.224] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.237] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.237] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.254] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.254] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.268] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.268] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.284] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.284] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.299] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.299] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.315] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.315] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.331] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.331] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.361] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.362] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.389] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.389] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.393] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.393] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.409] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.409] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.424] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.424] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.440] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.440] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.455] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.455] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.471] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.471] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.487] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.487] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.522] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.522] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.551] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.551] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.596] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.596] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.612] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.612] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.627] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.628] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.643] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.643] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.659] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.675] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.675] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.690] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.690] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.708] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.708] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.732] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.732] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.737] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.737] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.753] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.753] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.770] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.770] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.784] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.784] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.801] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.801] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.814] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.814] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.831] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.831] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.863] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.863] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.878] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.878] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.893] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.894] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.912] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.924] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.924] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.942] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.956] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.956] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.972] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0134.972] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0134.987] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0134.987] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.005] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.018] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.074] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.081] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.096] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.096] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.112] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.112] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.128] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.128] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.143] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.143] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.175] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.188] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.191] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.191] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.206] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.206] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.221] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.222] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.237] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.237] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.253] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.253] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.270] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.270] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.284] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.284] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.303] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.304] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.315] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.315] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.333] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.347] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.347] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.362] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.362] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.378] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.378] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.394] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.409] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.409] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.425] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.425] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.440] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.440] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.458] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.471] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.471] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.506] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.506] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.518] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.518] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.535] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.552] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.584] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.584] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.596] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.596] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.614] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.614] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.629] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.629] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.659] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.692] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.706] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.706] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.722] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.722] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.738] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.738] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.753] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.753] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.769] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.769] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.785] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.785] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.803] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.803] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.817] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.817] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.832] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.832] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.897] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.897] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.909] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.909] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.934] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.934] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.949] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.967] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.967] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.982] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0135.982] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0135.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0135.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.012] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.012] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.043] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.061] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.061] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.127] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.127] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.137] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.152] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.215] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.215] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.230] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.246] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.246] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.262] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.280] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.280] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.294] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.294] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.309] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.309] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.340] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.387] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.403] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.403] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.434] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.434] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.459] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.459] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.466] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.466] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.481] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.481] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.512] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.512] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.543] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.543] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.574] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.574] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.590] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.590] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.606] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.606] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.639] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.639] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.669] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.669] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.685] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.685] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.699] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.700] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.715] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.715] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.731] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.731] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.764] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.764] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.779] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.779] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.793] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.793] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.809] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.809] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.852] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.852] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.875] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.875] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.888] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.888] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0136.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.919] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.919] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.934] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.952] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.952] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.966] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.966] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0136.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0136.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.012] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.012] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.029] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.029] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.069] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.069] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.077] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.077] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.152] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.153] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.219] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.220] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.231] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.231] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.246] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.246] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.264] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.264] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.285] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.285] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.293] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.293] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.311] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.311] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.328] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.328] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.340] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.374] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.374] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.405] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.406] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.434] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.434] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.465] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.465] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.512] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.512] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.528] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.545] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.545] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.560] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.560] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.574] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.574] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.590] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.590] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.608] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.608] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.684] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.699] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.715] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.715] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.731] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.731] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.764] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.764] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.779] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.779] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.795] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.795] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.825] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.825] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.842] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.842] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.873] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.873] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.887] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.887] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.903] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.950] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.950] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.965] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0137.965] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0137.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0137.981] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.029] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.029] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.043] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.070] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.070] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.074] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.091] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.091] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.155] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.155] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.184] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.184] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.202] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.202] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.221] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.221] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.232] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.232] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.246] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.246] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.262] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.262] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.293] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.293] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.309] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.309] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.325] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.342] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.342] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.373] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.373] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.390] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.390] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.404] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.404] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.419] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.434] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.434] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.451] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.451] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.465] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.465] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.481] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.523] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.524] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.543] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.543] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.559] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.559] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.581] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.581] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.606] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.637] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.653] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.653] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.674] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.674] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.700] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.700] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.715] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.715] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.777] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.777] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.778] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.778] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.793] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.793] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.809] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.809] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.840] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.840] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.874] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.874] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.888] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0138.888] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0138.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0138.903] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.095] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.095] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.106] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.106] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.171] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.171] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.216] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.216] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.231] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.231] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.258] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.315] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.340] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.375] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0139.375] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.389] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.389] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.465] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.465] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.481] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.482] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.497] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.497] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.516] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.517] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.529] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0139.529] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.543] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.543] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.559] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0139.559] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.581] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0139.581] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.606] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.637] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.655] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.655] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0139.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.699] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.716] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.716] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0139.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.762] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0139.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.778] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0139.778] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.794] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.794] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.810] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.810] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.840] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.840] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.856] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.872] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0139.872] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.887] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.887] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.905] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0139.905] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0139.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.951] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.951] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.965] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.965] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.981] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0139.981] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0139.997] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0139.997] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.013] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.013] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.028] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.028] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.062] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.062] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.076] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.076] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.106] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.106] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.187] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.187] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.215] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.215] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.231] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.231] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.246] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.246] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.264] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.264] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.279] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.279] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.293] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.293] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.310] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.311] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.340] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.356] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.356] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.387] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.387] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.436] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.436] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.450] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.475] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.475] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.481] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.481] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.497] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.497] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.515] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.515] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.530] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.530] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.543] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.543] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.560] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.560] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.585] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.585] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.653] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.653] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.669] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.684] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.684] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.699] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.715] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.715] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.731] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.731] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.762] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.780] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.780] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.795] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.795] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.809] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.809] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.840] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.840] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.856] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.856] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.871] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.871] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.890] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.890] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.934] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.934] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.949] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.966] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0140.966] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0140.997] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0140.997] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.012] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.012] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.033] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.033] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.043] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.059] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.059] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.077] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.077] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.092] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.092] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.107] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.107] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.159] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.159] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.184] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.184] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.200] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.200] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.220] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.220] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.246] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.262] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.262] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.278] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.278] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.293] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.293] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.309] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.310] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.340] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.356] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.372] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.372] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.394] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.407] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.407] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.435] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.436] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.450] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.466] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.466] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.481] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.481] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.513] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.513] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.530] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.530] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.564] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.564] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.584] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.584] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.608] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.609] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.653] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.669] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.669] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.684] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.684] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.702] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.702] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.717] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.717] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.734] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.734] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.769] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.769] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.778] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.778] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.800] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.801] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.809] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.809] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.833] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.840] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.840] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.879] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.889] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.889] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.921] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.921] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.934] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.934] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.965] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.965] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.982] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0141.982] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0141.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0141.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.014] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.014] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.030] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.030] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.043] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.059] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.059] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.074] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.106] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.106] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.122] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.122] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.171] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.184] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.184] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.218] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.218] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.269] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.278] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.293] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.293] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.309] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.309] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.340] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.356] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.356] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.387] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.387] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.434] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.434] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.465] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.465] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.481] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.481] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.515] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.515] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.545] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.545] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.584] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.584] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.606] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.606] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.637] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.653] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.684] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.684] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.699] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.715] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.715] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.731] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.762] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.777] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.778] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.793] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.793] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.809] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.809] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.840] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.840] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.871] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.871] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.887] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.887] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.903] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0142.903] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0142.936] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0142.936] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.000] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.001] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.012] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.012] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.028] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.028] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.043] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.059] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.059] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.074] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.106] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.106] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.121] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.121] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.139] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.139] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.185] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.185] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.215] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.215] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.231] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.231] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.246] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.246] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.262] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.262] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.285] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.285] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.309] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.309] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.325] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.325] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.356] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.356] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.387] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.387] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.403] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.403] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.434] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.434] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.465] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.465] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.481] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.481] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.512] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.512] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.544] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.544] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.559] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.559] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.606] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.637] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.653] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.653] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.684] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.684] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.699] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.717] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.717] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.747] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.747] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.762] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.777] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.777] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.793] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.793] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.809] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.809] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.840] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.840] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.856] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.856] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.871] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.871] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.887] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.887] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.934] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.934] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.955] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0143.955] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.981] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.981] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0143.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0143.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.012] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.012] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.028] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.043] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.059] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.059] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.074] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.108] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.108] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.137] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.137] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.153] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.153] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.210] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.211] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.215] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.215] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.232] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.232] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.246] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.246] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.262] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.262] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.293] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.293] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.311] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.311] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.340] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.356] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.356] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.387] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.387] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.424] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.424] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.434] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.434] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.450] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.465] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.465] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.481] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.481] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.497] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.497] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.528] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.528] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.543] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.543] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.559] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.559] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.586] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.586] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.590] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.590] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.606] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.637] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.653] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.653] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.706] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.706] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.724] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.762] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.777] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.777] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.793] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.793] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.809] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.809] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.840] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.840] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.856] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.856] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.871] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.871] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.891] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.891] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.904] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.905] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.920] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.920] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.941] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.941] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.957] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0144.957] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.972] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.972] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0144.988] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0144.988] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.003] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.003] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.019] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.019] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.035] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.035] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.066] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.066] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.085] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.085] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.097] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.097] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.113] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.113] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.128] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.128] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.144] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.144] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.160] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.160] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.175] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.175] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.253] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.253] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.269] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.269] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.284] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.284] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.300] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.300] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.316] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.316] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.331] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.332] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.394] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.411] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.425] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.425] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.441] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.441] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.457] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.457] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.472] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.472] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.493] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.519] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.519] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.534] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.535] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.550] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.550] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.566] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.613] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.613] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.628] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.628] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.644] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.644] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.660] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.660] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.675] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.675] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.691] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.691] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.706] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.706] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.722] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.722] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.738] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.738] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.753] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.753] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.769] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.769] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.800] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.800] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.816] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.816] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.832] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.832] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.847] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.847] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.863] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.863] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.878] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.878] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.895] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.896] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.909] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.909] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.924] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.925] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.940] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.941] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.956] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0145.956] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.972] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.972] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0145.987] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0145.988] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.003] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.003] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.019] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.019] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.034] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.035] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.051] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.065] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.066] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.250] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.250] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.321] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.337] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.337] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.358] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.358] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.446] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.493] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.493] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.634] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.634] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.665] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.665] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.712] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.712] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.763] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.763] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.847] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.847] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.858] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.858] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.890] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.890] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.912] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.913] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0146.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.987] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.988] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0146.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0146.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.029] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.030] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.134] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.134] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.165] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.165] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.184] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.184] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.270] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.271] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.274] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.274] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.306] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.337] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.337] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.405] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.405] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.481] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.481] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.634] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.734] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.734] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.768] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.768] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.884] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0147.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0147.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0147.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.173] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.173] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.256] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.256] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.337] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.493] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.513] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.513] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.606] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.607] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.634] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.634] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.712] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.712] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.774] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.884] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.905] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.905] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0148.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0148.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0148.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.134] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.134] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.165] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.257] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.257] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.306] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.321] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.321] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.337] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.337] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.399] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.446] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.618] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.638] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.638] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.717] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.717] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.884] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0149.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.961] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0149.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0149.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.012] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.012] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.061] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.061] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.137] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.137] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.152] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.250] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.250] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.512] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.512] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.699] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.792] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.903] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.903] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0150.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0150.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0150.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.082] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.082] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.170] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.170] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.269] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.269] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.293] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.293] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.511] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.511] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.777] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.777] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.792] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.871] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.871] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0151.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0151.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0151.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.137] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.137] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.270] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.271] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.511] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.511] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.777] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.777] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.820] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.820] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.827] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.827] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.895] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.896] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.919] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.959] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.959] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0152.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0152.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0152.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.123] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.123] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.155] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.155] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.176] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.176] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.252] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.252] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.309] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.309] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.373] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.373] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.410] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.410] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.511] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.511] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.574] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.591] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.591] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.699] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.700] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.763] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.792] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0153.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0153.997] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0153.997] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.075] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.075] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.154] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.154] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.256] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.257] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.423] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.423] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.517] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.517] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.546] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.546] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.747] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.748] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.764] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.764] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.792] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.873] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.873] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0154.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0154.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0154.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0155.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.052] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.067] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0155.067] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.098] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.098] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.129] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.129] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.145] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.145] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.161] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.176] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0155.176] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.254] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.254] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.254] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.254] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.270] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.270] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.301] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0155.301] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.317] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.317] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.332] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.332] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.348] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.348] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.363] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0155.364] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.379] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.379] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.395] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0155.395] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.411] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0155.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.426] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.426] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.442] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0155.442] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.536] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.553] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.553] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.567] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.567] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.595] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.595] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.716] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.725] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.754] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.754] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.770] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.770] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.789] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.789] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.819] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.819] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0155.850] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0155.850] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.081] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.098] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.098] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.129] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.129] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.147] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.148] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.161] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.176] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.176] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.243] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.255] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.255] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.270] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0156.270] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0156.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0156.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.369] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0156.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0156.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0156.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0156.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0156.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.591] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.591] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0156.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0156.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0156.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0156.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0156.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0156.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.018] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.039] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.319] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.320] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.325] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.325] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.373] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.373] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.399] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.399] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.592] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.593] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.949] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0157.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0157.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0157.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.265] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.265] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.428] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.428] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.593] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.593] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.762] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0158.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0158.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0158.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.012] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.012] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.293] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.293] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.597] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.597] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.792] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.816] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.816] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.828] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.828] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.858] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.858] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0159.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0159.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0159.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.085] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.085] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.099] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.130] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.130] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.145] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.145] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.161] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.177] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.193] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.193] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.257] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.257] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.271] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.271] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.302] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.333] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.365] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.365] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.398] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.411] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.428] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.428] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.468] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.469] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.475] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.475] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.528] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.528] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.561] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.561] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.600] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.600] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.614] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.614] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.653] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.653] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.661] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.692] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.708] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.708] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.732] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.732] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.788] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.788] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.817] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.833] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.864] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.897] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.897] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.911] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.927] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.927] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.942] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.958] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.974] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0160.974] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0160.989] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0160.989] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.005] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.036] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.036] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.052] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.052] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.068] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.100] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.116] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.116] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.130] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.130] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.146] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.146] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.161] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.177] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.193] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.193] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.251] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.251] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.255] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.255] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.271] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.271] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.302] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.333] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.365] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.365] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.398] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.398] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.411] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.427] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.427] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.459] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.505] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.521] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.521] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.536] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.552] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.600] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.600] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.630] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.678] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.678] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.692] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.709] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.725] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.802] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.802] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.833] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.864] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.896] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.896] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.927] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.927] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.943] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.986] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0161.986] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0161.989] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0161.989] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.008] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.008] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.036] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.052] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.052] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.068] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.099] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.130] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.130] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.146] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.146] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.161] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.177] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.193] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.193] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.258] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.258] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.271] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.271] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.302] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.317] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.317] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.333] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.364] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.365] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.396] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.396] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.413] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.413] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.427] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.427] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.458] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.490] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.505] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.521] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.521] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.536] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.552] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.567] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.567] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.606] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.606] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.631] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.631] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.708] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.708] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.724] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.724] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.805] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.805] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.833] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.864] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.864] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.881] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.895] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.896] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.896] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.927] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.927] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.942] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.958] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.974] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0162.974] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0162.989] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0162.989] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.005] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.036] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.036] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.052] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.052] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.067] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.099] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.115] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.131] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.131] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.146] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.146] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.161] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.177] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.194] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.194] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.246] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.247] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.255] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.255] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.271] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.271] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.302] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.317] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.333] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.350] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.364] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.364] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.397] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.397] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.412] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.427] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.427] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.442] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.442] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.459] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.459] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.505] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.521] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.521] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.536] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.553] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.553] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.586] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.586] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.614] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.630] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.692] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.708] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.708] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.724] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.724] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.740] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.802] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.802] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.817] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.817] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.833] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.864] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.864] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.896] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.896] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.911] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.927] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.927] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0163.943] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0163.982] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0163.982] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.006] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.020] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.036] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.036] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.052] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.052] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.069] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.069] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.099] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.130] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.130] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.146] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.146] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.161] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.177] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.193] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.193] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.247] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.247] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.255] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.255] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.271] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.271] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.287] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.302] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.336] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.336] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.351] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.351] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.367] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.367] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.396] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.396] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.412] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.427] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.427] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.442] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.458] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.505] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.521] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.521] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.536] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.552] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.567] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.601] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.601] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.630] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.645] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.724] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.724] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.802] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.802] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.833] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.865] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.896] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.896] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.927] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.927] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.943] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.943] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0164.958] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.974] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.974] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0164.989] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0164.989] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.005] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.020] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.036] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.036] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.052] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.052] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.068] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.129] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.129] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.145] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.145] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.160] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.160] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.176] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.176] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.255] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.255] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.270] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.270] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.285] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.301] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.301] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.317] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.317] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.333] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.364] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.364] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.379] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.379] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.395] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.395] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.410] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.410] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.429] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.429] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.457] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.457] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.473] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.473] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.488] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.488] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.504] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.504] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.567] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.567] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.582] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.582] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.629] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.629] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.645] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.645] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.660] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.660] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.676] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.692] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.692] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.707] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.707] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.723] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.723] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.754] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.754] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.770] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.770] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.785] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.785] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.801] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.801] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.816] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.832] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.832] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.848] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.848] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.864] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.864] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.879] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.879] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.895] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.895] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.910] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.910] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.926] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.926] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.942] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.957] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.957] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.975] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0165.975] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0165.988] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0165.988] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.004] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.004] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.035] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.035] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.051] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.067] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.082] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.082] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.098] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.098] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.129] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.129] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.145] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.145] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.160] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.160] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.176] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.176] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.232] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.232] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.239] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.239] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.255] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.255] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.285] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.301] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.301] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.317] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.317] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.332] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.332] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.348] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.348] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.388] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.388] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.395] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.395] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.411] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.426] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.426] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.442] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.442] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.458] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.473] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.473] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.488] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.488] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.519] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.519] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.535] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.535] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.551] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.551] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.566] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.582] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.582] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.629] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.629] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.645] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.645] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.660] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.660] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.884] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0166.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0166.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0166.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.254] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.254] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.369] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.369] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.390] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.390] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.592] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.593] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.804] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.805] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.942] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0167.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0167.997] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0167.997] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.269] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.269] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.369] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.369] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.466] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.466] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.604] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.604] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0168.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0168.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0168.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.091] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.091] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.265] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.265] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.369] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.369] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.827] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.827] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0169.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0169.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0169.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.184] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.215] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.215] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.265] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.265] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.340] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.387] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.387] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.434] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.434] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.465] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.465] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.481] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.481] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.511] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.512] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.543] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.543] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.559] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.559] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.575] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.575] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.605] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.605] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.699] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.715] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.715] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.780] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.780] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.793] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.793] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.840] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.871] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.871] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.887] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.949] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.966] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.966] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0170.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0170.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0170.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.012] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.012] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.043] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.074] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.121] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.121] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.152] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.215] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.215] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.264] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.265] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.293] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.293] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.309] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.309] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.389] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.389] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.487] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.487] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.513] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.513] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.551] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.555] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.560] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.560] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.578] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.578] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.591] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.591] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.613] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.613] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.621] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.621] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.639] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.639] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.699] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.715] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.715] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.730] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.777] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.777] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.793] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.793] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.809] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.840] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.840] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.871] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.871] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.887] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.887] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.919] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.919] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.949] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.965] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0171.965] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.981] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.981] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0171.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0171.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.012] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.012] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.043] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.059] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.059] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.074] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.121] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.121] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.152] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.215] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.215] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.264] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.264] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.293] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.293] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.341] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.341] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.387] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.465] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.465] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.512] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.512] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.543] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.543] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.574] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.574] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.590] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.590] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.607] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.607] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.702] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.702] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.715] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.715] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.731] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.731] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.762] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.777] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.777] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.793] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.793] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.809] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.809] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.840] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.871] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.871] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.887] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.887] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.949] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.965] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0172.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0172.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0172.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.028] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.028] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.043] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.074] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.121] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.121] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.137] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.152] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.215] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.265] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.266] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.278] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.278] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.293] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.293] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.309] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.340] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.387] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.402] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.402] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.437] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.437] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.465] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.465] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.514] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.514] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.543] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.543] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.574] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.574] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.590] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.590] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.607] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.607] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.637] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.652] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.652] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.699] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.699] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.715] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.715] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.730] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.731] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.777] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.777] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.793] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.793] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.871] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.871] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.887] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.887] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.904] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.904] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.934] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.934] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.949] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.949] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.965] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.965] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0173.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0173.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0173.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.012] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.012] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.027] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.043] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.059] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.059] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.074] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.074] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.091] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.091] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.106] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.106] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.121] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.121] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.153] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.153] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.215] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.215] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.270] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.270] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.293] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.295] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.309] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.340] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.340] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.403] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.403] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.418] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.434] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.434] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.465] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.465] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.480] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.480] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.496] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.496] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.512] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.512] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.543] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.543] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.574] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.574] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.590] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.590] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.608] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.608] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.637] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.653] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.653] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.668] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.668] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.686] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.686] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.715] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.715] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.746] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.746] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.777] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.777] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.793] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.793] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.824] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.824] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.840] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.840] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.855] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.855] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.871] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.871] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.902] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.902] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.918] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.918] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.934] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.934] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.950] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.950] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.965] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.965] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.980] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0174.980] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0174.996] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0174.996] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.012] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.012] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.076] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.076] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.110] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.110] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.121] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.121] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.153] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.153] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.206] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.206] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.222] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.222] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.274] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.284] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.284] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.300] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.300] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.316] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.316] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.331] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.331] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.347] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.347] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.362] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.362] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.378] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.378] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.394] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.410] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.425] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.425] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.441] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.441] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.456] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.456] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.472] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.472] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.488] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.488] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.519] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.519] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.534] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.534] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.550] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.550] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.566] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.581] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.581] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.608] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.608] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.613] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.613] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.628] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.628] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.645] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.645] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.659] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.676] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.676] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.691] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.691] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.706] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.706] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.722] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.722] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.737] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.737] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.753] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.753] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.769] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.769] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.784] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.784] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.800] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.800] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.816] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.816] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.831] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.831] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.847] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.847] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.862] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.862] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.878] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.878] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.894] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.894] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.910] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0175.910] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.925] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.925] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.941] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.941] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.956] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.956] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.972] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.972] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0175.987] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0175.987] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.003] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.003] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.019] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.019] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.034] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.034] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.066] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.066] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.081] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.097] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.097] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.112] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.113] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.129] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.129] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.159] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.160] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.175] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.175] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.191] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.191] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.206] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.206] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.231] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.237] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.237] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.300] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.300] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.316] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.316] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.332] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.332] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.347] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.347] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.364] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.364] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.395] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.395] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.409] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.409] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.425] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.425] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.440] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.440] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.487] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.488] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.519] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.519] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.534] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.535] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.550] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.550] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.585] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.585] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.608] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.608] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.638] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.638] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.654] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.654] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.669] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.669] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.685] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.685] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.700] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.700] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.716] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.716] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.733] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.733] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.748] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.748] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.762] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.762] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.784] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.784] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.800] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.800] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.815] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.815] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.831] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.831] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.846] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.846] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.862] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.862] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.878] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.878] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.893] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.893] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.909] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.909] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.925] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0176.925] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.941] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.941] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.956] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.956] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.971] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.971] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0176.987] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0176.987] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.003] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.003] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.019] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.019] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.034] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.034] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.065] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.065] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.086] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.086] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.097] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.097] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.112] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.112] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.128] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.128] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.144] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.144] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.159] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.159] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.175] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.175] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.190] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.190] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.207] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.207] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.221] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.222] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.237] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.237] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.253] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.253] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.268] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.268] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.331] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.331] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.346] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.346] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.362] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.362] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.378] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.378] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.393] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.393] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.409] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.409] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.425] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.425] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.440] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.440] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.456] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.456] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.471] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.471] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.487] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.487] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.518] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.518] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.534] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.534] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.550] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.550] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.565] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.565] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.581] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.581] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.596] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.597] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.612] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.613] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.628] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.628] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.643] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.644] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.659] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.675] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.675] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.690] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.690] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.706] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.706] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.721] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.721] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.737] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.737] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.753] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.753] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.768] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.769] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.784] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.784] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.800] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.800] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.816] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.816] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.831] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.831] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.846] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.846] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.862] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.862] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.878] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.878] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.893] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.893] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.909] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.909] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.925] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.925] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.940] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.940] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0177.958] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.971] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.971] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0177.987] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0177.987] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.003] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.003] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.018] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.034] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.034] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.065] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.065] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.081] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.096] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.096] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.112] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.112] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.128] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.128] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.144] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.144] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.160] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.160] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.175] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.175] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.190] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.190] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.207] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.207] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.222] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.222] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.237] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.237] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.253] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.253] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.268] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.268] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.325] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.325] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.331] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.331] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.346] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.346] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.362] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.363] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.378] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.378] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.393] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.393] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.409] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.409] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.426] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.426] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.440] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.440] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.456] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.456] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.471] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.471] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.488] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.488] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.518] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.519] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.534] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.534] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.552] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.565] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.565] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.581] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.581] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.597] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.607] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.612] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.612] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.628] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.628] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.643] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.644] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.659] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.675] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.675] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.690] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.690] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.706] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.706] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.721] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.721] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.737] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.738] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.753] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.753] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.768] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.768] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.784] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.784] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.800] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.800] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.815] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.815] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.831] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.831] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.846] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.846] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.862] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.862] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.878] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.878] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.893] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.893] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.909] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.909] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.925] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.925] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.940] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.940] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.956] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0178.956] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.971] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.971] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0178.987] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0178.987] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.003] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.003] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.019] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.034] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.034] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.065] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.065] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.081] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.096] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.096] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.112] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.112] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.128] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.128] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.143] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.143] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.159] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.159] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.175] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.175] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.190] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.190] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.206] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.206] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.221] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.221] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.237] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.237] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.253] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.253] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.268] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.268] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.324] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.324] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.331] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.331] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.346] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.347] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.362] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.362] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.379] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.379] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.394] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.409] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.409] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.425] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.425] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.440] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.440] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.456] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.456] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.471] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.471] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.487] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.487] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.503] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.518] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.518] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.534] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.534] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.550] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.550] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.565] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.565] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.581] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.581] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.596] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.596] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.612] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.612] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.628] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.628] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.643] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.644] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.660] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.675] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.675] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.690] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.691] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.706] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.706] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.725] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.737] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.737] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.753] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.753] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.768] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.768] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.878] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.878] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.893] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.894] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.909] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.909] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.925] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.925] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.940] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.940] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.956] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.956] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.971] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0179.972] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0179.987] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0179.987] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.003] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.003] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.018] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.019] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.034] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.034] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.065] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.065] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.081] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.097] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.097] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.128] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.128] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.143] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.143] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.159] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.159] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.174] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.174] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.207] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.207] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.209] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.209] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.224] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.224] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.255] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.255] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.365] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.365] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.381] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.396] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.396] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.412] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.427] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.427] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.458] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.490] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.490] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.505] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.521] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.521] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.537] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.537] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.552] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.608] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.608] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.615] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.630] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.678] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.709] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.724] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.740] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.742] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.756] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.756] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.772] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.772] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.787] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.787] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.802] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.802] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.844] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.844] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.850] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.850] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.865] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0180.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.881] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.881] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.897] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.897] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.927] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.927] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0180.943] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0180.943] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.052] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.052] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.068] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.099] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.115] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.138] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.138] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.146] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.146] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.162] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.178] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.193] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.193] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.209] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.209] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.224] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.225] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.256] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.256] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.334] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.365] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.365] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.396] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.396] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.412] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.428] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.428] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.459] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.490] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.490] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.505] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.521] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.521] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.537] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.537] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.553] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.584] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.584] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.615] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.630] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.661] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.678] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.678] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.709] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.724] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.724] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.741] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.741] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.787] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.787] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.802] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.802] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.834] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.834] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.850] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.850] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.865] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.896] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.896] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.912] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.943] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.943] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0181.958] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.974] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.974] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0181.990] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0181.990] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.005] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.052] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.052] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.068] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.102] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.102] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.115] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.130] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.130] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.146] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.146] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.162] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.162] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.177] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.193] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.193] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.208] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.209] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.224] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.224] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.255] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.256] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.311] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.311] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.333] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.365] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.365] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.396] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.396] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.412] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.427] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.427] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.460] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.460] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.490] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.490] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.505] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.521] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.521] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.537] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.537] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.552] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.584] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.584] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.611] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.611] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.678] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.678] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.694] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.695] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.708] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.724] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.724] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.741] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.741] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.756] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.756] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.787] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.787] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.802] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.802] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.834] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.834] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.851] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.851] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.896] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.896] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.927] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.927] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.943] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.943] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.959] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.974] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0182.974] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0182.990] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0182.990] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.006] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.006] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.065] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.065] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.068] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.099] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.130] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.131] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.148] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.148] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.162] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.162] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.177] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.193] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.193] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.216] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.216] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.224] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.224] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.241] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.241] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.309] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.309] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.334] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.334] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.365] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.365] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.397] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.397] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.428] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.428] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.459] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.490] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.490] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.506] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.506] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.521] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.521] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.537] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.537] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.552] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.570] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.570] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.610] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.610] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.615] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.630] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.709] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.725] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.741] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.741] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.787] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.787] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.802] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.802] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.834] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.834] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.865] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.881] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.881] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.896] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.896] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.912] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.927] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.927] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.944] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.944] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.960] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0183.960] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0183.990] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0183.990] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.006] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.052] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.052] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.068] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.084] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.085] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.099] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.115] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.130] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.130] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.146] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.146] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.162] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.162] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.177] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.177] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.193] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.193] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.209] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.209] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.227] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.227] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.257] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.257] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.302] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.334] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.334] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.350] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.350] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.396] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.396] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.412] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.428] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.428] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.459] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.491] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.492] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.505] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.607] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.607] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.615] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.630] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.708] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.709] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.724] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.724] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.787] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.787] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.803] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.803] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.833] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.865] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.896] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.896] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.912] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.927] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0184.927] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.943] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.943] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.958] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.974] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.974] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0184.990] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0184.990] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.005] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.006] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.021] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.021] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.037] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.037] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.052] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.052] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.068] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.068] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.099] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.099] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.115] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.115] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.132] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.132] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.162] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.162] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.178] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.178] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.208] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.209] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.237] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.238] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.253] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.253] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.269] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.269] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.313] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.313] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.316] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.316] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.331] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.331] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.347] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.347] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.363] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.363] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.378] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.378] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.394] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.394] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.410] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.410] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.425] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.425] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.441] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.441] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.456] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.456] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.472] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.472] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.487] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.487] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.503] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.504] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.519] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.519] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.535] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.535] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.550] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.550] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.566] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.566] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.581] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.581] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.597] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.597] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.613] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.613] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.628] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.628] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.644] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.644] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.660] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.660] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.675] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.675] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.691] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.691] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.707] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.707] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.722] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.722] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.737] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.737] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.802] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.802] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.833] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.865] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0185.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0185.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0185.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.230] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.303] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.303] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.308] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.308] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.371] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.449] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.449] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.497] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.497] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.512] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.512] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.558] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.610] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.610] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.636] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.792] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0186.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0186.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0186.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.108] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.108] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.138] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.138] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.318] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.318] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.323] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.339] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.339] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.511] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.511] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.613] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.614] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.683] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.792] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0187.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0187.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0187.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.341] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.341] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.355] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.433] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.511] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.511] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.615] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.761] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.792] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0188.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0188.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0188.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.043] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.057] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.106] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.106] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.152] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.152] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.198] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.198] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.214] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.214] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.230] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.230] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.245] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.245] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.261] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.261] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.355] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.383] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.383] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.401] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.401] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.417] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.417] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.432] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.433] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.479] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.495] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.495] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.511] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.511] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.527] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.527] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.542] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.542] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.558] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.589] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.589] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.614] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.614] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.636] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.667] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.667] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.683] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.714] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.745] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.745] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.761] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.792] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.792] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.808] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.808] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.823] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.823] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.839] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.839] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.901] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.901] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0189.933] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.948] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.948] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.964] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.964] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.979] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0189.995] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0189.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.011] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.011] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.027] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.042] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.042] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.058] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.058] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.073] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.073] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.089] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.089] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.105] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.105] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.136] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.136] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.167] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.167] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.183] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.183] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.235] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.235] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.241] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.241] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.287] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.287] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.343] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.343] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.350] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.351] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.366] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.367] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.383] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.397] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.397] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.413] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.413] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.428] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.429] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.445] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.445] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.460] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.460] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.475] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.476] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.491] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.491] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.507] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.507] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.522] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.522] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.538] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.538] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.554] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.554] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.569] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.569] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.585] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.585] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.601] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.601] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.616] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.616] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.632] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.632] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.648] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.648] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.665] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.665] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.680] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.680] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.694] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.694] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.710] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.710] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.725] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0190.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.774] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.774] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.804] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.804] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.820] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.820] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.835] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.835] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.850] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.850] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.930] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.930] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0190.960] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0190.960] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.059] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.060] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.069] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.070] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.085] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.085] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.100] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.101] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0191.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.132] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.132] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.147] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0191.147] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.163] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0191.163] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.180] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.180] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.194] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.194] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.210] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.210] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.226] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.226] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.241] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.241] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.257] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0191.257] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.272] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.272] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.288] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0191.288] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.333] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.334] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.335] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.335] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.350] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.351] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.366] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.366] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.382] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.382] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.397] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0191.397] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.413] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.413] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.429] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.429] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.444] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0191.444] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.460] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.460] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.475] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0191.475] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.491] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0191.491] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.507] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.507] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.523] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.523] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.554] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.554] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.569] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.569] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.585] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.585] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.600] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.600] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0191.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.694] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.694] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.710] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.710] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.725] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.742] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.742] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.772] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.772] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.788] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.788] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.819] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.819] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.835] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.835] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.850] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.850] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.866] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.866] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.882] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.882] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.897] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.897] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.913] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.913] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.929] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0191.929] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.944] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0191.944] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0191.991] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0191.991] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.007] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.007] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.022] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.022] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.038] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.038] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.053] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.054] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.069] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.069] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.085] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.085] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.101] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.101] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.123] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.123] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.147] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.147] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.163] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.163] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.179] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.179] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.194] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.194] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.211] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.211] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.226] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.226] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.241] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.241] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.256] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.257] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.272] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.272] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.288] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.288] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.349] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.366] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.367] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.382] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.382] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.397] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.397] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.413] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.413] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.428] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.429] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.444] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.444] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.460] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.460] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.475] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.476] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.491] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.491] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.507] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.507] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.522] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.522] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.538] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.538] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.554] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.554] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.570] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.570] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.585] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.585] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.600] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.601] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.627] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.627] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.632] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.632] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.647] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.647] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.663] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.663] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.678] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.679] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.700] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.700] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.710] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.710] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.727] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.727] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.757] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.757] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.773] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.773] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.788] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.788] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.804] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.804] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.819] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.819] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.835] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.835] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.851] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.851] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.866] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.866] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.882] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.882] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.897] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.897] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.913] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.913] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.928] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.928] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.944] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.945] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.960] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.960] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.975] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0192.975] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0192.991] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0192.991] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.007] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.007] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.022] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.022] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.038] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.038] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.054] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.054] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.085] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.085] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.100] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.101] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.117] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.132] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.132] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.147] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.147] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.163] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.163] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.179] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.179] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.194] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.194] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.210] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.210] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.225] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.226] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.241] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.241] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.257] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.257] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.272] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.272] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.288] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.288] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.345] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.345] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.350] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.350] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.366] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.366] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.382] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.382] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.397] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.398] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.413] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.413] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.429] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.429] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.445] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.445] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.460] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.460] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.477] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.477] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.507] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.519] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.522] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.522] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.538] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.538] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.554] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.554] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.569] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.569] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.585] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.585] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.600] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.600] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.626] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.626] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.632] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.632] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.647] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.647] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.663] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.663] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.679] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.679] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.694] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.694] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.710] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.710] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.725] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.725] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.772] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.773] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.788] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.788] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.804] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.804] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.819] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.819] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.835] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.835] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.850] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.850] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.866] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.866] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.882] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.882] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.913] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.913] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.929] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.929] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.944] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.944] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.960] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.960] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.975] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0193.975] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0193.991] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0193.991] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.007] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.007] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.022] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.022] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.038] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.038] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.054] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.054] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.069] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.069] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.085] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.085] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.101] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.101] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.116] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.116] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.132] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.132] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.147] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.147] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.163] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.163] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.178] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.178] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.194] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.194] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.211] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.211] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.226] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.226] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.257] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.257] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.272] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.272] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.288] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.288] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.336] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.336] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.351] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.351] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.366] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.366] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.382] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.382] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.397] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.397] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.413] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.413] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.429] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.429] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.444] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.444] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.460] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.460] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.475] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.476] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.491] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.491] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.507] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.507] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.522] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.523] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.538] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.538] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.553] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.554] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.569] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.569] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.585] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.585] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.600] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.600] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.626] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.626] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.632] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.632] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.647] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.648] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.663] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.663] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.694] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.694] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.710] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.710] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.726] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.726] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.742] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.742] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.772] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.773] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.788] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.788] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.803] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.803] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.820] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.820] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.835] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.835] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.850] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.850] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.866] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.866] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.882] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.882] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.897] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.897] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.913] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.913] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.929] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.929] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.944] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0194.944] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.960] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.960] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.975] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.976] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0194.991] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0194.991] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.007] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.007] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.022] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.022] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.038] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.038] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.054] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.054] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.100] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.101] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.116] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.116] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.132] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.132] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.147] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.147] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.163] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.163] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.178] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.178] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.194] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.194] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.211] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.211] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.225] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.225] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.248] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.250] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.271] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.271] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.348] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.349] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.364] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.365] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.397] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.397] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.411] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.427] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.427] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.458] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.505] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.521] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.521] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.536] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.552] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.553] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.568] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.568] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.584] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.599] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.599] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.615] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.637] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.693] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.693] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.708] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.708] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.724] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.724] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.755] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.771] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.802] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.802] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.818] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.818] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.833] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.849] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.864] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.865] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.897] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.897] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.912] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.927] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.927] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.943] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0195.943] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.958] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0195.988] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0195.988] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.003] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.003] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.019] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.019] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.035] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.035] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.050] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.050] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.066] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.066] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.081] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.081] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.098] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.098] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.112] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.112] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.142] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.142] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.149] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.196] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.212] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.212] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.243] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.450] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.452] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.520] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.520] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.524] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.618] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.637] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.637] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.665] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.712] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.712] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.884] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.903] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.903] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0196.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0196.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0196.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.024] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.071] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.134] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.134] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.165] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.165] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.202] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.202] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.212] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.212] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.243] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.343] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.343] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.352] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.353] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.399] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.399] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.493] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.493] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.644] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.644] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.651] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.651] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.802] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.803] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.884] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.910] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.910] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0197.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0197.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0197.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.071] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.134] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.134] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.165] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.165] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.212] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.212] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.243] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.274] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.306] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.371] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.399] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.446] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.524] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.524] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.618] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.618] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.645] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.645] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.665] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.665] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.712] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.712] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.774] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.868] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.899] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0198.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0198.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0198.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.134] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.134] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.165] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.165] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.199] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.199] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.212] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.306] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.367] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.367] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.462] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.462] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.477] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.493] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.493] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.509] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.524] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.618] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.618] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.644] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.644] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.665] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.665] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.806] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.837] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.837] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.870] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.870] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.884] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.899] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.917] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.917] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0199.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.962] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.962] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0199.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0199.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.009] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.009] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.040] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.071] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.087] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.087] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.134] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.134] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.165] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.165] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.196] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.212] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.212] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.259] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.302] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.377] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.377] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.397] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.397] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.412] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.430] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.430] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.444] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.444] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.457] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.457] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.476] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.476] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.504] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.504] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.520] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.520] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.536] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.551] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.551] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.567] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.567] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.582] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.598] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.598] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.614] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.614] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.629] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.629] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.646] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.646] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.661] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.661] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.695] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.695] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.715] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.715] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.726] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.726] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.783] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.783] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.815] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.815] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.831] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.831] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.846] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.846] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.848] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.849] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.886] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.886] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.895] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0200.895] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.914] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.914] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.926] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.926] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.959] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.959] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.973] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.973] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0200.989] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0200.989] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.004] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.004] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.020] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.020] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.036] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.036] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.051] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.067] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.067] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.082] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.082] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.098] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.098] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.129] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.130] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.207] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.208] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.223] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.223] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.239] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.239] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.255] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.255] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.270] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.270] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.301] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.379] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.395] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.395] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.411] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.426] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.426] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.442] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.442] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.457] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.458] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.473] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.473] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.504] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.520] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.520] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.536] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.551] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.551] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.567] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.567] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.582] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.598] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.598] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.614] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.615] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.630] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.650] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.677] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.714] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.723] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.723] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.754] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.754] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.770] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.770] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.801] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.804] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.817] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.817] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.832] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.848] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.848] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.864] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.864] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.895] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.895] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.911] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.926] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.927] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.942] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0201.958] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.973] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.973] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0201.989] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0201.989] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.004] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.005] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.020] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.020] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.035] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.036] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.051] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.067] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.067] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.083] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.098] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.098] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.129] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.129] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.145] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.145] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.161] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.176] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.176] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.208] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.208] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.223] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.223] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.273] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.286] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.301] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.363] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.363] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.364] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.364] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.379] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.379] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.395] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.395] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.410] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.426] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.426] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.442] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.442] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.458] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.458] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.473] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.473] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.504] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.504] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.520] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.520] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.536] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.551] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.551] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.567] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.567] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.601] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.602] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.630] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.655] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.655] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.661] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.661] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.676] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.676] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.692] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.692] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.707] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.708] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.723] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.723] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.754] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.754] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.770] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.770] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.801] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.801] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.817] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.817] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.832] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.848] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.848] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.864] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.864] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.879] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.879] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.895] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.895] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.911] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.926] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.926] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.942] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.958] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0202.958] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.973] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.973] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0202.991] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0202.991] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.020] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.020] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.035] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.036] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.051] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.067] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.067] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.082] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.098] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.098] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.130] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.130] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.145] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.145] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.161] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.176] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.176] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.208] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.208] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.223] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.223] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.240] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.240] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.254] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.254] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.270] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.270] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.285] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.285] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.301] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.301] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.368] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.379] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.379] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.395] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.395] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.411] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.426] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.426] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.442] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.457] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.458] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.473] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.473] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.504] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.520] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.520] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.536] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.551] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.551] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.567] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.567] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.582] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.598] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.598] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.614] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.614] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.629] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.630] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.655] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.656] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.661] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.661] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.676] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.676] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.692] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.692] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.708] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.708] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.754] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.754] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.772] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.772] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.801] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.801] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.817] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.817] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.832] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.848] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.848] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.864] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.864] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.881] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.895] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.895] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.911] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.926] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.926] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.942] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.942] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.957] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.957] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.973] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0203.974] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0203.989] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0203.989] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.004] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.004] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.020] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.020] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.036] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.036] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.051] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.067] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.067] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.082] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.082] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.098] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.098] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.129] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.129] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.145] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.145] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.163] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.163] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.208] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.208] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.223] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.223] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.239] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.239] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.254] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.254] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.270] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.270] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.285] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.286] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.301] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.301] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.370] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.379] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.379] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.395] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.395] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.411] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.426] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.426] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.442] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.442] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.457] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.457] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.473] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.474] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.489] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.489] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.504] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.505] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.520] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.520] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.536] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.536] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.554] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.554] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.598] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.598] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.614] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.614] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.629] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.629] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.656] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.656] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.676] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.677] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.692] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.692] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.708] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.708] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.723] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.723] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.739] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.739] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.754] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.755] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.770] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.770] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.786] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.786] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.801] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.801] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.817] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.817] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.832] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.833] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.848] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.848] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.864] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.864] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.880] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.880] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.895] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.895] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.911] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.911] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.926] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.926] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.944] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0204.944] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.974] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.974] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0204.989] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0204.989] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.004] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.005] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.020] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.020] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.035] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.036] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.051] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.067] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.067] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.082] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.082] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.098] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.098] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.114] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.114] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.129] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.129] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.145] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.145] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.161] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.161] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.176] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.176] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.192] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.192] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.208] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.208] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.223] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.223] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.239] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.239] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.254] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.254] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.272] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.272] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.302] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.302] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.370] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.372] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.380] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.380] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.399] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.399] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.414] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.430] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.430] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.446] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.461] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.461] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.477] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.477] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.492] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.492] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.508] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.508] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.524] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.524] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.539] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.539] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.555] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.555] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.586] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.586] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.617] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.618] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.633] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.633] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.656] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.657] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.680] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.680] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.711] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.711] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.727] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.727] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.759] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.774] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.774] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.789] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.789] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.805] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.805] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.820] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.820] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.852] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.852] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0205.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.961] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.974] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.977] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.977] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0205.992] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0205.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.008] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.008] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.024] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.039] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.055] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.055] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.086] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.086] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.101] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.101] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.128] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.128] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.143] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.143] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.159] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.159] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.174] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.174] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.190] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.190] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.206] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.206] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.221] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.221] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.237] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.238] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.252] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.252] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.274] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.274] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.289] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.289] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.305] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.305] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.376] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.377] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.385] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.399] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.399] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.430] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.430] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.446] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.461] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.461] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.477] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.477] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.492] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.492] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.508] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.508] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.524] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.524] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.539] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.539] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.555] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.555] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.587] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.587] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.607] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.607] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.633] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.633] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.659] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.664] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.664] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.680] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.680] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.711] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.712] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.727] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.727] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.742] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.758] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.758] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.774] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.774] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.789] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.805] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.805] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.836] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.836] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.852] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.852] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.867] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.884] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.899] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.899] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.930] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.930] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.961] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.961] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.977] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0206.977] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0206.992] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0206.992] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.008] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.008] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.024] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.039] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.039] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.055] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.055] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.071] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.086] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.086] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.102] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.102] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.133] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.133] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.180] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.180] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.196] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.211] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.211] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.227] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.227] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.242] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.243] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.258] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.258] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.277] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.277] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.289] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.289] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.305] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.305] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.376] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.376] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.383] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.383] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.399] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.399] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.430] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.430] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.446] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.461] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.461] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.477] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.477] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.493] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.493] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.508] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.509] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.524] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.524] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.540] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.555] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.555] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.586] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.586] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.602] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.602] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.617] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.617] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.633] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.633] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.659] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.680] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.680] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.711] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.711] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.727] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.727] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.743] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.758] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.758] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.774] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.774] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.789] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.789] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.805] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.805] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.820] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.836] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.836] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.852] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.852] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.867] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.883] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.883] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.899] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.899] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.914] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.930] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.930] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.961] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0207.961] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.977] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.977] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0207.992] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0207.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.008] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.008] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.024] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.039] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.039] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.055] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.055] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.071] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.086] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.086] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.102] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.102] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.133] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.133] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.149] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.149] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.164] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.164] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.180] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.180] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.196] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.212] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.212] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.227] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.227] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.243] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.243] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.258] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.258] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.274] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.274] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.289] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.289] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.305] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.305] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.373] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.373] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.399] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.399] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.430] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.430] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.446] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.461] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.461] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.477] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.477] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.492] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.492] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.508] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.508] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.524] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.524] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.539] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.539] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.555] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.555] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.586] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.586] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.602] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.602] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.617] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.618] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.633] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.633] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.659] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.665] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.665] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.680] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.680] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.716] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.716] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.727] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.727] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.742] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.743] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.758] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.758] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.774] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.774] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.789] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.789] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.805] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.805] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.836] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.836] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.852] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.852] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.867] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.867] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.883] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.883] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.899] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.899] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.914] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0208.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.961] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.961] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.977] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.977] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0208.993] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0208.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.008] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.008] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.024] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.039] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.039] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.055] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.055] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.071] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.086] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.086] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.102] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.102] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.117] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.134] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.134] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.149] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.149] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.164] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.165] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.180] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.180] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.196] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.211] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.211] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.227] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.227] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.242] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.243] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.258] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.258] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.274] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.274] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.289] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.289] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.305] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.305] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.367] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.367] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.367] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.368] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.399] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.399] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.415] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.415] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.430] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.430] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.446] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.461] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.461] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.477] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.477] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.492] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.493] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.508] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.508] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.524] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.524] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.539] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.540] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.555] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.555] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.571] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.571] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.586] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.586] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.602] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.602] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.618] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.618] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.633] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.633] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.659] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.659] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.664] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.665] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.680] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.681] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.696] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.696] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.711] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.711] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.727] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.727] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.742] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.742] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.758] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.758] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.774] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.774] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.790] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.790] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.805] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.805] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.821] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.821] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.836] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.836] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.852] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.852] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.867] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.868] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.883] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.883] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.899] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.899] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.915] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.915] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.930] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.930] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.946] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.946] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.961] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.961] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.977] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0209.977] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0209.992] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0209.993] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.008] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.008] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.024] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.024] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.039] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.040] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.055] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.055] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.071] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.071] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.086] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0210.086] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.102] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.102] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.118] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.118] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.133] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0210.133] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.149] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.149] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.164] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0210.164] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.180] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0210.180] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.196] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.211] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.212] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.227] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.227] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.242] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.243] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.258] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0210.258] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.274] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0210.274] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.290] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.305] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.305] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.448] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.448] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.512] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.512] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.573] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.573] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0210.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.766] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.766] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.898] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.898] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0210.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0210.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0210.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0210.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0210.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.259] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.410] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.411] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.418] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.660] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.660] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.759] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.776] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.776] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.934] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.934] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0211.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0211.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0211.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.120] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.151] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.151] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.168] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.168] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.229] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.282] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.282] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.375] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.375] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.384] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.384] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.400] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.400] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.432] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.478] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.526] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.526] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.620] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.620] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.662] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.662] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.698] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.698] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.747] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.747] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.931] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.931] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0212.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0212.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0212.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.026] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.026] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.056] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.119] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.137] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.137] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.182] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.412] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.416] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.416] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.431] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.431] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.464] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.464] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.557] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.557] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.661] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.661] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.681] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.729] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.729] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.806] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.838] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.838] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.854] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.854] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.933] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.938] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0213.979] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0213.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0213.994] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.088] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.088] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.104] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.104] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.181] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.228] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.275] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.275] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.306] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.323] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.338] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.338] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.353] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.441] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.441] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.447] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.447] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.463] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.463] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.494] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.494] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.510] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.510] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.525] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.525] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.541] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.541] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.556] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.556] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.572] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.572] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.588] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.588] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.603] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.603] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.619] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.619] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.635] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.635] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.661] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.661] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.682] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.682] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.697] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.697] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.713] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.713] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.728] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.744] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.744] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.760] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.760] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.775] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.775] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.791] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.791] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.807] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.807] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.822] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.822] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.852] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.852] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.853] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.853] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.869] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.869] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.885] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.885] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.900] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.900] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.916] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.916] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.932] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.932] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.947] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.947] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.963] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.963] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.978] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0214.978] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0214.994] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0214.995] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.010] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.010] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.025] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.025] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.041] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.041] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.056] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.057] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.072] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.072] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.090] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.090] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.103] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.103] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.119] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.120] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.135] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.135] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.150] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.150] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.166] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.166] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.181] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.182] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.197] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.197] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.213] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.213] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.228] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.229] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.244] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.244] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.276] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.276] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.291] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.291] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.307] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.307] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.322] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.322] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.344] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.344] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.358] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.358] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.373] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.373] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.424] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.425] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.436] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.436] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.452] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.452] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.468] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.468] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.483] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.483] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.498] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.498] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.514] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.514] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.530] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.530] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.545] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.545] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.561] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.561] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.577] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.577] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.592] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.592] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.608] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.608] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.623] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.623] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.639] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.639] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.660] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.660] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.687] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.687] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.701] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.701] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.718] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.718] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.733] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.733] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.748] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.748] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.764] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.764] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.780] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.780] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.795] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.795] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.811] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.811] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.826] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.826] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.842] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.842] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.858] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.858] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.873] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.874] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.889] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.889] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.905] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.905] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.920] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.920] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.936] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.936] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.951] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.952] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.967] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.967] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.983] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0215.983] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0215.998] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0215.998] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.014] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.014] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.030] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.030] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.045] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.045] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.061] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.061] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.076] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.076] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.093] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.093] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.108] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.108] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.123] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.123] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.139] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.139] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.155] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.155] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.170] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.171] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.185] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.185] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.210] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.210] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.226] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.226] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.241] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.241] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.257] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.257] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.273] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.273] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.292] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.292] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.304] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.304] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.321] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.321] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.335] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.335] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.357] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.357] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.372] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.373] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.388] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.388] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.455] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.455] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.466] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.466] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.482] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.482] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.498] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.498] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.513] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.513] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.529] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.529] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.544] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.544] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.560] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.560] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.575] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.576] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.694] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.694] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.701] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.701] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.716] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.716] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.732] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.732] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.748] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.748] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.763] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.763] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.779] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.779] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.794] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.794] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.810] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.810] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.826] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.826] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.841] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.841] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.857] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.857] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.872] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.872] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.888] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.888] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.904] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0216.904] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.919] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.919] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.935] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.935] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.951] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.951] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.966] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.966] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.982] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.982] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0216.997] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0216.997] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.013] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.013] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.029] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.029] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.044] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.044] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.060] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.060] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.075] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.076] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.091] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.091] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.107] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.107] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.122] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.123] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.138] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.138] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.154] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.154] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.169] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.169] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.185] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.185] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.201] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.201] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.216] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.216] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.232] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.232] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.247] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.248] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.263] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.263] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.282] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.294] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.294] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.310] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.310] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.326] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.326] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.341] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.341] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.357] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.357] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.372] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.372] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.388] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.388] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.443] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.443] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.450] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.451] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.466] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.466] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.482] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.482] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.497] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.497] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.514] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.514] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.529] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.529] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.544] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.544] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.560] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.560] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.576] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.576] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.591] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.591] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.607] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.607] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.622] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.622] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.638] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.638] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.664] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.664] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.670] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.670] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.685] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.685] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.700] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.700] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.716] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.716] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.732] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.732] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.747] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.747] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.763] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.763] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.779] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.779] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.794] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.794] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.810] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.810] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.826] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.826] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.841] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.841] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.857] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.857] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.873] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.873] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.888] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.888] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.904] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.904] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.919] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.919] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.935] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0217.935] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.951] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.951] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.966] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.966] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.982] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.982] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0217.997] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0217.998] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.013] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.013] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.029] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.029] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.045] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.045] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.060] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.060] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.076] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.076] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.092] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.092] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.138] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.138] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.154] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.154] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.170] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.170] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.185] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.185] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.201] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.201] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.216] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.216] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.232] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.232] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.247] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.247] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.263] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.263] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.279] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.279] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.296] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.296] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.310] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.310] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.326] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.326] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.341] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.341] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.357] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.357] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.372] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.373] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.388] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.388] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.445] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.446] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.450] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.450] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.467] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.467] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.488] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.488] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.498] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.498] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.513] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.513] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.529] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.529] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.545] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.546] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.561] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.561] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.575] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.576] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.593] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.593] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.607] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.607] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.623] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.623] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.638] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.638] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.664] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.664] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.669] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.669] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.685] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.685] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.701] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.701] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.716] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.716] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.732] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.732] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.747] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.747] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.763] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.763] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.779] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.779] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.794] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.794] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.814] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.814] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.825] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.826] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.841] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.841] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.857] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.857] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.872] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.872] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.888] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.888] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.904] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.904] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.919] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.919] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.935] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.935] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.951] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.951] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.966] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0218.966] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.982] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.982] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0218.997] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0218.998] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.013] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.013] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.029] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.029] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.045] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.045] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.060] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.060] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.076] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.076] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.091] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.091] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.107] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.107] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.122] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.122] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.138] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.138] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.154] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.154] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.169] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.169] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.185] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.185] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.201] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.201] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.216] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.216] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.232] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.232] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.247] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.247] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.263] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.263] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.279] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.279] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.294] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.294] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.310] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.310] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.326] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.326] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.341] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.341] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.357] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.357] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.372] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.372] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.388] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.388] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.440] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.440] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.450] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.451] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.466] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.466] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.482] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.482] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.497] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.497] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.514] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.514] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.529] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.529] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.544] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.545] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.560] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.560] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.576] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.576] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.591] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.591] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.607] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.607] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.633] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.633] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.665] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.665] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.685] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.685] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.701] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.701] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.716] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.716] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.732] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.733] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.747] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.747] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.763] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.763] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.779] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.779] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.795] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.795] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.810] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.810] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.826] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.826] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.842] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.842] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.857] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.857] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.872] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.872] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.888] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.889] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.903] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.904] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.919] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.920] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.935] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.935] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.951] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.951] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.967] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.967] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.982] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0219.982] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0219.997] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0219.998] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.013] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.013] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.029] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.029] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.051] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.051] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.060] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.060] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.076] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.076] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.091] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.091] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.107] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.107] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.122] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.123] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.139] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.139] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.154] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.154] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.169] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.169] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.185] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.185] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.201] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.201] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.216] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.216] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.232] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.232] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.247] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.248] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.263] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.263] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.279] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.279] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.294] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.294] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.310] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.310] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.328] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.328] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.341] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.341] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.357] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.357] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.373] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.373] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.388] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.388] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.478] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.479] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.484] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.484] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.500] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.500] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.518] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.518] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.531] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.531] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.590] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.590] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.594] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.594] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.609] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.609] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.632] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.647] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.688] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.688] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.703] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.703] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.719] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.719] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.734] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.734] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.750] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.750] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.766] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.766] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.781] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.781] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.813] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.813] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.844] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.844] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.859] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.859] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.875] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.875] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.890] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.890] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.906] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.906] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.922] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.922] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.938] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.938] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0220.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0220.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0220.984] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.001] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.001] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.015] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.016] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.031] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.031] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.063] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.063] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.094] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.094] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.109] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.109] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.125] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.125] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.156] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.156] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.187] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.188] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.204] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.204] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.219] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.219] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.234] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.234] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.250] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.250] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.266] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.266] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.297] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.297] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.313] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.313] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.328] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.328] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.344] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.344] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.359] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.359] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.375] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.375] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.390] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.390] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.407] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.407] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.422] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.422] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.437] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.437] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.491] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.491] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.502] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.502] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.516] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.516] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.531] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.531] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.549] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.549] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.562] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.562] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.578] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.578] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.594] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.594] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.609] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.609] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.625] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.625] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.640] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.641] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.664] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.664] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.688] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.688] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.703] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.703] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.719] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.719] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.734] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.734] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.750] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.750] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.765] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.766] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.781] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.781] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.812] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.813] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.828] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.828] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.843] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.844] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.860] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.860] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.875] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.875] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.891] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.891] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.906] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.906] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.922] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.922] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.937] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.937] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0221.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0221.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0221.984] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.000] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.000] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.017] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.017] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.062] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.062] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.094] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.094] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.109] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.109] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.125] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.125] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.156] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.156] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.187] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.188] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.203] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.203] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.219] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.219] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.234] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.234] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.252] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.252] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.287] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.290] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.297] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.297] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.313] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.313] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.344] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.344] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.359] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.359] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.375] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.375] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.391] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.391] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.406] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.406] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.422] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.422] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.438] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.438] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.513] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.513] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.516] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.516] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.578] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.578] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.594] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.594] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.609] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.610] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.625] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.625] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.640] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.641] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.664] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.664] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.687] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.687] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.703] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.703] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.719] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.719] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.734] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.734] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.750] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.750] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.765] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.765] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.781] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.781] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.812] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.812] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.830] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.830] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.859] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.859] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.875] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.875] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.890] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.890] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.906] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.906] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.922] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.922] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.937] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.937] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0222.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0222.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0222.984] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.001] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.001] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.015] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.016] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.031] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.031] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.062] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.062] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.093] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.093] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.109] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.109] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.125] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.125] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.140] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.156] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.156] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.187] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.187] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.203] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.203] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.220] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.221] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.250] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.250] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.265] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.266] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.297] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.297] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.312] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.313] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.328] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.328] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.344] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.344] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.359] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.359] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.375] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.375] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.390] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.391] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.406] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.406] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.422] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.422] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.437] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.438] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.453] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.453] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.469] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.469] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.529] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.529] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.531] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.531] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.547] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.547] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.562] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.562] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.578] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.578] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.594] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.594] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.611] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.611] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.641] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.641] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.666] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.666] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.672] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.672] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.687] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.687] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.703] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.703] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.749] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.749] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.750] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.750] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.766] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.766] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.781] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.781] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.812] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.812] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.828] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.828] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.844] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.844] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.859] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.859] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.875] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.875] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.891] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.891] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.906] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.906] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.922] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.922] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.945] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.945] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0223.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0223.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0223.984] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.001] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.001] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.032] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.032] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.047] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.047] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.062] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.062] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.095] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.095] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.109] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.109] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.125] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.125] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.156] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.156] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.187] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.188] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.205] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.205] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.219] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.219] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.234] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.234] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.250] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.250] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.266] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.266] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.297] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.297] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.313] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.313] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.328] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.328] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.343] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.344] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.359] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.359] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.375] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.375] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.392] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.392] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.406] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.406] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.422] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.422] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.438] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.438] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.453] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.453] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.469] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.469] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.484] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.484] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.583] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.583] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.594] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.594] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.609] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.609] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.625] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.625] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.640] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.640] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.669] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.669] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.672] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.672] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.688] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.688] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.703] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.703] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.719] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.719] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.734] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.734] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.750] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.750] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.766] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.766] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.781] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.781] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.797] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.797] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.812] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.812] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.828] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.828] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.843] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.844] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.859] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.860] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.875] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.875] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.891] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.891] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.906] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.906] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.922] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.922] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.937] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0224.937] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.953] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.953] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.968] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.969] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0224.984] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0224.984] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.000] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.000] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.016] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.016] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.031] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0225.031] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.055] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.055] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.062] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0225.062] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.078] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.078] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.094] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.094] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.109] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0225.109] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.125] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.125] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.141] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.141] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.156] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0225.156] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.172] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0225.172] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.196] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.196] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.203] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.203] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.223] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0225.223] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.260] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.260] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.273] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.273] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.281] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.281] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.303] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0225.303] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.341] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.341] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.348] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.348] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.361] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0225.361] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.386] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.386] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.391] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.391] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.412] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.413] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.422] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.422] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.446] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 0 [0225.446] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.457] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.457] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.485] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.485] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.709] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.719] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.795] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.796] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.873] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0225.873] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0225.969] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0226.028] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0226.207] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0226.208] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0226.264] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0226.264] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0226.314] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0226.314] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0226.354] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0226.354] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0226.392] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0226.393] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0226.435] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0226.435] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0226.459] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0226.461] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0226.474] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0226.728] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x102 [0226.769] PeekMessageW (in: lpMsg=0x91ead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x91ead0) returned 1 [0226.771] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xa) returned 0x0 [0226.787] CloseHandle (hObject=0x530) returned 1 [0226.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=".exe", cchCount1=-1, lpString2=".exe", cchCount2=-1) returned 2 [0226.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0226.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0226.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0226.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0226.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0226.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0226.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0226.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="TempMode", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 2 [0226.788] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0226.788] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="1") returned 0x2 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0226.788] ExpandEnvironmentStringsW (in: lpSrc="D, PasswordIskk2511, , , 1.exe, ", lpDst=0x91db3c, nSize=0x1000 | out: lpDst="D, PasswordIskk2511, , , 1.exe, ") returned 0x21 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0226.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Shortcut", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 2 [0226.788] GetDlgItem (hDlg=0x502c0, nIDDlgItem=1) returned 0x102e8 [0226.788] EnableWindow (hWnd=0x102e8, bEnable=1) returned 0 [0226.789] GetProcAddress (hModule=0x769e0000, lpProcName="EndDialog") returned 0x769e9080 [0226.789] EndDialog (hDlg=0x502c0, nResult=0x1) returned 1 [0226.849] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x123c48 | out: hHeap=0x110000) returned 1 [0226.849] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x123b88 | out: hHeap=0x110000) returned 1 [0226.849] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="RarSFX0", cchCount1=6, lpString2="RarSFX", cchCount2=6) returned 2 [0226.849] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0226.853] GetProcAddress (hModule=0x74a80000, lpProcName="SHFileOperationW") returned 0x74c70a20 [0226.857] SHFileOperationW (in: lpFileOp=0x95f8a4*(hwnd=0x0, wFunc=0x3, pFrom="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0", pTo=0x0, fFlags=0x14, fAnyOperationsAborted=0, hNameMappings=0x0, lpszProgressTitle="ఀ픮윀⒄ø") | out: lpFileOp=0x95f8a4*(hwnd=0x0, wFunc=0x3, pFrom="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0", pTo=0x0, fFlags=0x14, fAnyOperationsAborted=0, hNameMappings=0x0, lpszProgressTitle="ఀ픮윀⒄ø")) returned 0 [0229.553] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x145b58 | out: hHeap=0x110000) returned 1 [0229.554] GetProcAddress (hModule=0x760b0000, lpProcName="DeleteObject") returned 0x760b52b0 [0229.554] DeleteObject (ho=0x80131) returned 0 [0229.554] GetProcAddress (hModule=0x760b0000, lpProcName="DeleteObject") returned 0x760b52b0 [0229.554] DeleteObject (ho=0x24050516) returned 1 [0229.555] IUnknown:AddRef (This=0x7488d000) returned 0x1 [0229.555] GdiplusShutdown (token=0xd80658) [0229.563] GetProcAddress (hModule=0x760e0000, lpProcName="OleUninitialize") returned 0x76114de0 [0229.563] OleUninitialize () [0229.569] GetModuleHandleW (lpModuleName=0x0) returned 0xd20000 [0229.569] GetModuleHandleW (lpModuleName=0x0) returned 0xd20000 [0229.569] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x153530 | out: hHeap=0x110000) returned 1 [0229.569] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x13f5e0 | out: hHeap=0x110000) returned 1 [0229.569] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x110f20 | out: hHeap=0x110000) returned 1 [0229.569] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x110d30 | out: hHeap=0x110000) returned 1 [0229.569] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x114c38 | out: hHeap=0x110000) returned 1 [0229.570] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1205d0 | out: hHeap=0x110000) returned 1 [0229.570] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x77380000 [0229.570] GetProcAddress (hModule=0x77380000, lpProcName="GetCurrentPackageId") returned 0x77383510 [0229.570] GetCurrentPackageId () returned 0x3d54 [0229.570] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x95f954 | out: phModule=0x95f954) returned 0 [0229.570] ExitProcess (uExitCode=0x0) [0229.570] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11ec20 | out: hHeap=0x110000) returned 1 Thread: id = 2 os_tid = 0x12f4 Thread: id = 3 os_tid = 0xfec Thread: id = 4 os_tid = 0xf28 Thread: id = 5 os_tid = 0xf50 Thread: id = 6 os_tid = 0x1040 Thread: id = 7 os_tid = 0x1054 Thread: id = 24 os_tid = 0x13b8 Thread: id = 25 os_tid = 0xa00 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x49390000" os_pid = "0x538" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x24c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:00011899" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 8 os_tid = 0x908 Thread: id = 9 os_tid = 0x900 Thread: id = 10 os_tid = 0x8f8 Thread: id = 11 os_tid = 0x8f0 Thread: id = 12 os_tid = 0x570 Thread: id = 13 os_tid = 0x5a8 Thread: id = 14 os_tid = 0x614 Thread: id = 15 os_tid = 0x610 Thread: id = 16 os_tid = 0x604 Thread: id = 17 os_tid = 0x598 Thread: id = 18 os_tid = 0x594 Thread: id = 19 os_tid = 0x590 Thread: id = 20 os_tid = 0x53c Process: id = "3" image_name = "1.exe" filename = "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0\\1.exe" page_root = "0x2aedf000" os_pid = "0x1068" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x60" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0\\1.exe\" " cur_dir = "C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000faa5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 21 os_tid = 0x1080 [0061.475] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x74030000 [0061.476] GetProcAddress (hModule=0x74030000, lpProcName="lstrlenA") returned 0x74046c50 [0061.476] GetProcAddress (hModule=0x74030000, lpProcName="CloseHandle") returned 0x7409eab0 [0061.476] GetProcAddress (hModule=0x74030000, lpProcName="CopyFileA") returned 0x7407ceb0 [0061.476] GetProcAddress (hModule=0x74030000, lpProcName="CreateFileA") returned 0x7409ed00 [0061.476] GetProcAddress (hModule=0x74030000, lpProcName="ExitProcess") returned 0x74043cb0 [0061.476] GetProcAddress (hModule=0x74030000, lpProcName="FindClose") returned 0x7409ed70 [0061.476] GetProcAddress (hModule=0x74030000, lpProcName="FindFirstFileA") returned 0x7409edb0 [0061.476] GetProcAddress (hModule=0x74030000, lpProcName="FindNextFileA") returned 0x7409ee20 [0061.476] GetProcAddress (hModule=0x74030000, lpProcName="FindResourceA") returned 0x740827c0 [0061.476] GetProcAddress (hModule=0x74030000, lpProcName="FreeResource") returned 0x74044c80 [0061.476] GetProcAddress (hModule=0x74030000, lpProcName="GetCommandLineA") returned 0x74044cb0 [0061.476] GetProcAddress (hModule=0x74030000, lpProcName="GetEnvironmentVariableA") returned 0x74044f90 [0061.477] GetProcAddress (hModule=0x74030000, lpProcName="GetFileAttributesA") returned 0x7409eee0 [0061.477] GetProcAddress (hModule=0x74030000, lpProcName="GetFileSize") returned 0x7409ef30 [0061.477] GetProcAddress (hModule=0x74030000, lpProcName="GetFileTime") returned 0x7409ef50 [0061.477] GetProcAddress (hModule=0x74030000, lpProcName="GetLogicalDrives") returned 0x74040d20 [0061.477] GetProcAddress (hModule=0x74030000, lpProcName="GetModuleFileNameA") returned 0x74045070 [0061.477] GetProcAddress (hModule=0x74030000, lpProcName="GetModuleHandleA") returned 0x740450b0 [0061.477] GetProcAddress (hModule=0x74030000, lpProcName="GetProcessHeap") returned 0x740451f0 [0061.477] GetProcAddress (hModule=0x74030000, lpProcName="GetTempPathA") returned 0x7409efe0 [0061.477] GetProcAddress (hModule=0x74030000, lpProcName="GetWindowsDirectoryA") returned 0x74045710 [0061.477] GetProcAddress (hModule=0x74030000, lpProcName="GlobalFree") returned 0x74041ee0 [0061.477] GetProcAddress (hModule=0x74030000, lpProcName="HeapAlloc") returned 0x773d2dc0 [0061.477] GetProcAddress (hModule=0x74030000, lpProcName="LoadResource") returned 0x74045b00 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="LockResource") returned 0x74045bc0 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="MoveFileA") returned 0x7407e410 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="ReadFile") returned 0x7409f090 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="RtlMoveMemory") returned 0x77415ad0 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="SetErrorMode") returned 0x74046500 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="SetFilePointer") returned 0x7409f120 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="SetFileTime") returned 0x7409f140 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="SizeofResource") returned 0x74046740 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="WriteFile") returned 0x7409f180 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="lstrcatA") returned 0x740870c0 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="lstrcmpA") returned 0x74046b90 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="lstrcmpiA") returned 0x74046bd0 [0061.478] GetProcAddress (hModule=0x74030000, lpProcName="lstrcpyA") returned 0x74087060 [0061.478] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x745c0000 [0061.479] GetProcAddress (hModule=0x745c0000, lpProcName="RegCreateKeyExA") returned 0x745df560 [0061.479] GetProcAddress (hModule=0x745c0000, lpProcName="CryptCreateHash") returned 0x745deed0 [0061.479] GetProcAddress (hModule=0x745c0000, lpProcName="CryptDestroyHash") returned 0x745df0e0 [0061.479] GetProcAddress (hModule=0x745c0000, lpProcName="CryptGetHashParam") returned 0x745dee70 [0061.479] GetProcAddress (hModule=0x745c0000, lpProcName="RegSetValueExA") returned 0x745dffc0 [0061.479] GetProcAddress (hModule=0x745c0000, lpProcName="RegDeleteKeyA") returned 0x745df8c0 [0061.479] GetProcAddress (hModule=0x745c0000, lpProcName="CryptAcquireContextA") returned 0x745dfc40 [0061.479] GetProcAddress (hModule=0x745c0000, lpProcName="RegCloseKey") returned 0x745ded60 [0061.479] GetProcAddress (hModule=0x745c0000, lpProcName="CryptReleaseContext") returned 0x745dfbc0 [0061.479] GetProcAddress (hModule=0x745c0000, lpProcName="CryptHashData") returned 0x745deef0 [0061.479] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x726a0000 [0061.480] GetProcAddress (hModule=0x726a0000, lpProcName="InitCommonControls") returned 0x726be450 [0061.480] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x760b0000 [0061.480] GetProcAddress (hModule=0x760b0000, lpProcName="CreateFontIndirectA") returned 0x760b4880 [0061.480] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74a80000 [0061.480] GetProcAddress (hModule=0x74a80000, lpProcName="ShellExecuteA") returned 0x74c83ef0 [0061.480] GetProcAddress (hModule=0x74a80000, lpProcName="SHGetSpecialFolderPathA") returned 0x74cdcc90 [0061.480] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x74640000 [0061.480] GetProcAddress (hModule=0x74640000, lpProcName="PathFindFileNameA") returned 0x74654640 [0061.480] GetProcAddress (hModule=0x74640000, lpProcName="PathFindExtensionA") returned 0x7465bfe0 [0061.480] GetProcAddress (hModule=0x74640000, lpProcName="PathAddBackslashA") returned 0x74657700 [0061.480] GetProcAddress (hModule=0x74640000, lpProcName="PathMatchSpecA") returned 0x7465c2a0 [0061.480] LoadLibraryA (lpLibFileName="user32.dll") returned 0x769e0000 [0061.480] GetProcAddress (hModule=0x769e0000, lpProcName="RegisterClassExA") returned 0x769f8260 [0061.481] GetProcAddress (hModule=0x769e0000, lpProcName="PeekMessageA") returned 0x769f87a0 [0061.481] GetProcAddress (hModule=0x769e0000, lpProcName="SendMessageA") returned 0x769f0630 [0061.481] GetProcAddress (hModule=0x769e0000, lpProcName="LoadCursorA") returned 0x76a0ab70 [0061.481] GetProcAddress (hModule=0x769e0000, lpProcName="GetSystemMetrics") returned 0x76a0ddc0 [0061.481] GetProcAddress (hModule=0x769e0000, lpProcName="GetMessageA") returned 0x769fbdf0 [0061.481] GetProcAddress (hModule=0x769e0000, lpProcName="GetDlgItemTextA") returned 0x76a5f2d0 [0061.481] GetProcAddress (hModule=0x769e0000, lpProcName="EndPaint") returned 0x76a132d0 [0061.481] GetProcAddress (hModule=0x769e0000, lpProcName="SystemParametersInfoA") returned 0x769f5060 [0061.481] GetProcAddress (hModule=0x769e0000, lpProcName="TranslateMessage") returned 0x76a0f900 [0061.481] GetProcAddress (hModule=0x769e0000, lpProcName="UpdateWindow") returned 0x769f2b80 [0061.481] GetProcAddress (hModule=0x769e0000, lpProcName="MessageBoxA") returned 0x76a4d740 [0061.481] GetProcAddress (hModule=0x769e0000, lpProcName="DispatchMessageA") returned 0x769ffd80 [0061.482] GetProcAddress (hModule=0x769e0000, lpProcName="DefWindowProcA") returned 0x77415680 [0061.482] GetProcAddress (hModule=0x769e0000, lpProcName="CreateWindowExA") returned 0x76a01470 [0061.482] GetProcAddress (hModule=0x769e0000, lpProcName="BeginPaint") returned 0x76a12fb0 [0061.482] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x19ff60 | out: lpflOldProtect=0x19ff60*=0x2) returned 1 [0061.512] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x19ff60 | out: lpflOldProtect=0x19ff60*=0x4) returned 1 [0061.513] GetProcessHeap () returned 0x740000 [0061.514] FindResourceA (hModule=0x0, lpName=0xe, lpType=0x2) returned 0x42c0c8 [0061.514] SizeofResource (hModule=0x0, hResInfo=0x42c0c8) returned 0x30b [0061.514] LoadResource (hModule=0x0, hResInfo=0x42c0c8) returned 0x428ddc [0061.514] LockResource (hResData=0x428ddc) returned 0x428ddc [0061.514] RtlMoveMemory (in: Destination=0x406db9, Source=0x428ddc, Length=0x10 | out: Destination=0x406db9) [0061.514] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x16c) returned 0x752b88 [0061.514] RtlMoveMemory (in: Destination=0x752b88, Source=0x428df0, Length=0x16c | out: Destination=0x752b88) [0061.514] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x133) returned 0x74ffd8 [0061.514] RtlMoveMemory (in: Destination=0x74ffd8, Source=0x428f60, Length=0x133 | out: Destination=0x74ffd8) [0061.514] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xb) returned 0x75dfa8 [0061.514] RtlMoveMemory (in: Destination=0x75dfa8, Source=0x429097, Length=0xb | out: Destination=0x75dfa8) [0061.514] RtlMoveMemory (in: Destination=0x406dc9, Source=0x4290a2, Length=0x10 | out: Destination=0x406dc9) [0061.514] RtlMoveMemory (in: Destination=0x407529, Source=0x4290b2, Length=0x5 | out: Destination=0x407529) [0061.514] RtlMoveMemory (in: Destination=0x406dd9, Source=0x4290b7, Length=0x10 | out: Destination=0x406dd9) [0061.514] RtlMoveMemory (in: Destination=0x406de9, Source=0x4290c7, Length=0x10 | out: Destination=0x406de9) [0061.514] RtlMoveMemory (in: Destination=0x407525, Source=0x4290d7, Length=0x4 | out: Destination=0x407525) [0061.515] RtlMoveMemory (in: Destination=0x4065a5, Source=0x4290db, Length=0x4 | out: Destination=0x4065a5) [0061.515] RtlMoveMemory (in: Destination=0x4065a9, Source=0x4290df, Length=0x4 | out: Destination=0x4065a9) [0061.515] RtlMoveMemory (in: Destination=0x4065ad, Source=0x4290e3, Length=0x4 | out: Destination=0x4065ad) [0061.515] FreeResource (hResData=0x428ddc) returned 0 [0061.515] GetTempPathA (in: nBufferLength=0x200, lpBuffer=0x404e50 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0061.515] lstrcpyA (in: lpString1=0x405950, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\" [0061.515] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x405450, nSize=0x500 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0\\1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0\\1.exe")) returned 0x30 [0061.526] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1a8bf8) returned 0x2143020 [0061.530] GetWindowsDirectoryA (in: lpBuffer=0x40755e, uSize=0x200 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0061.530] PathAddBackslashA (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS\\") returned="" [0061.531] lstrcatA (in: lpString1="C:\\WINDOWS\\", lpString2="explorer.exe" | out: lpString1="C:\\WINDOWS\\explorer.exe") returned="C:\\WINDOWS\\explorer.exe" [0061.531] CreateFileA (lpFileName="C:\\WINDOWS\\explorer.exe" (normalized: "c:\\windows\\explorer.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.531] GetFileTime (in: hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556 | out: lpCreationTime=0x407546*(dwLowDateTime=0x46742519, dwHighDateTime=0x1d2fa08), lpLastAccessTime=0x40754e*(dwLowDateTime=0x75f1db39, dwHighDateTime=0x1d2fa09), lpLastWriteTime=0x407556*(dwLowDateTime=0x46742519, dwHighDateTime=0x1d2fa08)) returned 1 [0061.531] CloseHandle (hObject=0x1d4) returned 1 [0061.531] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpString2="L62qp156vd23Q0V" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V" [0061.531] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V", lpString2=".exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe" [0061.531] CopyFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RarSFX0\\1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rarsfx0\\1.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\l62qp156vd23q0v.exe"), bFailIfExists=1) returned 1 [0061.547] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\l62qp156vd23q0v.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.548] SetFileTime (hFile=0x1d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.548] CloseHandle (hObject=0x1d4) returned 1 [0061.548] RegCreateKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff64, lpdwDisposition=0x19ff68 | out: phkResult=0x19ff64*=0x1d4, lpdwDisposition=0x19ff68*=0x2) returned 0x0 [0061.548] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe") returned 54 [0061.548] RegSetValueExA (in: hKey=0x1d4, lpValueName="Alcmeter", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe", cbData=0x36 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe") returned 0x0 [0061.548] RegCloseKey (hKey=0x1d4) returned 0x0 [0061.549] lstrcpyA (in: lpString1=0x4065b9, lpString2="." | out: lpString1=".") returned="." [0061.549] lstrcatA (in: lpString1=".", lpString2="EnCiPhErEd" | out: lpString1=".EnCiPhErEd") returned=".EnCiPhErEd" [0061.549] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey=".EnCiPhErEd", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff60, lpdwDisposition=0x19ff64 | out: phkResult=0x19ff60*=0x1fe, lpdwDisposition=0x19ff64*=0x1) returned 0x0 [0061.572] lstrlenA (lpString="TRQMYWRHTYHQVCX") returned 15 [0061.572] RegSetValueExA (in: hKey=0x1fe, lpValueName="", Reserved=0x0, dwType=0x1, lpData="TRQMYWRHTYHQVCX", cbData=0xf | out: lpData="TRQMYWRHTYHQVCX") returned 0x0 [0061.572] RegCloseKey (hKey=0x1fe) returned 0x0 [0061.572] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="TRQMYWRHTYHQVCX", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff60, lpdwDisposition=0x19ff64 | out: phkResult=0x19ff60*=0x1da, lpdwDisposition=0x19ff64*=0x1) returned 0x0 [0061.586] lstrlenA (lpString="CRYPTED!") returned 8 [0061.586] RegSetValueExA (in: hKey=0x1da, lpValueName="", Reserved=0x0, dwType=0x1, lpData="CRYPTED!", cbData=0x8 | out: lpData="CRYPTED!") returned 0x0 [0061.586] RegCloseKey (hKey=0x1da) returned 0x0 [0061.586] lstrcpyA (in: lpString1=0x4065b9, lpString2="TRQMYWRHTYHQVCX" | out: lpString1="TRQMYWRHTYHQVCX") returned="TRQMYWRHTYHQVCX" [0061.586] lstrcatA (in: lpString1="TRQMYWRHTYHQVCX", lpString2="\\DefaultIcon" | out: lpString1="TRQMYWRHTYHQVCX\\DefaultIcon") returned="TRQMYWRHTYHQVCX\\DefaultIcon" [0061.586] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe", lpString2=",0" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe,0") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe,0" [0061.586] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="TRQMYWRHTYHQVCX\\DefaultIcon", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff60, lpdwDisposition=0x19ff64 | out: phkResult=0x19ff60*=0x1fe, lpdwDisposition=0x19ff64*=0x1) returned 0x0 [0061.586] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe,0") returned 56 [0061.586] RegSetValueExA (in: hKey=0x1fe, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe,0", cbData=0x38 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe,0") returned 0x0 [0061.586] RegCloseKey (hKey=0x1fe) returned 0x0 [0061.587] lstrcpyA (in: lpString1=0x4065b9, lpString2="TRQMYWRHTYHQVCX" | out: lpString1="TRQMYWRHTYHQVCX") returned="TRQMYWRHTYHQVCX" [0061.587] lstrcatA (in: lpString1="TRQMYWRHTYHQVCX", lpString2="\\shell\\open\\command" | out: lpString1="TRQMYWRHTYHQVCX\\shell\\open\\command") returned="TRQMYWRHTYHQVCX\\shell\\open\\command" [0061.587] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe,0") returned 56 [0061.587] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="TRQMYWRHTYHQVCX\\shell\\open\\command", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x19ff60, lpdwDisposition=0x19ff64 | out: phkResult=0x19ff60*=0x202, lpdwDisposition=0x19ff64*=0x1) returned 0x0 [0061.587] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe") returned 54 [0061.587] RegSetValueExA (in: hKey=0x202, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe", cbData=0x36 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\L62qp156vd23Q0V.exe") returned 0x0 [0061.587] RegCloseKey (hKey=0x202) returned 0x0 [0061.587] SetErrorMode (uMode=0x1) returned 0x0 [0061.587] GetLogicalDrives () returned 0x4 [0061.588] FindFirstFileA (in: lpFileName="C:\\*.*", lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19ff60, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x759a50 [0061.588] lstrcmpA (lpString1=".", lpString2="$GetCurrent") returned 1 [0061.589] lstrcmpA (lpString1="..", lpString2="$GetCurrent") returned 1 [0061.590] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0061.590] lstrcatA (in: lpString1="C:\\", lpString2="$GetCurrent" | out: lpString1="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0061.590] lstrlenA (lpString="C:\\$GetCurrent") returned 14 [0061.590] FindFirstFileA (in: lpFileName="C:\\$GetCurrent\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19febc, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0061.611] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.611] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19febc, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0061.611] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.612] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.612] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19febc, dwReserved1=0x20000, cFileName="Logs", cAlternateFileName="")) returned 1 [0061.612] lstrcmpA (lpString1=".", lpString2="Logs") returned -1 [0061.612] lstrcmpA (lpString1="..", lpString2="Logs") returned -1 [0061.612] PathFindFileNameA (pszPath="C:\\$GetCurrent\\*.*") returned="*.*" [0061.612] lstrcatA (in: lpString1="C:\\$GetCurrent\\", lpString2="Logs" | out: lpString1="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0061.612] lstrlenA (lpString="C:\\$GetCurrent\\Logs") returned 19 [0061.612] FindFirstFileA (in: lpFileName="C:\\$GetCurrent\\Logs\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x75e218, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0061.615] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.615] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x75e218, cFileName="..", cAlternateFileName="")) returned 1 [0061.615] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.615] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.615] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0xfffffffe, dwReserved1=0x75e218, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0061.615] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.615] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0061.615] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0061.615] lstrcmpiA (lpString1="", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0061.615] PathFindFileNameA (pszPath="C:\\$GetCurrent\\Logs\\*.*") returned="*.*" [0061.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0061.615] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\Logs\\" | out: pszPath="C:\\$GetCurrent\\Logs\\") returned="" [0061.615] lstrcatA (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$GetCurrent\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\$GetCurrent\\Logs\\HOW TO DECRYPT FILES.txt" [0061.616] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$getcurrent\\logs\\how to decrypt files.txt")) returned 0xffffffff [0061.616] CreateFileA (lpFileName="C:\\$GetCurrent\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$getcurrent\\logs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0061.617] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0061.617] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0061.618] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.618] CloseHandle (hObject=0x208) returned 1 [0061.619] lstrcatA (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="downlevel_2017_09_07_02_02_39_766.log" | out: lpString1="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.zip") returned 0 [0061.619] lstrlenA (lpString="*.zip") returned 5 [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.rar") returned 0 [0061.619] lstrlenA (lpString="*.rar") returned 5 [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.7z") returned 0 [0061.619] lstrlenA (lpString="*.7z") returned 4 [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.tar") returned 0 [0061.619] lstrlenA (lpString="*.tar") returned 5 [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.gzip") returned 0 [0061.619] lstrlenA (lpString="*.gzip") returned 6 [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.jpg") returned 0 [0061.619] lstrlenA (lpString="*.jpg") returned 5 [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.jpeg") returned 0 [0061.619] lstrlenA (lpString="*.jpeg") returned 6 [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.psd") returned 0 [0061.619] lstrlenA (lpString="*.psd") returned 5 [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.cdr") returned 0 [0061.619] lstrlenA (lpString="*.cdr") returned 5 [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.dwg") returned 0 [0061.619] lstrlenA (lpString="*.dwg") returned 5 [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.max") returned 0 [0061.619] lstrlenA (lpString="*.max") returned 5 [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.bmp") returned 0 [0061.619] lstrlenA (lpString="*.bmp") returned 5 [0061.619] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.gif") returned 0 [0061.619] lstrlenA (lpString="*.gif") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.png") returned 0 [0061.620] lstrlenA (lpString="*.png") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.doc") returned 0 [0061.620] lstrlenA (lpString="*.doc") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.docx") returned 0 [0061.620] lstrlenA (lpString="*.docx") returned 6 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.xls") returned 0 [0061.620] lstrlenA (lpString="*.xls") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.xlsx") returned 0 [0061.620] lstrlenA (lpString="*.xlsx") returned 6 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.ppt") returned 0 [0061.620] lstrlenA (lpString="*.ppt") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.pptx") returned 0 [0061.620] lstrlenA (lpString="*.pptx") returned 6 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.txt") returned 0 [0061.620] lstrlenA (lpString="*.txt") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.pdf") returned 0 [0061.620] lstrlenA (lpString="*.pdf") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.djvu") returned 0 [0061.620] lstrlenA (lpString="*.djvu") returned 6 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.htm") returned 0 [0061.620] lstrlenA (lpString="*.htm") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.html") returned 0 [0061.620] lstrlenA (lpString="*.html") returned 6 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mdb") returned 0 [0061.620] lstrlenA (lpString="*.mdb") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.cer") returned 0 [0061.620] lstrlenA (lpString="*.cer") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.p12") returned 0 [0061.620] lstrlenA (lpString="*.p12") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.pfx") returned 0 [0061.620] lstrlenA (lpString="*.pfx") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.kwm") returned 0 [0061.620] lstrlenA (lpString="*.kwm") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.pwm") returned 0 [0061.620] lstrlenA (lpString="*.pwm") returned 5 [0061.620] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.1cd") returned 0 [0061.620] lstrlenA (lpString="*.1cd") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.md") returned 0 [0061.621] lstrlenA (lpString="*.md") returned 4 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mdf") returned 0 [0061.621] lstrlenA (lpString="*.mdf") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.dbf") returned 0 [0061.621] lstrlenA (lpString="*.dbf") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.odt") returned 0 [0061.621] lstrlenA (lpString="*.odt") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.vob") returned 0 [0061.621] lstrlenA (lpString="*.vob") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.ifo") returned 0 [0061.621] lstrlenA (lpString="*.ifo") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.lnk") returned 0 [0061.621] lstrlenA (lpString="*.lnk") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.torrent") returned 0 [0061.621] lstrlenA (lpString="*.torrent") returned 9 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mov") returned 0 [0061.621] lstrlenA (lpString="*.mov") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.m2v") returned 0 [0061.621] lstrlenA (lpString="*.m2v") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.3gp") returned 0 [0061.621] lstrlenA (lpString="*.3gp") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mpeg") returned 0 [0061.621] lstrlenA (lpString="*.mpeg") returned 6 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mpg") returned 0 [0061.621] lstrlenA (lpString="*.mpg") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.flv") returned 0 [0061.621] lstrlenA (lpString="*.flv") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.avi") returned 0 [0061.621] lstrlenA (lpString="*.avi") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mp4") returned 0 [0061.621] lstrlenA (lpString="*.mp4") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.wmv") returned 0 [0061.621] lstrlenA (lpString="*.wmv") returned 5 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.divx") returned 0 [0061.621] lstrlenA (lpString="*.divx") returned 6 [0061.621] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mkv") returned 0 [0061.622] lstrlenA (lpString="*.mkv") returned 5 [0061.622] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.mp3") returned 0 [0061.622] lstrlenA (lpString="*.mp3") returned 5 [0061.622] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.wav") returned 0 [0061.622] lstrlenA (lpString="*.wav") returned 5 [0061.622] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.flac") returned 0 [0061.622] lstrlenA (lpString="*.flac") returned 6 [0061.622] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.ape") returned 0 [0061.622] lstrlenA (lpString="*.ape") returned 5 [0061.622] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.wma") returned 0 [0061.622] lstrlenA (lpString="*.wma") returned 5 [0061.622] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.ac3") returned 0 [0061.622] lstrlenA (lpString="*.ac3") returned 5 [0061.622] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", pszSpec="*.doc") returned 0 [0061.622] lstrlenA (lpString="*.doc") returned 5 [0061.622] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x1, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0061.622] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.622] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oobe_2017_09_07_03_08_57_737.log") returned -1 [0061.622] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oobe_2017_09_07_03_08_57_737.log") returned -1 [0061.622] lstrcmpiA (lpString1="", lpString2="oobe_2017_09_07_03_08_57_737.log") returned -1 [0061.622] PathFindFileNameA (pszPath="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned="downlevel_2017_09_07_02_02_39_766.log" [0061.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0061.622] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\Logs\\" | out: pszPath="C:\\$GetCurrent\\Logs\\") returned="" [0061.622] lstrcatA (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$GetCurrent\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\$GetCurrent\\Logs\\HOW TO DECRYPT FILES.txt" [0061.622] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$getcurrent\\logs\\how to decrypt files.txt")) returned 0x20 [0061.622] lstrcatA (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="oobe_2017_09_07_03_08_57_737.log" | out: lpString1="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" [0061.622] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.zip") returned 0 [0061.622] lstrlenA (lpString="*.zip") returned 5 [0061.622] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.rar") returned 0 [0061.622] lstrlenA (lpString="*.rar") returned 5 [0061.622] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.7z") returned 0 [0061.622] lstrlenA (lpString="*.7z") returned 4 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.tar") returned 0 [0061.623] lstrlenA (lpString="*.tar") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.gzip") returned 0 [0061.623] lstrlenA (lpString="*.gzip") returned 6 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.jpg") returned 0 [0061.623] lstrlenA (lpString="*.jpg") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.jpeg") returned 0 [0061.623] lstrlenA (lpString="*.jpeg") returned 6 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.psd") returned 0 [0061.623] lstrlenA (lpString="*.psd") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.cdr") returned 0 [0061.623] lstrlenA (lpString="*.cdr") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.dwg") returned 0 [0061.623] lstrlenA (lpString="*.dwg") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.max") returned 0 [0061.623] lstrlenA (lpString="*.max") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.bmp") returned 0 [0061.623] lstrlenA (lpString="*.bmp") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.gif") returned 0 [0061.623] lstrlenA (lpString="*.gif") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.png") returned 0 [0061.623] lstrlenA (lpString="*.png") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.doc") returned 0 [0061.623] lstrlenA (lpString="*.doc") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.docx") returned 0 [0061.623] lstrlenA (lpString="*.docx") returned 6 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.xls") returned 0 [0061.623] lstrlenA (lpString="*.xls") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.xlsx") returned 0 [0061.623] lstrlenA (lpString="*.xlsx") returned 6 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.ppt") returned 0 [0061.623] lstrlenA (lpString="*.ppt") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.pptx") returned 0 [0061.623] lstrlenA (lpString="*.pptx") returned 6 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.txt") returned 0 [0061.623] lstrlenA (lpString="*.txt") returned 5 [0061.623] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.pdf") returned 0 [0061.624] lstrlenA (lpString="*.pdf") returned 5 [0061.624] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.djvu") returned 0 [0061.624] lstrlenA (lpString="*.djvu") returned 6 [0061.624] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.htm") returned 0 [0061.627] lstrlenA (lpString="*.htm") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.html") returned 0 [0061.627] lstrlenA (lpString="*.html") returned 6 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mdb") returned 0 [0061.627] lstrlenA (lpString="*.mdb") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.cer") returned 0 [0061.627] lstrlenA (lpString="*.cer") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.p12") returned 0 [0061.627] lstrlenA (lpString="*.p12") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.pfx") returned 0 [0061.627] lstrlenA (lpString="*.pfx") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.kwm") returned 0 [0061.627] lstrlenA (lpString="*.kwm") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.pwm") returned 0 [0061.627] lstrlenA (lpString="*.pwm") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.1cd") returned 0 [0061.627] lstrlenA (lpString="*.1cd") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.md") returned 0 [0061.627] lstrlenA (lpString="*.md") returned 4 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mdf") returned 0 [0061.627] lstrlenA (lpString="*.mdf") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.dbf") returned 0 [0061.627] lstrlenA (lpString="*.dbf") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.odt") returned 0 [0061.627] lstrlenA (lpString="*.odt") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.vob") returned 0 [0061.627] lstrlenA (lpString="*.vob") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.ifo") returned 0 [0061.627] lstrlenA (lpString="*.ifo") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.lnk") returned 0 [0061.627] lstrlenA (lpString="*.lnk") returned 5 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.torrent") returned 0 [0061.627] lstrlenA (lpString="*.torrent") returned 9 [0061.627] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mov") returned 0 [0061.627] lstrlenA (lpString="*.mov") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.m2v") returned 0 [0061.628] lstrlenA (lpString="*.m2v") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.3gp") returned 0 [0061.628] lstrlenA (lpString="*.3gp") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mpeg") returned 0 [0061.628] lstrlenA (lpString="*.mpeg") returned 6 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mpg") returned 0 [0061.628] lstrlenA (lpString="*.mpg") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.flv") returned 0 [0061.628] lstrlenA (lpString="*.flv") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.avi") returned 0 [0061.628] lstrlenA (lpString="*.avi") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mp4") returned 0 [0061.628] lstrlenA (lpString="*.mp4") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.wmv") returned 0 [0061.628] lstrlenA (lpString="*.wmv") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.divx") returned 0 [0061.628] lstrlenA (lpString="*.divx") returned 6 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mkv") returned 0 [0061.628] lstrlenA (lpString="*.mkv") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.mp3") returned 0 [0061.628] lstrlenA (lpString="*.mp3") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.wav") returned 0 [0061.628] lstrlenA (lpString="*.wav") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.flac") returned 0 [0061.628] lstrlenA (lpString="*.flac") returned 6 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.ape") returned 0 [0061.628] lstrlenA (lpString="*.ape") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.wma") returned 0 [0061.628] lstrlenA (lpString="*.wma") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.ac3") returned 0 [0061.628] lstrlenA (lpString="*.ac3") returned 5 [0061.628] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", pszSpec="*.doc") returned 0 [0061.628] lstrlenA (lpString="*.doc") returned 5 [0061.628] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0061.628] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.628] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PartnerSetupCompleteResult.log") returned -1 [0061.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PartnerSetupCompleteResult.log") returned -1 [0061.629] lstrcmpiA (lpString1="", lpString2="PartnerSetupCompleteResult.log") returned -1 [0061.629] PathFindFileNameA (pszPath="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned="oobe_2017_09_07_03_08_57_737.log" [0061.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0061.629] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\Logs\\" | out: pszPath="C:\\$GetCurrent\\Logs\\") returned="" [0061.629] lstrcatA (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$GetCurrent\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\$GetCurrent\\Logs\\HOW TO DECRYPT FILES.txt" [0061.629] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$getcurrent\\logs\\how to decrypt files.txt")) returned 0x20 [0061.629] lstrcatA (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="PartnerSetupCompleteResult.log" | out: lpString1="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.zip") returned 0 [0061.629] lstrlenA (lpString="*.zip") returned 5 [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.rar") returned 0 [0061.629] lstrlenA (lpString="*.rar") returned 5 [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.7z") returned 0 [0061.629] lstrlenA (lpString="*.7z") returned 4 [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.tar") returned 0 [0061.629] lstrlenA (lpString="*.tar") returned 5 [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.gzip") returned 0 [0061.629] lstrlenA (lpString="*.gzip") returned 6 [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.jpg") returned 0 [0061.629] lstrlenA (lpString="*.jpg") returned 5 [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.jpeg") returned 0 [0061.629] lstrlenA (lpString="*.jpeg") returned 6 [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.psd") returned 0 [0061.629] lstrlenA (lpString="*.psd") returned 5 [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.cdr") returned 0 [0061.629] lstrlenA (lpString="*.cdr") returned 5 [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.dwg") returned 0 [0061.629] lstrlenA (lpString="*.dwg") returned 5 [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.max") returned 0 [0061.629] lstrlenA (lpString="*.max") returned 5 [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.bmp") returned 0 [0061.629] lstrlenA (lpString="*.bmp") returned 5 [0061.629] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.gif") returned 0 [0061.630] lstrlenA (lpString="*.gif") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.png") returned 0 [0061.630] lstrlenA (lpString="*.png") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.doc") returned 0 [0061.630] lstrlenA (lpString="*.doc") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.docx") returned 0 [0061.630] lstrlenA (lpString="*.docx") returned 6 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.xls") returned 0 [0061.630] lstrlenA (lpString="*.xls") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.xlsx") returned 0 [0061.630] lstrlenA (lpString="*.xlsx") returned 6 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.ppt") returned 0 [0061.630] lstrlenA (lpString="*.ppt") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.pptx") returned 0 [0061.630] lstrlenA (lpString="*.pptx") returned 6 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.txt") returned 0 [0061.630] lstrlenA (lpString="*.txt") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.pdf") returned 0 [0061.630] lstrlenA (lpString="*.pdf") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.djvu") returned 0 [0061.630] lstrlenA (lpString="*.djvu") returned 6 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.htm") returned 0 [0061.630] lstrlenA (lpString="*.htm") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.html") returned 0 [0061.630] lstrlenA (lpString="*.html") returned 6 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mdb") returned 0 [0061.630] lstrlenA (lpString="*.mdb") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.cer") returned 0 [0061.630] lstrlenA (lpString="*.cer") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.p12") returned 0 [0061.630] lstrlenA (lpString="*.p12") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.pfx") returned 0 [0061.630] lstrlenA (lpString="*.pfx") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.kwm") returned 0 [0061.630] lstrlenA (lpString="*.kwm") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.pwm") returned 0 [0061.630] lstrlenA (lpString="*.pwm") returned 5 [0061.630] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.1cd") returned 0 [0061.631] lstrlenA (lpString="*.1cd") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.md") returned 0 [0061.631] lstrlenA (lpString="*.md") returned 4 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mdf") returned 0 [0061.631] lstrlenA (lpString="*.mdf") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.dbf") returned 0 [0061.631] lstrlenA (lpString="*.dbf") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.odt") returned 0 [0061.631] lstrlenA (lpString="*.odt") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.vob") returned 0 [0061.631] lstrlenA (lpString="*.vob") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.ifo") returned 0 [0061.631] lstrlenA (lpString="*.ifo") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.lnk") returned 0 [0061.631] lstrlenA (lpString="*.lnk") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.torrent") returned 0 [0061.631] lstrlenA (lpString="*.torrent") returned 9 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mov") returned 0 [0061.631] lstrlenA (lpString="*.mov") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.m2v") returned 0 [0061.631] lstrlenA (lpString="*.m2v") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.3gp") returned 0 [0061.631] lstrlenA (lpString="*.3gp") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mpeg") returned 0 [0061.631] lstrlenA (lpString="*.mpeg") returned 6 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mpg") returned 0 [0061.631] lstrlenA (lpString="*.mpg") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.flv") returned 0 [0061.631] lstrlenA (lpString="*.flv") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.avi") returned 0 [0061.631] lstrlenA (lpString="*.avi") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mp4") returned 0 [0061.631] lstrlenA (lpString="*.mp4") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.wmv") returned 0 [0061.631] lstrlenA (lpString="*.wmv") returned 5 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.divx") returned 0 [0061.631] lstrlenA (lpString="*.divx") returned 6 [0061.631] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mkv") returned 0 [0061.632] lstrlenA (lpString="*.mkv") returned 5 [0061.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.mp3") returned 0 [0061.632] lstrlenA (lpString="*.mp3") returned 5 [0061.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.wav") returned 0 [0061.632] lstrlenA (lpString="*.wav") returned 5 [0061.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.flac") returned 0 [0061.632] lstrlenA (lpString="*.flac") returned 6 [0061.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.ape") returned 0 [0061.632] lstrlenA (lpString="*.ape") returned 5 [0061.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.wma") returned 0 [0061.632] lstrlenA (lpString="*.wma") returned 5 [0061.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.ac3") returned 0 [0061.632] lstrlenA (lpString="*.ac3") returned 5 [0061.632] PathMatchSpecA (pszFile="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", pszSpec="*.doc") returned 0 [0061.632] lstrlenA (lpString="*.doc") returned 5 [0061.632] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0061.632] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0061.632] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0061.632] lstrcmpA (lpString1=".", lpString2="SafeOS") returned -1 [0061.632] lstrcmpA (lpString1="..", lpString2="SafeOS") returned -1 [0061.632] PathFindFileNameA (pszPath="C:\\$GetCurrent\\*.*") returned="*.*" [0061.632] lstrcatA (in: lpString1="C:\\$GetCurrent\\", lpString2="SafeOS" | out: lpString1="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS" [0061.632] lstrlenA (lpString="C:\\$GetCurrent\\SafeOS") returned 21 [0061.632] FindFirstFileA (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759fd0 [0061.635] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.635] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.635] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.635] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.635] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0061.635] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.635] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GetCurrentOOBE.dll") returned -1 [0061.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GetCurrentOOBE.dll") returned 1 [0061.635] lstrcmpiA (lpString1="", lpString2="GetCurrentOOBE.dll") returned -1 [0061.635] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\*.*") returned="*.*" [0061.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0061.635] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\SafeOS\\" | out: pszPath="C:\\$GetCurrent\\SafeOS\\") returned="" [0061.635] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt") returned="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt" [0061.635] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$getcurrent\\safeos\\how to decrypt files.txt")) returned 0xffffffff [0061.635] CreateFileA (lpFileName="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$getcurrent\\safeos\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0061.636] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0061.636] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0061.637] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.637] CloseHandle (hObject=0x208) returned 1 [0061.637] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="GetCurrentOOBE.dll" | out: lpString1="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" [0061.637] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.zip") returned 0 [0061.637] lstrlenA (lpString="*.zip") returned 5 [0061.637] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.rar") returned 0 [0061.637] lstrlenA (lpString="*.rar") returned 5 [0061.637] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.7z") returned 0 [0061.637] lstrlenA (lpString="*.7z") returned 4 [0061.637] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.tar") returned 0 [0061.637] lstrlenA (lpString="*.tar") returned 5 [0061.637] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.gzip") returned 0 [0061.637] lstrlenA (lpString="*.gzip") returned 6 [0061.637] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.jpg") returned 0 [0061.637] lstrlenA (lpString="*.jpg") returned 5 [0061.637] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.jpeg") returned 0 [0061.637] lstrlenA (lpString="*.jpeg") returned 6 [0061.637] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.psd") returned 0 [0061.638] lstrlenA (lpString="*.psd") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.cdr") returned 0 [0061.638] lstrlenA (lpString="*.cdr") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.dwg") returned 0 [0061.638] lstrlenA (lpString="*.dwg") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.max") returned 0 [0061.638] lstrlenA (lpString="*.max") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.bmp") returned 0 [0061.638] lstrlenA (lpString="*.bmp") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.gif") returned 0 [0061.638] lstrlenA (lpString="*.gif") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.png") returned 0 [0061.638] lstrlenA (lpString="*.png") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.doc") returned 0 [0061.638] lstrlenA (lpString="*.doc") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.docx") returned 0 [0061.638] lstrlenA (lpString="*.docx") returned 6 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.xls") returned 0 [0061.638] lstrlenA (lpString="*.xls") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.xlsx") returned 0 [0061.638] lstrlenA (lpString="*.xlsx") returned 6 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.ppt") returned 0 [0061.638] lstrlenA (lpString="*.ppt") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.pptx") returned 0 [0061.638] lstrlenA (lpString="*.pptx") returned 6 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.txt") returned 0 [0061.638] lstrlenA (lpString="*.txt") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.pdf") returned 0 [0061.638] lstrlenA (lpString="*.pdf") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.djvu") returned 0 [0061.638] lstrlenA (lpString="*.djvu") returned 6 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.htm") returned 0 [0061.638] lstrlenA (lpString="*.htm") returned 5 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.html") returned 0 [0061.638] lstrlenA (lpString="*.html") returned 6 [0061.638] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mdb") returned 0 [0061.639] lstrlenA (lpString="*.mdb") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.cer") returned 0 [0061.639] lstrlenA (lpString="*.cer") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.p12") returned 0 [0061.639] lstrlenA (lpString="*.p12") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.pfx") returned 0 [0061.639] lstrlenA (lpString="*.pfx") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.kwm") returned 0 [0061.639] lstrlenA (lpString="*.kwm") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.pwm") returned 0 [0061.639] lstrlenA (lpString="*.pwm") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.1cd") returned 0 [0061.639] lstrlenA (lpString="*.1cd") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.md") returned 0 [0061.639] lstrlenA (lpString="*.md") returned 4 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mdf") returned 0 [0061.639] lstrlenA (lpString="*.mdf") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.dbf") returned 0 [0061.639] lstrlenA (lpString="*.dbf") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.odt") returned 0 [0061.639] lstrlenA (lpString="*.odt") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.vob") returned 0 [0061.639] lstrlenA (lpString="*.vob") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.ifo") returned 0 [0061.639] lstrlenA (lpString="*.ifo") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.lnk") returned 0 [0061.639] lstrlenA (lpString="*.lnk") returned 5 [0061.639] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.torrent") returned 0 [0061.639] lstrlenA (lpString="*.torrent") returned 9 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mov") returned 0 [0061.640] lstrlenA (lpString="*.mov") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.m2v") returned 0 [0061.640] lstrlenA (lpString="*.m2v") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.3gp") returned 0 [0061.640] lstrlenA (lpString="*.3gp") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mpeg") returned 0 [0061.640] lstrlenA (lpString="*.mpeg") returned 6 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mpg") returned 0 [0061.640] lstrlenA (lpString="*.mpg") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.flv") returned 0 [0061.640] lstrlenA (lpString="*.flv") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.avi") returned 0 [0061.640] lstrlenA (lpString="*.avi") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mp4") returned 0 [0061.640] lstrlenA (lpString="*.mp4") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.wmv") returned 0 [0061.640] lstrlenA (lpString="*.wmv") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.divx") returned 0 [0061.640] lstrlenA (lpString="*.divx") returned 6 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mkv") returned 0 [0061.640] lstrlenA (lpString="*.mkv") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.mp3") returned 0 [0061.640] lstrlenA (lpString="*.mp3") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.wav") returned 0 [0061.640] lstrlenA (lpString="*.wav") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.flac") returned 0 [0061.640] lstrlenA (lpString="*.flac") returned 6 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.ape") returned 0 [0061.640] lstrlenA (lpString="*.ape") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.wma") returned 0 [0061.640] lstrlenA (lpString="*.wma") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.ac3") returned 0 [0061.640] lstrlenA (lpString="*.ac3") returned 5 [0061.640] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", pszSpec="*.doc") returned 0 [0061.640] lstrlenA (lpString="*.doc") returned 5 [0061.640] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x1, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0061.640] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.641] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GetCurrentRollback.ini") returned -1 [0061.641] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GetCurrentRollback.ini") returned 1 [0061.641] lstrcmpiA (lpString1="", lpString2="GetCurrentRollback.ini") returned -1 [0061.641] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned="GetCurrentOOBE.dll" [0061.641] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0061.641] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\SafeOS\\" | out: pszPath="C:\\$GetCurrent\\SafeOS\\") returned="" [0061.641] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt") returned="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt" [0061.641] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$getcurrent\\safeos\\how to decrypt files.txt")) returned 0x20 [0061.641] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="GetCurrentRollback.ini" | out: lpString1="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" [0061.641] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.zip") returned 0 [0061.641] lstrlenA (lpString="*.zip") returned 5 [0061.641] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.rar") returned 0 [0061.641] lstrlenA (lpString="*.rar") returned 5 [0061.641] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.7z") returned 0 [0061.641] lstrlenA (lpString="*.7z") returned 4 [0061.641] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.tar") returned 0 [0061.641] lstrlenA (lpString="*.tar") returned 5 [0061.641] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.gzip") returned 0 [0061.641] lstrlenA (lpString="*.gzip") returned 6 [0061.641] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.jpg") returned 0 [0061.641] lstrlenA (lpString="*.jpg") returned 5 [0061.641] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.jpeg") returned 0 [0061.641] lstrlenA (lpString="*.jpeg") returned 6 [0061.641] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.psd") returned 0 [0061.641] lstrlenA (lpString="*.psd") returned 5 [0061.641] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.cdr") returned 0 [0061.641] lstrlenA (lpString="*.cdr") returned 5 [0061.641] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.dwg") returned 0 [0061.641] lstrlenA (lpString="*.dwg") returned 5 [0061.641] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.max") returned 0 [0061.641] lstrlenA (lpString="*.max") returned 5 [0061.641] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.bmp") returned 0 [0061.642] lstrlenA (lpString="*.bmp") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.gif") returned 0 [0061.642] lstrlenA (lpString="*.gif") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.png") returned 0 [0061.642] lstrlenA (lpString="*.png") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.doc") returned 0 [0061.642] lstrlenA (lpString="*.doc") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.docx") returned 0 [0061.642] lstrlenA (lpString="*.docx") returned 6 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.xls") returned 0 [0061.642] lstrlenA (lpString="*.xls") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.xlsx") returned 0 [0061.642] lstrlenA (lpString="*.xlsx") returned 6 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.ppt") returned 0 [0061.642] lstrlenA (lpString="*.ppt") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.pptx") returned 0 [0061.642] lstrlenA (lpString="*.pptx") returned 6 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.txt") returned 0 [0061.642] lstrlenA (lpString="*.txt") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.pdf") returned 0 [0061.642] lstrlenA (lpString="*.pdf") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.djvu") returned 0 [0061.642] lstrlenA (lpString="*.djvu") returned 6 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.htm") returned 0 [0061.642] lstrlenA (lpString="*.htm") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.html") returned 0 [0061.642] lstrlenA (lpString="*.html") returned 6 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mdb") returned 0 [0061.642] lstrlenA (lpString="*.mdb") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.cer") returned 0 [0061.642] lstrlenA (lpString="*.cer") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.p12") returned 0 [0061.642] lstrlenA (lpString="*.p12") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.pfx") returned 0 [0061.642] lstrlenA (lpString="*.pfx") returned 5 [0061.642] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.kwm") returned 0 [0061.642] lstrlenA (lpString="*.kwm") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.pwm") returned 0 [0061.643] lstrlenA (lpString="*.pwm") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.1cd") returned 0 [0061.643] lstrlenA (lpString="*.1cd") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.md") returned 0 [0061.643] lstrlenA (lpString="*.md") returned 4 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mdf") returned 0 [0061.643] lstrlenA (lpString="*.mdf") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.dbf") returned 0 [0061.643] lstrlenA (lpString="*.dbf") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.odt") returned 0 [0061.643] lstrlenA (lpString="*.odt") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.vob") returned 0 [0061.643] lstrlenA (lpString="*.vob") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.ifo") returned 0 [0061.643] lstrlenA (lpString="*.ifo") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.lnk") returned 0 [0061.643] lstrlenA (lpString="*.lnk") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.torrent") returned 0 [0061.643] lstrlenA (lpString="*.torrent") returned 9 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mov") returned 0 [0061.643] lstrlenA (lpString="*.mov") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.m2v") returned 0 [0061.643] lstrlenA (lpString="*.m2v") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.3gp") returned 0 [0061.643] lstrlenA (lpString="*.3gp") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mpeg") returned 0 [0061.643] lstrlenA (lpString="*.mpeg") returned 6 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mpg") returned 0 [0061.643] lstrlenA (lpString="*.mpg") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.flv") returned 0 [0061.643] lstrlenA (lpString="*.flv") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.avi") returned 0 [0061.643] lstrlenA (lpString="*.avi") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mp4") returned 0 [0061.643] lstrlenA (lpString="*.mp4") returned 5 [0061.643] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.wmv") returned 0 [0061.643] lstrlenA (lpString="*.wmv") returned 5 [0061.644] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.divx") returned 0 [0061.644] lstrlenA (lpString="*.divx") returned 6 [0061.644] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mkv") returned 0 [0061.644] lstrlenA (lpString="*.mkv") returned 5 [0061.644] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.mp3") returned 0 [0061.644] lstrlenA (lpString="*.mp3") returned 5 [0061.644] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.wav") returned 0 [0061.644] lstrlenA (lpString="*.wav") returned 5 [0061.644] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.flac") returned 0 [0061.644] lstrlenA (lpString="*.flac") returned 6 [0061.644] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.ape") returned 0 [0061.644] lstrlenA (lpString="*.ape") returned 5 [0061.644] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.wma") returned 0 [0061.644] lstrlenA (lpString="*.wma") returned 5 [0061.644] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.ac3") returned 0 [0061.644] lstrlenA (lpString="*.ac3") returned 5 [0061.644] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", pszSpec="*.doc") returned 0 [0061.644] lstrlenA (lpString="*.doc") returned 5 [0061.644] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0061.644] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.644] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PartnerSetupComplete.cmd") returned -1 [0061.644] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PartnerSetupComplete.cmd") returned -1 [0061.644] lstrcmpiA (lpString1="", lpString2="PartnerSetupComplete.cmd") returned -1 [0061.644] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned="GetCurrentRollback.ini" [0061.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0061.644] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\SafeOS\\" | out: pszPath="C:\\$GetCurrent\\SafeOS\\") returned="" [0061.644] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt") returned="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt" [0061.644] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$getcurrent\\safeos\\how to decrypt files.txt")) returned 0x20 [0061.644] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="PartnerSetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" [0061.644] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.zip") returned 0 [0061.644] lstrlenA (lpString="*.zip") returned 5 [0061.644] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.rar") returned 0 [0061.644] lstrlenA (lpString="*.rar") returned 5 [0061.644] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.7z") returned 0 [0061.645] lstrlenA (lpString="*.7z") returned 4 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.tar") returned 0 [0061.645] lstrlenA (lpString="*.tar") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.gzip") returned 0 [0061.645] lstrlenA (lpString="*.gzip") returned 6 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.jpg") returned 0 [0061.645] lstrlenA (lpString="*.jpg") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.jpeg") returned 0 [0061.645] lstrlenA (lpString="*.jpeg") returned 6 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.psd") returned 0 [0061.645] lstrlenA (lpString="*.psd") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.cdr") returned 0 [0061.645] lstrlenA (lpString="*.cdr") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.dwg") returned 0 [0061.645] lstrlenA (lpString="*.dwg") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.max") returned 0 [0061.645] lstrlenA (lpString="*.max") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.bmp") returned 0 [0061.645] lstrlenA (lpString="*.bmp") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.gif") returned 0 [0061.645] lstrlenA (lpString="*.gif") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.png") returned 0 [0061.645] lstrlenA (lpString="*.png") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.doc") returned 0 [0061.645] lstrlenA (lpString="*.doc") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.docx") returned 0 [0061.645] lstrlenA (lpString="*.docx") returned 6 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.xls") returned 0 [0061.645] lstrlenA (lpString="*.xls") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.xlsx") returned 0 [0061.645] lstrlenA (lpString="*.xlsx") returned 6 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.ppt") returned 0 [0061.645] lstrlenA (lpString="*.ppt") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.pptx") returned 0 [0061.645] lstrlenA (lpString="*.pptx") returned 6 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.txt") returned 0 [0061.645] lstrlenA (lpString="*.txt") returned 5 [0061.645] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.pdf") returned 0 [0061.646] lstrlenA (lpString="*.pdf") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.djvu") returned 0 [0061.646] lstrlenA (lpString="*.djvu") returned 6 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.htm") returned 0 [0061.646] lstrlenA (lpString="*.htm") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.html") returned 0 [0061.646] lstrlenA (lpString="*.html") returned 6 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mdb") returned 0 [0061.646] lstrlenA (lpString="*.mdb") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.cer") returned 0 [0061.646] lstrlenA (lpString="*.cer") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.p12") returned 0 [0061.646] lstrlenA (lpString="*.p12") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.pfx") returned 0 [0061.646] lstrlenA (lpString="*.pfx") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.kwm") returned 0 [0061.646] lstrlenA (lpString="*.kwm") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.pwm") returned 0 [0061.646] lstrlenA (lpString="*.pwm") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.1cd") returned 0 [0061.646] lstrlenA (lpString="*.1cd") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.md") returned 0 [0061.646] lstrlenA (lpString="*.md") returned 4 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mdf") returned 0 [0061.646] lstrlenA (lpString="*.mdf") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.dbf") returned 0 [0061.646] lstrlenA (lpString="*.dbf") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.odt") returned 0 [0061.646] lstrlenA (lpString="*.odt") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.vob") returned 0 [0061.646] lstrlenA (lpString="*.vob") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.ifo") returned 0 [0061.646] lstrlenA (lpString="*.ifo") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.lnk") returned 0 [0061.646] lstrlenA (lpString="*.lnk") returned 5 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.torrent") returned 0 [0061.646] lstrlenA (lpString="*.torrent") returned 9 [0061.646] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mov") returned 0 [0061.647] lstrlenA (lpString="*.mov") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.m2v") returned 0 [0061.647] lstrlenA (lpString="*.m2v") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.3gp") returned 0 [0061.647] lstrlenA (lpString="*.3gp") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mpeg") returned 0 [0061.647] lstrlenA (lpString="*.mpeg") returned 6 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mpg") returned 0 [0061.647] lstrlenA (lpString="*.mpg") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.flv") returned 0 [0061.647] lstrlenA (lpString="*.flv") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.avi") returned 0 [0061.647] lstrlenA (lpString="*.avi") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mp4") returned 0 [0061.647] lstrlenA (lpString="*.mp4") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.wmv") returned 0 [0061.647] lstrlenA (lpString="*.wmv") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.divx") returned 0 [0061.647] lstrlenA (lpString="*.divx") returned 6 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mkv") returned 0 [0061.647] lstrlenA (lpString="*.mkv") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.mp3") returned 0 [0061.647] lstrlenA (lpString="*.mp3") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.wav") returned 0 [0061.647] lstrlenA (lpString="*.wav") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.flac") returned 0 [0061.647] lstrlenA (lpString="*.flac") returned 6 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.ape") returned 0 [0061.647] lstrlenA (lpString="*.ape") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.wma") returned 0 [0061.647] lstrlenA (lpString="*.wma") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.ac3") returned 0 [0061.647] lstrlenA (lpString="*.ac3") returned 5 [0061.647] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", pszSpec="*.doc") returned 0 [0061.647] lstrlenA (lpString="*.doc") returned 5 [0061.647] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0061.647] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.647] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="preoobe.cmd") returned -1 [0061.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="preoobe.cmd") returned -1 [0061.648] lstrcmpiA (lpString1="", lpString2="preoobe.cmd") returned -1 [0061.648] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned="PartnerSetupComplete.cmd" [0061.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0061.648] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\SafeOS\\" | out: pszPath="C:\\$GetCurrent\\SafeOS\\") returned="" [0061.648] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt") returned="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt" [0061.648] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$getcurrent\\safeos\\how to decrypt files.txt")) returned 0x20 [0061.648] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="preoobe.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.zip") returned 0 [0061.648] lstrlenA (lpString="*.zip") returned 5 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.rar") returned 0 [0061.648] lstrlenA (lpString="*.rar") returned 5 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.7z") returned 0 [0061.648] lstrlenA (lpString="*.7z") returned 4 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.tar") returned 0 [0061.648] lstrlenA (lpString="*.tar") returned 5 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.gzip") returned 0 [0061.648] lstrlenA (lpString="*.gzip") returned 6 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.jpg") returned 0 [0061.648] lstrlenA (lpString="*.jpg") returned 5 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.jpeg") returned 0 [0061.648] lstrlenA (lpString="*.jpeg") returned 6 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.psd") returned 0 [0061.648] lstrlenA (lpString="*.psd") returned 5 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.cdr") returned 0 [0061.648] lstrlenA (lpString="*.cdr") returned 5 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.dwg") returned 0 [0061.648] lstrlenA (lpString="*.dwg") returned 5 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.max") returned 0 [0061.648] lstrlenA (lpString="*.max") returned 5 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.bmp") returned 0 [0061.648] lstrlenA (lpString="*.bmp") returned 5 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.gif") returned 0 [0061.648] lstrlenA (lpString="*.gif") returned 5 [0061.648] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.png") returned 0 [0061.649] lstrlenA (lpString="*.png") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.doc") returned 0 [0061.649] lstrlenA (lpString="*.doc") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.docx") returned 0 [0061.649] lstrlenA (lpString="*.docx") returned 6 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.xls") returned 0 [0061.649] lstrlenA (lpString="*.xls") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.xlsx") returned 0 [0061.649] lstrlenA (lpString="*.xlsx") returned 6 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.ppt") returned 0 [0061.649] lstrlenA (lpString="*.ppt") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.pptx") returned 0 [0061.649] lstrlenA (lpString="*.pptx") returned 6 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.txt") returned 0 [0061.649] lstrlenA (lpString="*.txt") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.pdf") returned 0 [0061.649] lstrlenA (lpString="*.pdf") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.djvu") returned 0 [0061.649] lstrlenA (lpString="*.djvu") returned 6 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.htm") returned 0 [0061.649] lstrlenA (lpString="*.htm") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.html") returned 0 [0061.649] lstrlenA (lpString="*.html") returned 6 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mdb") returned 0 [0061.649] lstrlenA (lpString="*.mdb") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.cer") returned 0 [0061.649] lstrlenA (lpString="*.cer") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.p12") returned 0 [0061.649] lstrlenA (lpString="*.p12") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.pfx") returned 0 [0061.649] lstrlenA (lpString="*.pfx") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.kwm") returned 0 [0061.649] lstrlenA (lpString="*.kwm") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.pwm") returned 0 [0061.649] lstrlenA (lpString="*.pwm") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.1cd") returned 0 [0061.649] lstrlenA (lpString="*.1cd") returned 5 [0061.649] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.md") returned 0 [0061.650] lstrlenA (lpString="*.md") returned 4 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mdf") returned 0 [0061.650] lstrlenA (lpString="*.mdf") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.dbf") returned 0 [0061.650] lstrlenA (lpString="*.dbf") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.odt") returned 0 [0061.650] lstrlenA (lpString="*.odt") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.vob") returned 0 [0061.650] lstrlenA (lpString="*.vob") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.ifo") returned 0 [0061.650] lstrlenA (lpString="*.ifo") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.lnk") returned 0 [0061.650] lstrlenA (lpString="*.lnk") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.torrent") returned 0 [0061.650] lstrlenA (lpString="*.torrent") returned 9 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mov") returned 0 [0061.650] lstrlenA (lpString="*.mov") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.m2v") returned 0 [0061.650] lstrlenA (lpString="*.m2v") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.3gp") returned 0 [0061.650] lstrlenA (lpString="*.3gp") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mpeg") returned 0 [0061.650] lstrlenA (lpString="*.mpeg") returned 6 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mpg") returned 0 [0061.650] lstrlenA (lpString="*.mpg") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.flv") returned 0 [0061.650] lstrlenA (lpString="*.flv") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.avi") returned 0 [0061.650] lstrlenA (lpString="*.avi") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mp4") returned 0 [0061.650] lstrlenA (lpString="*.mp4") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.wmv") returned 0 [0061.650] lstrlenA (lpString="*.wmv") returned 5 [0061.650] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.divx") returned 0 [0061.650] lstrlenA (lpString="*.divx") returned 6 [0061.651] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mkv") returned 0 [0061.651] lstrlenA (lpString="*.mkv") returned 5 [0061.651] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.mp3") returned 0 [0061.651] lstrlenA (lpString="*.mp3") returned 5 [0061.651] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.wav") returned 0 [0061.651] lstrlenA (lpString="*.wav") returned 5 [0061.651] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.flac") returned 0 [0061.651] lstrlenA (lpString="*.flac") returned 6 [0061.651] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.ape") returned 0 [0061.651] lstrlenA (lpString="*.ape") returned 5 [0061.651] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.wma") returned 0 [0061.651] lstrlenA (lpString="*.wma") returned 5 [0061.651] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.ac3") returned 0 [0061.651] lstrlenA (lpString="*.ac3") returned 5 [0061.651] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", pszSpec="*.doc") returned 0 [0061.651] lstrlenA (lpString="*.doc") returned 5 [0061.651] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0061.651] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.651] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupComplete.cmd") returned -1 [0061.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupComplete.cmd") returned -1 [0061.651] lstrcmpiA (lpString1="", lpString2="SetupComplete.cmd") returned -1 [0061.651] PathFindFileNameA (pszPath="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned="preoobe.cmd" [0061.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0061.651] PathAddBackslashA (in: pszPath="C:\\$GetCurrent\\SafeOS\\" | out: pszPath="C:\\$GetCurrent\\SafeOS\\") returned="" [0061.651] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt") returned="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt" [0061.651] GetFileAttributesA (lpFileName="C:\\$GetCurrent\\SafeOS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$getcurrent\\safeos\\how to decrypt files.txt")) returned 0x20 [0061.651] lstrcatA (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="SetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" [0061.651] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.zip") returned 0 [0061.651] lstrlenA (lpString="*.zip") returned 5 [0061.651] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.rar") returned 0 [0061.651] lstrlenA (lpString="*.rar") returned 5 [0061.651] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.7z") returned 0 [0061.651] lstrlenA (lpString="*.7z") returned 4 [0061.651] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.tar") returned 0 [0061.651] lstrlenA (lpString="*.tar") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.gzip") returned 0 [0061.652] lstrlenA (lpString="*.gzip") returned 6 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.jpg") returned 0 [0061.652] lstrlenA (lpString="*.jpg") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.jpeg") returned 0 [0061.652] lstrlenA (lpString="*.jpeg") returned 6 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.psd") returned 0 [0061.652] lstrlenA (lpString="*.psd") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.cdr") returned 0 [0061.652] lstrlenA (lpString="*.cdr") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.dwg") returned 0 [0061.652] lstrlenA (lpString="*.dwg") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.max") returned 0 [0061.652] lstrlenA (lpString="*.max") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.bmp") returned 0 [0061.652] lstrlenA (lpString="*.bmp") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.gif") returned 0 [0061.652] lstrlenA (lpString="*.gif") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.png") returned 0 [0061.652] lstrlenA (lpString="*.png") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.doc") returned 0 [0061.652] lstrlenA (lpString="*.doc") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.docx") returned 0 [0061.652] lstrlenA (lpString="*.docx") returned 6 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.xls") returned 0 [0061.652] lstrlenA (lpString="*.xls") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.xlsx") returned 0 [0061.652] lstrlenA (lpString="*.xlsx") returned 6 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.ppt") returned 0 [0061.652] lstrlenA (lpString="*.ppt") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.pptx") returned 0 [0061.652] lstrlenA (lpString="*.pptx") returned 6 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.txt") returned 0 [0061.652] lstrlenA (lpString="*.txt") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.pdf") returned 0 [0061.652] lstrlenA (lpString="*.pdf") returned 5 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.djvu") returned 0 [0061.652] lstrlenA (lpString="*.djvu") returned 6 [0061.652] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.htm") returned 0 [0061.653] lstrlenA (lpString="*.htm") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.html") returned 0 [0061.653] lstrlenA (lpString="*.html") returned 6 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mdb") returned 0 [0061.653] lstrlenA (lpString="*.mdb") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.cer") returned 0 [0061.653] lstrlenA (lpString="*.cer") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.p12") returned 0 [0061.653] lstrlenA (lpString="*.p12") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.pfx") returned 0 [0061.653] lstrlenA (lpString="*.pfx") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.kwm") returned 0 [0061.653] lstrlenA (lpString="*.kwm") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.pwm") returned 0 [0061.653] lstrlenA (lpString="*.pwm") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.1cd") returned 0 [0061.653] lstrlenA (lpString="*.1cd") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.md") returned 0 [0061.653] lstrlenA (lpString="*.md") returned 4 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mdf") returned 0 [0061.653] lstrlenA (lpString="*.mdf") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.dbf") returned 0 [0061.653] lstrlenA (lpString="*.dbf") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.odt") returned 0 [0061.653] lstrlenA (lpString="*.odt") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.vob") returned 0 [0061.653] lstrlenA (lpString="*.vob") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.ifo") returned 0 [0061.653] lstrlenA (lpString="*.ifo") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.lnk") returned 0 [0061.653] lstrlenA (lpString="*.lnk") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.torrent") returned 0 [0061.653] lstrlenA (lpString="*.torrent") returned 9 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mov") returned 0 [0061.653] lstrlenA (lpString="*.mov") returned 5 [0061.653] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.m2v") returned 0 [0061.653] lstrlenA (lpString="*.m2v") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.3gp") returned 0 [0061.654] lstrlenA (lpString="*.3gp") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mpeg") returned 0 [0061.654] lstrlenA (lpString="*.mpeg") returned 6 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mpg") returned 0 [0061.654] lstrlenA (lpString="*.mpg") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.flv") returned 0 [0061.654] lstrlenA (lpString="*.flv") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.avi") returned 0 [0061.654] lstrlenA (lpString="*.avi") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mp4") returned 0 [0061.654] lstrlenA (lpString="*.mp4") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.wmv") returned 0 [0061.654] lstrlenA (lpString="*.wmv") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.divx") returned 0 [0061.654] lstrlenA (lpString="*.divx") returned 6 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mkv") returned 0 [0061.654] lstrlenA (lpString="*.mkv") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.mp3") returned 0 [0061.654] lstrlenA (lpString="*.mp3") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.wav") returned 0 [0061.654] lstrlenA (lpString="*.wav") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.flac") returned 0 [0061.654] lstrlenA (lpString="*.flac") returned 6 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.ape") returned 0 [0061.654] lstrlenA (lpString="*.ape") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.wma") returned 0 [0061.654] lstrlenA (lpString="*.wma") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.ac3") returned 0 [0061.654] lstrlenA (lpString="*.ac3") returned 5 [0061.654] PathMatchSpecA (pszFile="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", pszSpec="*.doc") returned 0 [0061.654] lstrlenA (lpString="*.doc") returned 5 [0061.654] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0061.654] FindClose (in: hFindFile=0x759fd0 | out: hFindFile=0x759fd0) returned 1 [0061.655] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0061.655] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0061.655] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x742dd8, dwReserved1=0x19ff60, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0061.655] lstrcmpA (lpString1=".", lpString2="$Recycle.Bin") returned 1 [0061.655] lstrcmpA (lpString1="..", lpString2="$Recycle.Bin") returned 1 [0061.655] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0061.655] lstrcatA (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0061.673] lstrlenA (lpString="C:\\$Recycle.Bin") returned 15 [0061.673] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x75e218, cFileName=".", cAlternateFileName="")) returned 0x759ed0 [0061.673] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.673] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x75e218, cFileName="..", cAlternateFileName="")) returned 1 [0061.673] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.673] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.673] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x75e218, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0061.673] lstrcmpA (lpString1=".", lpString2="S-1-5-18") returned -1 [0061.673] lstrcmpA (lpString1="..", lpString2="S-1-5-18") returned -1 [0061.673] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\*.*") returned="*.*" [0061.673] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-18" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18") returned="C:\\$Recycle.Bin\\S-1-5-18" [0061.673] lstrlenA (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0061.673] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x760e78, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0061.674] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.674] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x760e78, cFileName="..", cAlternateFileName="")) returned 1 [0061.674] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.674] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.674] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xfffffffe, dwReserved1=0x760e78, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.674] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.674] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0061.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0061.674] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0061.674] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\S-1-5-18\\*.*") returned="*.*" [0061.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$Recycle.Bin\\S-1-5-18\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\") returned="C:\\$Recycle.Bin\\S-1-5-18\\" [0061.674] PathAddBackslashA (in: pszPath="C:\\$Recycle.Bin\\S-1-5-18\\" | out: pszPath="C:\\$Recycle.Bin\\S-1-5-18\\") returned="" [0061.674] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\HOW TO DECRYPT FILES.txt") returned="C:\\$Recycle.Bin\\S-1-5-18\\HOW TO DECRYPT FILES.txt" [0061.674] GetFileAttributesA (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-18\\how to decrypt files.txt")) returned 0xffffffff [0061.674] CreateFileA (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-18\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0061.683] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0061.683] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0061.684] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.684] CloseHandle (hObject=0x208) returned 1 [0061.685] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.zip") returned 0 [0061.685] lstrlenA (lpString="*.zip") returned 5 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.rar") returned 0 [0061.685] lstrlenA (lpString="*.rar") returned 5 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.7z") returned 0 [0061.685] lstrlenA (lpString="*.7z") returned 4 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.tar") returned 0 [0061.685] lstrlenA (lpString="*.tar") returned 5 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.gzip") returned 0 [0061.685] lstrlenA (lpString="*.gzip") returned 6 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.jpg") returned 0 [0061.685] lstrlenA (lpString="*.jpg") returned 5 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.jpeg") returned 0 [0061.685] lstrlenA (lpString="*.jpeg") returned 6 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.psd") returned 0 [0061.685] lstrlenA (lpString="*.psd") returned 5 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.cdr") returned 0 [0061.685] lstrlenA (lpString="*.cdr") returned 5 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.dwg") returned 0 [0061.685] lstrlenA (lpString="*.dwg") returned 5 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.max") returned 0 [0061.685] lstrlenA (lpString="*.max") returned 5 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.bmp") returned 0 [0061.685] lstrlenA (lpString="*.bmp") returned 5 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.gif") returned 0 [0061.685] lstrlenA (lpString="*.gif") returned 5 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.png") returned 0 [0061.685] lstrlenA (lpString="*.png") returned 5 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.doc") returned 0 [0061.685] lstrlenA (lpString="*.doc") returned 5 [0061.685] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.docx") returned 0 [0061.686] lstrlenA (lpString="*.docx") returned 6 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.xls") returned 0 [0061.686] lstrlenA (lpString="*.xls") returned 5 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.xlsx") returned 0 [0061.686] lstrlenA (lpString="*.xlsx") returned 6 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.ppt") returned 0 [0061.686] lstrlenA (lpString="*.ppt") returned 5 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.pptx") returned 0 [0061.686] lstrlenA (lpString="*.pptx") returned 6 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.txt") returned 0 [0061.686] lstrlenA (lpString="*.txt") returned 5 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.pdf") returned 0 [0061.686] lstrlenA (lpString="*.pdf") returned 5 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.djvu") returned 0 [0061.686] lstrlenA (lpString="*.djvu") returned 6 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.htm") returned 0 [0061.686] lstrlenA (lpString="*.htm") returned 5 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.html") returned 0 [0061.686] lstrlenA (lpString="*.html") returned 6 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mdb") returned 0 [0061.686] lstrlenA (lpString="*.mdb") returned 5 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.cer") returned 0 [0061.686] lstrlenA (lpString="*.cer") returned 5 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.p12") returned 0 [0061.686] lstrlenA (lpString="*.p12") returned 5 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.pfx") returned 0 [0061.686] lstrlenA (lpString="*.pfx") returned 5 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.kwm") returned 0 [0061.686] lstrlenA (lpString="*.kwm") returned 5 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.pwm") returned 0 [0061.686] lstrlenA (lpString="*.pwm") returned 5 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.1cd") returned 0 [0061.686] lstrlenA (lpString="*.1cd") returned 5 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.md") returned 0 [0061.686] lstrlenA (lpString="*.md") returned 4 [0061.686] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mdf") returned 0 [0061.687] lstrlenA (lpString="*.mdf") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.dbf") returned 0 [0061.687] lstrlenA (lpString="*.dbf") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.odt") returned 0 [0061.687] lstrlenA (lpString="*.odt") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.vob") returned 0 [0061.687] lstrlenA (lpString="*.vob") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.ifo") returned 0 [0061.687] lstrlenA (lpString="*.ifo") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.lnk") returned 0 [0061.687] lstrlenA (lpString="*.lnk") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.torrent") returned 0 [0061.687] lstrlenA (lpString="*.torrent") returned 9 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mov") returned 0 [0061.687] lstrlenA (lpString="*.mov") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.m2v") returned 0 [0061.687] lstrlenA (lpString="*.m2v") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.3gp") returned 0 [0061.687] lstrlenA (lpString="*.3gp") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mpeg") returned 0 [0061.687] lstrlenA (lpString="*.mpeg") returned 6 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mpg") returned 0 [0061.687] lstrlenA (lpString="*.mpg") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.flv") returned 0 [0061.687] lstrlenA (lpString="*.flv") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.avi") returned 0 [0061.687] lstrlenA (lpString="*.avi") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mp4") returned 0 [0061.687] lstrlenA (lpString="*.mp4") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.wmv") returned 0 [0061.687] lstrlenA (lpString="*.wmv") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.divx") returned 0 [0061.687] lstrlenA (lpString="*.divx") returned 6 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mkv") returned 0 [0061.687] lstrlenA (lpString="*.mkv") returned 5 [0061.687] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.mp3") returned 0 [0061.687] lstrlenA (lpString="*.mp3") returned 5 [0061.688] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.wav") returned 0 [0061.688] lstrlenA (lpString="*.wav") returned 5 [0061.688] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.flac") returned 0 [0061.688] lstrlenA (lpString="*.flac") returned 6 [0061.688] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.ape") returned 0 [0061.688] lstrlenA (lpString="*.ape") returned 5 [0061.688] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.wma") returned 0 [0061.688] lstrlenA (lpString="*.wma") returned 5 [0061.688] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.ac3") returned 0 [0061.688] lstrlenA (lpString="*.ac3") returned 5 [0061.688] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", pszSpec="*.doc") returned 0 [0061.688] lstrlenA (lpString="*.doc") returned 5 [0061.688] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xfffffffe, dwReserved1=0x760e78, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0061.688] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0061.688] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0061.688] lstrcmpA (lpString1=".", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000") returned -1 [0061.688] lstrcmpA (lpString1="..", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000") returned -1 [0061.688] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\*.*") returned="*.*" [0061.688] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000" [0061.688] lstrlenA (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61 [0061.688] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0061.689] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.689] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0061.689] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.689] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.689] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.689] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.689] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0061.689] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0061.689] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0061.689] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*.*") returned="*.*" [0061.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\" [0061.689] PathAddBackslashA (in: pszPath="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\" | out: pszPath="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\") returned="" [0061.689] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\HOW TO DECRYPT FILES.txt" [0061.689] GetFileAttributesA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\how to decrypt files.txt")) returned 0xffffffff [0061.689] CreateFileA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0061.691] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0061.691] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0061.692] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.692] CloseHandle (hObject=0x208) returned 1 [0061.692] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" [0061.692] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.zip") returned 0 [0061.692] lstrlenA (lpString="*.zip") returned 5 [0061.692] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.rar") returned 0 [0061.692] lstrlenA (lpString="*.rar") returned 5 [0061.692] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.7z") returned 0 [0061.692] lstrlenA (lpString="*.7z") returned 4 [0061.692] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.tar") returned 0 [0061.692] lstrlenA (lpString="*.tar") returned 5 [0061.692] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.gzip") returned 0 [0061.692] lstrlenA (lpString="*.gzip") returned 6 [0061.692] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.jpg") returned 0 [0061.692] lstrlenA (lpString="*.jpg") returned 5 [0061.692] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.jpeg") returned 0 [0061.692] lstrlenA (lpString="*.jpeg") returned 6 [0061.692] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.psd") returned 0 [0061.692] lstrlenA (lpString="*.psd") returned 5 [0061.692] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.cdr") returned 0 [0061.692] lstrlenA (lpString="*.cdr") returned 5 [0061.692] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.dwg") returned 0 [0061.692] lstrlenA (lpString="*.dwg") returned 5 [0061.692] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.max") returned 0 [0061.692] lstrlenA (lpString="*.max") returned 5 [0061.692] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.bmp") returned 0 [0061.692] lstrlenA (lpString="*.bmp") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.gif") returned 0 [0061.693] lstrlenA (lpString="*.gif") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.png") returned 0 [0061.693] lstrlenA (lpString="*.png") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.doc") returned 0 [0061.693] lstrlenA (lpString="*.doc") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.docx") returned 0 [0061.693] lstrlenA (lpString="*.docx") returned 6 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.xls") returned 0 [0061.693] lstrlenA (lpString="*.xls") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.xlsx") returned 0 [0061.693] lstrlenA (lpString="*.xlsx") returned 6 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.ppt") returned 0 [0061.693] lstrlenA (lpString="*.ppt") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.pptx") returned 0 [0061.693] lstrlenA (lpString="*.pptx") returned 6 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.txt") returned 0 [0061.693] lstrlenA (lpString="*.txt") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.pdf") returned 0 [0061.693] lstrlenA (lpString="*.pdf") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.djvu") returned 0 [0061.693] lstrlenA (lpString="*.djvu") returned 6 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.htm") returned 0 [0061.693] lstrlenA (lpString="*.htm") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.html") returned 0 [0061.693] lstrlenA (lpString="*.html") returned 6 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mdb") returned 0 [0061.693] lstrlenA (lpString="*.mdb") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.cer") returned 0 [0061.693] lstrlenA (lpString="*.cer") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.p12") returned 0 [0061.693] lstrlenA (lpString="*.p12") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.pfx") returned 0 [0061.693] lstrlenA (lpString="*.pfx") returned 5 [0061.693] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.kwm") returned 0 [0061.694] lstrlenA (lpString="*.kwm") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.pwm") returned 0 [0061.694] lstrlenA (lpString="*.pwm") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.1cd") returned 0 [0061.694] lstrlenA (lpString="*.1cd") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.md") returned 0 [0061.694] lstrlenA (lpString="*.md") returned 4 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mdf") returned 0 [0061.694] lstrlenA (lpString="*.mdf") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.dbf") returned 0 [0061.694] lstrlenA (lpString="*.dbf") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.odt") returned 0 [0061.694] lstrlenA (lpString="*.odt") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.vob") returned 0 [0061.694] lstrlenA (lpString="*.vob") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.ifo") returned 0 [0061.694] lstrlenA (lpString="*.ifo") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.lnk") returned 0 [0061.694] lstrlenA (lpString="*.lnk") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.torrent") returned 0 [0061.694] lstrlenA (lpString="*.torrent") returned 9 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mov") returned 0 [0061.694] lstrlenA (lpString="*.mov") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.m2v") returned 0 [0061.694] lstrlenA (lpString="*.m2v") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.3gp") returned 0 [0061.694] lstrlenA (lpString="*.3gp") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mpeg") returned 0 [0061.694] lstrlenA (lpString="*.mpeg") returned 6 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mpg") returned 0 [0061.694] lstrlenA (lpString="*.mpg") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.flv") returned 0 [0061.694] lstrlenA (lpString="*.flv") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.avi") returned 0 [0061.694] lstrlenA (lpString="*.avi") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mp4") returned 0 [0061.694] lstrlenA (lpString="*.mp4") returned 5 [0061.694] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.wmv") returned 0 [0061.695] lstrlenA (lpString="*.wmv") returned 5 [0061.695] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.divx") returned 0 [0061.695] lstrlenA (lpString="*.divx") returned 6 [0061.695] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mkv") returned 0 [0061.695] lstrlenA (lpString="*.mkv") returned 5 [0061.695] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.mp3") returned 0 [0061.695] lstrlenA (lpString="*.mp3") returned 5 [0061.695] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.wav") returned 0 [0061.695] lstrlenA (lpString="*.wav") returned 5 [0061.695] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.flac") returned 0 [0061.695] lstrlenA (lpString="*.flac") returned 6 [0061.695] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.ape") returned 0 [0061.695] lstrlenA (lpString="*.ape") returned 5 [0061.695] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.wma") returned 0 [0061.695] lstrlenA (lpString="*.wma") returned 5 [0061.695] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.ac3") returned 0 [0061.695] lstrlenA (lpString="*.ac3") returned 5 [0061.695] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", pszSpec="*.doc") returned 0 [0061.695] lstrlenA (lpString="*.doc") returned 5 [0061.695] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x1, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0061.695] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0061.695] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0061.695] FindClose (in: hFindFile=0x759ed0 | out: hFindFile=0x759ed0) returned 1 [0061.695] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0061.695] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0 [0061.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="$WINRE_BACKUP_PARTITION.MARKER") returned 1 [0061.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="$WINRE_BACKUP_PARTITION.MARKER") returned 1 [0061.695] lstrcmpiA (lpString1="", lpString2="$WINRE_BACKUP_PARTITION.MARKER") returned -1 [0061.695] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0061.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0061.696] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0061.696] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0061.696] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0xffffffff [0061.696] CreateFileA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0061.697] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0061.697] WriteFile (in: hFile=0x1d8, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0061.698] SetFileTime (hFile=0x1d8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.698] CloseHandle (hObject=0x1d8) returned 1 [0061.698] lstrcatA (in: lpString1="C:\\", lpString2="$WINRE_BACKUP_PARTITION.MARKER" | out: lpString1="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned="C:\\$WINRE_BACKUP_PARTITION.MARKER" [0061.698] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.zip") returned 0 [0061.698] lstrlenA (lpString="*.zip") returned 5 [0061.698] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.rar") returned 0 [0061.698] lstrlenA (lpString="*.rar") returned 5 [0061.698] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.7z") returned 0 [0061.698] lstrlenA (lpString="*.7z") returned 4 [0061.698] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.tar") returned 0 [0061.699] lstrlenA (lpString="*.tar") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.gzip") returned 0 [0061.699] lstrlenA (lpString="*.gzip") returned 6 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.jpg") returned 0 [0061.699] lstrlenA (lpString="*.jpg") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.jpeg") returned 0 [0061.699] lstrlenA (lpString="*.jpeg") returned 6 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.psd") returned 0 [0061.699] lstrlenA (lpString="*.psd") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.cdr") returned 0 [0061.699] lstrlenA (lpString="*.cdr") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.dwg") returned 0 [0061.699] lstrlenA (lpString="*.dwg") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.max") returned 0 [0061.699] lstrlenA (lpString="*.max") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.bmp") returned 0 [0061.699] lstrlenA (lpString="*.bmp") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.gif") returned 0 [0061.699] lstrlenA (lpString="*.gif") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.png") returned 0 [0061.699] lstrlenA (lpString="*.png") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.doc") returned 0 [0061.699] lstrlenA (lpString="*.doc") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.docx") returned 0 [0061.699] lstrlenA (lpString="*.docx") returned 6 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.xls") returned 0 [0061.699] lstrlenA (lpString="*.xls") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.xlsx") returned 0 [0061.699] lstrlenA (lpString="*.xlsx") returned 6 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.ppt") returned 0 [0061.699] lstrlenA (lpString="*.ppt") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.pptx") returned 0 [0061.699] lstrlenA (lpString="*.pptx") returned 6 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.txt") returned 0 [0061.699] lstrlenA (lpString="*.txt") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.pdf") returned 0 [0061.699] lstrlenA (lpString="*.pdf") returned 5 [0061.699] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.djvu") returned 0 [0061.700] lstrlenA (lpString="*.djvu") returned 6 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.htm") returned 0 [0061.700] lstrlenA (lpString="*.htm") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.html") returned 0 [0061.700] lstrlenA (lpString="*.html") returned 6 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mdb") returned 0 [0061.700] lstrlenA (lpString="*.mdb") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.cer") returned 0 [0061.700] lstrlenA (lpString="*.cer") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.p12") returned 0 [0061.700] lstrlenA (lpString="*.p12") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.pfx") returned 0 [0061.700] lstrlenA (lpString="*.pfx") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.kwm") returned 0 [0061.700] lstrlenA (lpString="*.kwm") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.pwm") returned 0 [0061.700] lstrlenA (lpString="*.pwm") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.1cd") returned 0 [0061.700] lstrlenA (lpString="*.1cd") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.md") returned 0 [0061.700] lstrlenA (lpString="*.md") returned 4 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mdf") returned 0 [0061.700] lstrlenA (lpString="*.mdf") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.dbf") returned 0 [0061.700] lstrlenA (lpString="*.dbf") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.odt") returned 0 [0061.700] lstrlenA (lpString="*.odt") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.vob") returned 0 [0061.700] lstrlenA (lpString="*.vob") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.ifo") returned 0 [0061.700] lstrlenA (lpString="*.ifo") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.lnk") returned 0 [0061.700] lstrlenA (lpString="*.lnk") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.torrent") returned 0 [0061.700] lstrlenA (lpString="*.torrent") returned 9 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mov") returned 0 [0061.700] lstrlenA (lpString="*.mov") returned 5 [0061.700] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.m2v") returned 0 [0061.701] lstrlenA (lpString="*.m2v") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.3gp") returned 0 [0061.701] lstrlenA (lpString="*.3gp") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mpeg") returned 0 [0061.701] lstrlenA (lpString="*.mpeg") returned 6 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mpg") returned 0 [0061.701] lstrlenA (lpString="*.mpg") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.flv") returned 0 [0061.701] lstrlenA (lpString="*.flv") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.avi") returned 0 [0061.701] lstrlenA (lpString="*.avi") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mp4") returned 0 [0061.701] lstrlenA (lpString="*.mp4") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.wmv") returned 0 [0061.701] lstrlenA (lpString="*.wmv") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.divx") returned 0 [0061.701] lstrlenA (lpString="*.divx") returned 6 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mkv") returned 0 [0061.701] lstrlenA (lpString="*.mkv") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.mp3") returned 0 [0061.701] lstrlenA (lpString="*.mp3") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.wav") returned 0 [0061.701] lstrlenA (lpString="*.wav") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.flac") returned 0 [0061.701] lstrlenA (lpString="*.flac") returned 6 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.ape") returned 0 [0061.701] lstrlenA (lpString="*.ape") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.wma") returned 0 [0061.701] lstrlenA (lpString="*.wma") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.ac3") returned 0 [0061.701] lstrlenA (lpString="*.ac3") returned 5 [0061.701] PathMatchSpecA (pszFile="C:\\$WINRE_BACKUP_PARTITION.MARKER", pszSpec="*.doc") returned 0 [0061.701] lstrlenA (lpString="*.doc") returned 5 [0061.701] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0061.701] lstrcmpA (lpString1=".", lpString2="588bce7c90097ed212") returned -1 [0061.701] lstrcmpA (lpString1="..", lpString2="588bce7c90097ed212") returned -1 [0061.701] PathFindFileNameA (pszPath="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned="$WINRE_BACKUP_PARTITION.MARKER" [0061.702] lstrcatA (in: lpString1="C:\\", lpString2="588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0061.702] lstrlenA (lpString="C:\\588bce7c90097ed212") returned 21 [0061.702] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x753650, dwReserved1=0x48, cFileName=".", cAlternateFileName="")) returned 0x759ed0 [0061.870] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.871] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x753650, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 1 [0061.873] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.873] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.873] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x753650, dwReserved1=0x48, cFileName="1025", cAlternateFileName="")) returned 1 [0061.873] lstrcmpA (lpString1=".", lpString2="1025") returned -1 [0061.873] lstrcmpA (lpString1="..", lpString2="1025") returned -1 [0061.873] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0061.873] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1025" | out: lpString1="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0061.873] lstrlenA (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0061.873] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x760e78, cFileName=".", cAlternateFileName="")) returned 0x759990 [0061.874] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.874] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x760e78, cFileName="..", cAlternateFileName="")) returned 1 [0061.874] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.874] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.874] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0xfffffffe, dwReserved1=0x760e78, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.874] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.874] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0061.874] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0061.875] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0061.875] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1025\\*.*") returned="*.*" [0061.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0061.875] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1025\\" | out: pszPath="C:\\588bce7c90097ed212\\1025\\") returned="" [0061.875] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1025\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1025\\HOW TO DECRYPT FILES.txt" [0061.875] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1025\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\how to decrypt files.txt")) returned 0xffffffff [0061.875] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1025\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0061.877] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0061.877] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0061.879] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.879] CloseHandle (hObject=0x208) returned 1 [0061.879] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf" [0061.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.zip") returned 0 [0061.879] lstrlenA (lpString="*.zip") returned 5 [0061.879] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.rar") returned 0 [0061.880] lstrlenA (lpString="*.rar") returned 5 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.7z") returned 0 [0061.880] lstrlenA (lpString="*.7z") returned 4 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.tar") returned 0 [0061.880] lstrlenA (lpString="*.tar") returned 5 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.gzip") returned 0 [0061.880] lstrlenA (lpString="*.gzip") returned 6 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.jpg") returned 0 [0061.880] lstrlenA (lpString="*.jpg") returned 5 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.jpeg") returned 0 [0061.880] lstrlenA (lpString="*.jpeg") returned 6 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.psd") returned 0 [0061.880] lstrlenA (lpString="*.psd") returned 5 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.cdr") returned 0 [0061.880] lstrlenA (lpString="*.cdr") returned 5 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.dwg") returned 0 [0061.880] lstrlenA (lpString="*.dwg") returned 5 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.max") returned 0 [0061.880] lstrlenA (lpString="*.max") returned 5 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.bmp") returned 0 [0061.880] lstrlenA (lpString="*.bmp") returned 5 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.gif") returned 0 [0061.880] lstrlenA (lpString="*.gif") returned 5 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.png") returned 0 [0061.880] lstrlenA (lpString="*.png") returned 5 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.doc") returned 0 [0061.880] lstrlenA (lpString="*.doc") returned 5 [0061.880] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.docx") returned 0 [0061.880] lstrlenA (lpString="*.docx") returned 6 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.xls") returned 0 [0061.881] lstrlenA (lpString="*.xls") returned 5 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.xlsx") returned 0 [0061.881] lstrlenA (lpString="*.xlsx") returned 6 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.ppt") returned 0 [0061.881] lstrlenA (lpString="*.ppt") returned 5 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.pptx") returned 0 [0061.881] lstrlenA (lpString="*.pptx") returned 6 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.txt") returned 0 [0061.881] lstrlenA (lpString="*.txt") returned 5 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.pdf") returned 0 [0061.881] lstrlenA (lpString="*.pdf") returned 5 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.djvu") returned 0 [0061.881] lstrlenA (lpString="*.djvu") returned 6 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.htm") returned 0 [0061.881] lstrlenA (lpString="*.htm") returned 5 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.html") returned 0 [0061.881] lstrlenA (lpString="*.html") returned 6 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mdb") returned 0 [0061.881] lstrlenA (lpString="*.mdb") returned 5 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.cer") returned 0 [0061.881] lstrlenA (lpString="*.cer") returned 5 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.p12") returned 0 [0061.881] lstrlenA (lpString="*.p12") returned 5 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.pfx") returned 0 [0061.881] lstrlenA (lpString="*.pfx") returned 5 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.kwm") returned 0 [0061.881] lstrlenA (lpString="*.kwm") returned 5 [0061.881] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.pwm") returned 0 [0061.882] lstrlenA (lpString="*.pwm") returned 5 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.1cd") returned 0 [0061.882] lstrlenA (lpString="*.1cd") returned 5 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.md") returned 0 [0061.882] lstrlenA (lpString="*.md") returned 4 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mdf") returned 0 [0061.882] lstrlenA (lpString="*.mdf") returned 5 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.dbf") returned 0 [0061.882] lstrlenA (lpString="*.dbf") returned 5 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.odt") returned 0 [0061.882] lstrlenA (lpString="*.odt") returned 5 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.vob") returned 0 [0061.882] lstrlenA (lpString="*.vob") returned 5 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.ifo") returned 0 [0061.882] lstrlenA (lpString="*.ifo") returned 5 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.lnk") returned 0 [0061.882] lstrlenA (lpString="*.lnk") returned 5 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.torrent") returned 0 [0061.882] lstrlenA (lpString="*.torrent") returned 9 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mov") returned 0 [0061.882] lstrlenA (lpString="*.mov") returned 5 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.m2v") returned 0 [0061.882] lstrlenA (lpString="*.m2v") returned 5 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.3gp") returned 0 [0061.882] lstrlenA (lpString="*.3gp") returned 5 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mpeg") returned 0 [0061.882] lstrlenA (lpString="*.mpeg") returned 6 [0061.882] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mpg") returned 0 [0061.882] lstrlenA (lpString="*.mpg") returned 5 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.flv") returned 0 [0061.883] lstrlenA (lpString="*.flv") returned 5 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.avi") returned 0 [0061.883] lstrlenA (lpString="*.avi") returned 5 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mp4") returned 0 [0061.883] lstrlenA (lpString="*.mp4") returned 5 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.wmv") returned 0 [0061.883] lstrlenA (lpString="*.wmv") returned 5 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.divx") returned 0 [0061.883] lstrlenA (lpString="*.divx") returned 6 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mkv") returned 0 [0061.883] lstrlenA (lpString="*.mkv") returned 5 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.mp3") returned 0 [0061.883] lstrlenA (lpString="*.mp3") returned 5 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.wav") returned 0 [0061.883] lstrlenA (lpString="*.wav") returned 5 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.flac") returned 0 [0061.883] lstrlenA (lpString="*.flac") returned 6 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.ape") returned 0 [0061.883] lstrlenA (lpString="*.ape") returned 5 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.wma") returned 0 [0061.883] lstrlenA (lpString="*.wma") returned 5 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.ac3") returned 0 [0061.883] lstrlenA (lpString="*.ac3") returned 5 [0061.883] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\eula.rtf", pszSpec="*.doc") returned 0 [0061.883] lstrlenA (lpString="*.doc") returned 5 [0061.883] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.883] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.884] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0061.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0061.884] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0061.884] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned="eula.rtf" [0061.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0061.884] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1025\\" | out: pszPath="C:\\588bce7c90097ed212\\1025\\") returned="" [0061.884] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1025\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1025\\HOW TO DECRYPT FILES.txt" [0061.884] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1025\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\how to decrypt files.txt")) returned 0x20 [0061.884] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" [0061.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0061.884] lstrlenA (lpString="*.zip") returned 5 [0061.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0061.884] lstrlenA (lpString="*.rar") returned 5 [0061.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0061.884] lstrlenA (lpString="*.7z") returned 4 [0061.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0061.884] lstrlenA (lpString="*.tar") returned 5 [0061.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0061.884] lstrlenA (lpString="*.gzip") returned 6 [0061.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0061.884] lstrlenA (lpString="*.jpg") returned 5 [0061.884] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0061.884] lstrlenA (lpString="*.jpeg") returned 6 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0061.885] lstrlenA (lpString="*.psd") returned 5 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0061.885] lstrlenA (lpString="*.cdr") returned 5 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0061.885] lstrlenA (lpString="*.dwg") returned 5 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.max") returned 0 [0061.885] lstrlenA (lpString="*.max") returned 5 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0061.885] lstrlenA (lpString="*.bmp") returned 5 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0061.885] lstrlenA (lpString="*.gif") returned 5 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.png") returned 0 [0061.885] lstrlenA (lpString="*.png") returned 5 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0061.885] lstrlenA (lpString="*.doc") returned 5 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0061.885] lstrlenA (lpString="*.docx") returned 6 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0061.885] lstrlenA (lpString="*.xls") returned 5 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0061.885] lstrlenA (lpString="*.xlsx") returned 6 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0061.885] lstrlenA (lpString="*.ppt") returned 5 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0061.885] lstrlenA (lpString="*.pptx") returned 6 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0061.885] lstrlenA (lpString="*.txt") returned 5 [0061.885] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0061.886] lstrlenA (lpString="*.pdf") returned 5 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0061.886] lstrlenA (lpString="*.djvu") returned 6 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0061.886] lstrlenA (lpString="*.htm") returned 5 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.html") returned 0 [0061.886] lstrlenA (lpString="*.html") returned 6 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0061.886] lstrlenA (lpString="*.mdb") returned 5 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0061.886] lstrlenA (lpString="*.cer") returned 5 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0061.886] lstrlenA (lpString="*.p12") returned 5 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0061.886] lstrlenA (lpString="*.pfx") returned 5 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0061.886] lstrlenA (lpString="*.kwm") returned 5 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0061.886] lstrlenA (lpString="*.pwm") returned 5 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0061.886] lstrlenA (lpString="*.1cd") returned 5 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.md") returned 0 [0061.886] lstrlenA (lpString="*.md") returned 4 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0061.886] lstrlenA (lpString="*.mdf") returned 5 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0061.886] lstrlenA (lpString="*.dbf") returned 5 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0061.886] lstrlenA (lpString="*.odt") returned 5 [0061.886] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0061.887] lstrlenA (lpString="*.vob") returned 5 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0061.887] lstrlenA (lpString="*.ifo") returned 5 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0061.887] lstrlenA (lpString="*.lnk") returned 5 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0061.887] lstrlenA (lpString="*.torrent") returned 9 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0061.887] lstrlenA (lpString="*.mov") returned 5 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0061.887] lstrlenA (lpString="*.m2v") returned 5 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0061.887] lstrlenA (lpString="*.3gp") returned 5 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0061.887] lstrlenA (lpString="*.mpeg") returned 6 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0061.887] lstrlenA (lpString="*.mpg") returned 5 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0061.887] lstrlenA (lpString="*.flv") returned 5 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0061.887] lstrlenA (lpString="*.avi") returned 5 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0061.887] lstrlenA (lpString="*.mp4") returned 5 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0061.887] lstrlenA (lpString="*.wmv") returned 5 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0061.887] lstrlenA (lpString="*.divx") returned 6 [0061.887] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0061.888] lstrlenA (lpString="*.mkv") returned 5 [0061.888] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0061.888] lstrlenA (lpString="*.mp3") returned 5 [0061.888] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0061.888] lstrlenA (lpString="*.wav") returned 5 [0061.888] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0061.888] lstrlenA (lpString="*.flac") returned 6 [0061.888] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0061.888] lstrlenA (lpString="*.ape") returned 5 [0061.888] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0061.888] lstrlenA (lpString="*.wma") returned 5 [0061.888] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0061.888] lstrlenA (lpString="*.ac3") returned 5 [0061.888] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0061.888] lstrlenA (lpString="*.doc") returned 5 [0061.888] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.888] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.888] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0061.888] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0061.888] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0061.888] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned="LocalizedData.xml" [0061.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0061.888] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1025\\" | out: pszPath="C:\\588bce7c90097ed212\\1025\\") returned="" [0061.888] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1025\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1025\\HOW TO DECRYPT FILES.txt" [0061.888] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1025\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\how to decrypt files.txt")) returned 0x20 [0061.889] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" [0061.889] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.zip") returned 0 [0061.889] lstrlenA (lpString="*.zip") returned 5 [0061.889] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.rar") returned 0 [0061.889] lstrlenA (lpString="*.rar") returned 5 [0061.889] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.7z") returned 0 [0061.889] lstrlenA (lpString="*.7z") returned 4 [0061.889] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.tar") returned 0 [0061.889] lstrlenA (lpString="*.tar") returned 5 [0061.889] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0061.889] lstrlenA (lpString="*.gzip") returned 6 [0061.889] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0061.889] lstrlenA (lpString="*.jpg") returned 5 [0061.889] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0061.889] lstrlenA (lpString="*.jpeg") returned 6 [0061.889] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.psd") returned 0 [0061.889] lstrlenA (lpString="*.psd") returned 5 [0061.889] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0061.889] lstrlenA (lpString="*.cdr") returned 5 [0061.914] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0061.914] lstrlenA (lpString="*.dwg") returned 5 [0061.914] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.max") returned 0 [0061.914] lstrlenA (lpString="*.max") returned 5 [0061.914] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0061.914] lstrlenA (lpString="*.bmp") returned 5 [0061.914] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.gif") returned 0 [0061.914] lstrlenA (lpString="*.gif") returned 5 [0061.914] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.png") returned 0 [0061.914] lstrlenA (lpString="*.png") returned 5 [0061.914] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.doc") returned 0 [0061.914] lstrlenA (lpString="*.doc") returned 5 [0061.914] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.docx") returned 0 [0061.915] lstrlenA (lpString="*.docx") returned 6 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.xls") returned 0 [0061.915] lstrlenA (lpString="*.xls") returned 5 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0061.915] lstrlenA (lpString="*.xlsx") returned 6 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0061.915] lstrlenA (lpString="*.ppt") returned 5 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0061.915] lstrlenA (lpString="*.pptx") returned 6 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.txt") returned 0 [0061.915] lstrlenA (lpString="*.txt") returned 5 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0061.915] lstrlenA (lpString="*.pdf") returned 5 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0061.915] lstrlenA (lpString="*.djvu") returned 6 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.htm") returned 0 [0061.915] lstrlenA (lpString="*.htm") returned 5 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.html") returned 0 [0061.915] lstrlenA (lpString="*.html") returned 6 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0061.915] lstrlenA (lpString="*.mdb") returned 5 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.cer") returned 0 [0061.915] lstrlenA (lpString="*.cer") returned 5 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.p12") returned 0 [0061.915] lstrlenA (lpString="*.p12") returned 5 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0061.915] lstrlenA (lpString="*.pfx") returned 5 [0061.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0061.916] lstrlenA (lpString="*.kwm") returned 5 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0061.916] lstrlenA (lpString="*.pwm") returned 5 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0061.916] lstrlenA (lpString="*.1cd") returned 5 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.md") returned 0 [0061.916] lstrlenA (lpString="*.md") returned 4 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0061.916] lstrlenA (lpString="*.mdf") returned 5 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0061.916] lstrlenA (lpString="*.dbf") returned 5 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.odt") returned 0 [0061.916] lstrlenA (lpString="*.odt") returned 5 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.vob") returned 0 [0061.916] lstrlenA (lpString="*.vob") returned 5 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0061.916] lstrlenA (lpString="*.ifo") returned 5 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0061.916] lstrlenA (lpString="*.lnk") returned 5 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0061.916] lstrlenA (lpString="*.torrent") returned 9 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mov") returned 0 [0061.916] lstrlenA (lpString="*.mov") returned 5 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0061.916] lstrlenA (lpString="*.m2v") returned 5 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0061.916] lstrlenA (lpString="*.3gp") returned 5 [0061.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0061.916] lstrlenA (lpString="*.mpeg") returned 6 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0061.917] lstrlenA (lpString="*.mpg") returned 5 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.flv") returned 0 [0061.917] lstrlenA (lpString="*.flv") returned 5 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.avi") returned 0 [0061.917] lstrlenA (lpString="*.avi") returned 5 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0061.917] lstrlenA (lpString="*.mp4") returned 5 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0061.917] lstrlenA (lpString="*.wmv") returned 5 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.divx") returned 0 [0061.917] lstrlenA (lpString="*.divx") returned 6 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0061.917] lstrlenA (lpString="*.mkv") returned 5 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0061.917] lstrlenA (lpString="*.mp3") returned 5 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.wav") returned 0 [0061.917] lstrlenA (lpString="*.wav") returned 5 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.flac") returned 0 [0061.917] lstrlenA (lpString="*.flac") returned 6 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.ape") returned 0 [0061.917] lstrlenA (lpString="*.ape") returned 5 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.wma") returned 0 [0061.917] lstrlenA (lpString="*.wma") returned 5 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0061.917] lstrlenA (lpString="*.ac3") returned 5 [0061.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", pszSpec="*.doc") returned 0 [0061.917] lstrlenA (lpString="*.doc") returned 5 [0061.917] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.917] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0061.918] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1028", cAlternateFileName="")) returned 1 [0061.918] lstrcmpA (lpString1=".", lpString2="1028") returned -1 [0061.918] lstrcmpA (lpString1="..", lpString2="1028") returned -1 [0061.918] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0061.918] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1028" | out: lpString1="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0061.918] lstrlenA (lpString="C:\\588bce7c90097ed212\\1028") returned 26 [0061.918] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e90 [0061.919] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.919] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.919] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.919] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.919] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.919] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.919] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0061.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0061.919] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0061.919] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1028\\*.*") returned="*.*" [0061.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0061.919] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1028\\" | out: pszPath="C:\\588bce7c90097ed212\\1028\\") returned="" [0061.919] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1028\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1028\\HOW TO DECRYPT FILES.txt" [0061.919] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1028\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\how to decrypt files.txt")) returned 0xffffffff [0061.919] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1028\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0061.921] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0061.921] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0061.922] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.922] CloseHandle (hObject=0x208) returned 1 [0061.922] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf" [0061.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.zip") returned 0 [0061.922] lstrlenA (lpString="*.zip") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.rar") returned 0 [0061.923] lstrlenA (lpString="*.rar") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.7z") returned 0 [0061.923] lstrlenA (lpString="*.7z") returned 4 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.tar") returned 0 [0061.923] lstrlenA (lpString="*.tar") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.gzip") returned 0 [0061.923] lstrlenA (lpString="*.gzip") returned 6 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.jpg") returned 0 [0061.923] lstrlenA (lpString="*.jpg") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.jpeg") returned 0 [0061.923] lstrlenA (lpString="*.jpeg") returned 6 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.psd") returned 0 [0061.923] lstrlenA (lpString="*.psd") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.cdr") returned 0 [0061.923] lstrlenA (lpString="*.cdr") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.dwg") returned 0 [0061.923] lstrlenA (lpString="*.dwg") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.max") returned 0 [0061.923] lstrlenA (lpString="*.max") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.bmp") returned 0 [0061.923] lstrlenA (lpString="*.bmp") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.gif") returned 0 [0061.923] lstrlenA (lpString="*.gif") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.png") returned 0 [0061.923] lstrlenA (lpString="*.png") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.doc") returned 0 [0061.923] lstrlenA (lpString="*.doc") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.docx") returned 0 [0061.923] lstrlenA (lpString="*.docx") returned 6 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.xls") returned 0 [0061.923] lstrlenA (lpString="*.xls") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.xlsx") returned 0 [0061.923] lstrlenA (lpString="*.xlsx") returned 6 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.ppt") returned 0 [0061.923] lstrlenA (lpString="*.ppt") returned 5 [0061.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.pptx") returned 0 [0061.924] lstrlenA (lpString="*.pptx") returned 6 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.txt") returned 0 [0061.924] lstrlenA (lpString="*.txt") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.pdf") returned 0 [0061.924] lstrlenA (lpString="*.pdf") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.djvu") returned 0 [0061.924] lstrlenA (lpString="*.djvu") returned 6 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.htm") returned 0 [0061.924] lstrlenA (lpString="*.htm") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.html") returned 0 [0061.924] lstrlenA (lpString="*.html") returned 6 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mdb") returned 0 [0061.924] lstrlenA (lpString="*.mdb") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.cer") returned 0 [0061.924] lstrlenA (lpString="*.cer") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.p12") returned 0 [0061.924] lstrlenA (lpString="*.p12") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.pfx") returned 0 [0061.924] lstrlenA (lpString="*.pfx") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.kwm") returned 0 [0061.924] lstrlenA (lpString="*.kwm") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.pwm") returned 0 [0061.924] lstrlenA (lpString="*.pwm") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.1cd") returned 0 [0061.924] lstrlenA (lpString="*.1cd") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.md") returned 0 [0061.924] lstrlenA (lpString="*.md") returned 4 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mdf") returned 0 [0061.924] lstrlenA (lpString="*.mdf") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.dbf") returned 0 [0061.924] lstrlenA (lpString="*.dbf") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.odt") returned 0 [0061.924] lstrlenA (lpString="*.odt") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.vob") returned 0 [0061.924] lstrlenA (lpString="*.vob") returned 5 [0061.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.ifo") returned 0 [0061.924] lstrlenA (lpString="*.ifo") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.lnk") returned 0 [0061.925] lstrlenA (lpString="*.lnk") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.torrent") returned 0 [0061.925] lstrlenA (lpString="*.torrent") returned 9 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mov") returned 0 [0061.925] lstrlenA (lpString="*.mov") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.m2v") returned 0 [0061.925] lstrlenA (lpString="*.m2v") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.3gp") returned 0 [0061.925] lstrlenA (lpString="*.3gp") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mpeg") returned 0 [0061.925] lstrlenA (lpString="*.mpeg") returned 6 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mpg") returned 0 [0061.925] lstrlenA (lpString="*.mpg") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.flv") returned 0 [0061.925] lstrlenA (lpString="*.flv") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.avi") returned 0 [0061.925] lstrlenA (lpString="*.avi") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mp4") returned 0 [0061.925] lstrlenA (lpString="*.mp4") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.wmv") returned 0 [0061.925] lstrlenA (lpString="*.wmv") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.divx") returned 0 [0061.925] lstrlenA (lpString="*.divx") returned 6 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mkv") returned 0 [0061.925] lstrlenA (lpString="*.mkv") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.mp3") returned 0 [0061.925] lstrlenA (lpString="*.mp3") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.wav") returned 0 [0061.925] lstrlenA (lpString="*.wav") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.flac") returned 0 [0061.925] lstrlenA (lpString="*.flac") returned 6 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.ape") returned 0 [0061.925] lstrlenA (lpString="*.ape") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.wma") returned 0 [0061.925] lstrlenA (lpString="*.wma") returned 5 [0061.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.ac3") returned 0 [0061.926] lstrlenA (lpString="*.ac3") returned 5 [0061.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\eula.rtf", pszSpec="*.doc") returned 0 [0061.926] lstrlenA (lpString="*.doc") returned 5 [0061.926] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.926] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.926] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0061.926] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0061.926] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0061.926] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned="eula.rtf" [0061.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0061.926] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1028\\" | out: pszPath="C:\\588bce7c90097ed212\\1028\\") returned="" [0061.926] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1028\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1028\\HOW TO DECRYPT FILES.txt" [0061.926] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1028\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\how to decrypt files.txt")) returned 0x20 [0061.926] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" [0061.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0061.926] lstrlenA (lpString="*.zip") returned 5 [0061.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0061.926] lstrlenA (lpString="*.rar") returned 5 [0061.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0061.926] lstrlenA (lpString="*.7z") returned 4 [0061.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0061.926] lstrlenA (lpString="*.tar") returned 5 [0061.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0061.926] lstrlenA (lpString="*.gzip") returned 6 [0061.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0061.926] lstrlenA (lpString="*.jpg") returned 5 [0061.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0061.926] lstrlenA (lpString="*.jpeg") returned 6 [0061.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0061.926] lstrlenA (lpString="*.psd") returned 5 [0061.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0061.926] lstrlenA (lpString="*.cdr") returned 5 [0061.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0061.927] lstrlenA (lpString="*.dwg") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.max") returned 0 [0061.927] lstrlenA (lpString="*.max") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0061.927] lstrlenA (lpString="*.bmp") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0061.927] lstrlenA (lpString="*.gif") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.png") returned 0 [0061.927] lstrlenA (lpString="*.png") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0061.927] lstrlenA (lpString="*.doc") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0061.927] lstrlenA (lpString="*.docx") returned 6 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0061.927] lstrlenA (lpString="*.xls") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0061.927] lstrlenA (lpString="*.xlsx") returned 6 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0061.927] lstrlenA (lpString="*.ppt") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0061.927] lstrlenA (lpString="*.pptx") returned 6 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0061.927] lstrlenA (lpString="*.txt") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0061.927] lstrlenA (lpString="*.pdf") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0061.927] lstrlenA (lpString="*.djvu") returned 6 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0061.927] lstrlenA (lpString="*.htm") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.html") returned 0 [0061.927] lstrlenA (lpString="*.html") returned 6 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0061.927] lstrlenA (lpString="*.mdb") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0061.927] lstrlenA (lpString="*.cer") returned 5 [0061.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0061.927] lstrlenA (lpString="*.p12") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0061.928] lstrlenA (lpString="*.pfx") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0061.928] lstrlenA (lpString="*.kwm") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0061.928] lstrlenA (lpString="*.pwm") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0061.928] lstrlenA (lpString="*.1cd") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.md") returned 0 [0061.928] lstrlenA (lpString="*.md") returned 4 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0061.928] lstrlenA (lpString="*.mdf") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0061.928] lstrlenA (lpString="*.dbf") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0061.928] lstrlenA (lpString="*.odt") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0061.928] lstrlenA (lpString="*.vob") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0061.928] lstrlenA (lpString="*.ifo") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0061.928] lstrlenA (lpString="*.lnk") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0061.928] lstrlenA (lpString="*.torrent") returned 9 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0061.928] lstrlenA (lpString="*.mov") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0061.928] lstrlenA (lpString="*.m2v") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0061.928] lstrlenA (lpString="*.3gp") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0061.928] lstrlenA (lpString="*.mpeg") returned 6 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0061.928] lstrlenA (lpString="*.mpg") returned 5 [0061.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0061.928] lstrlenA (lpString="*.flv") returned 5 [0061.929] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0061.929] lstrlenA (lpString="*.avi") returned 5 [0061.929] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0061.929] lstrlenA (lpString="*.mp4") returned 5 [0061.929] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0061.929] lstrlenA (lpString="*.wmv") returned 5 [0061.929] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0061.929] lstrlenA (lpString="*.divx") returned 6 [0061.929] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0061.929] lstrlenA (lpString="*.mkv") returned 5 [0061.929] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0061.929] lstrlenA (lpString="*.mp3") returned 5 [0061.929] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0061.929] lstrlenA (lpString="*.wav") returned 5 [0061.929] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0061.929] lstrlenA (lpString="*.flac") returned 6 [0061.929] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0061.929] lstrlenA (lpString="*.ape") returned 5 [0061.929] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0061.929] lstrlenA (lpString="*.wma") returned 5 [0061.929] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0061.929] lstrlenA (lpString="*.ac3") returned 5 [0061.929] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0061.929] lstrlenA (lpString="*.doc") returned 5 [0061.929] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.929] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.929] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0061.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0061.929] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0061.929] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned="LocalizedData.xml" [0061.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0061.929] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1028\\" | out: pszPath="C:\\588bce7c90097ed212\\1028\\") returned="" [0061.929] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1028\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1028\\HOW TO DECRYPT FILES.txt" [0061.930] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1028\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\how to decrypt files.txt")) returned 0x20 [0061.930] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.zip") returned 0 [0061.930] lstrlenA (lpString="*.zip") returned 5 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.rar") returned 0 [0061.930] lstrlenA (lpString="*.rar") returned 5 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.7z") returned 0 [0061.930] lstrlenA (lpString="*.7z") returned 4 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.tar") returned 0 [0061.930] lstrlenA (lpString="*.tar") returned 5 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0061.930] lstrlenA (lpString="*.gzip") returned 6 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0061.930] lstrlenA (lpString="*.jpg") returned 5 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0061.930] lstrlenA (lpString="*.jpeg") returned 6 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.psd") returned 0 [0061.930] lstrlenA (lpString="*.psd") returned 5 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0061.930] lstrlenA (lpString="*.cdr") returned 5 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0061.930] lstrlenA (lpString="*.dwg") returned 5 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.max") returned 0 [0061.930] lstrlenA (lpString="*.max") returned 5 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0061.930] lstrlenA (lpString="*.bmp") returned 5 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.gif") returned 0 [0061.930] lstrlenA (lpString="*.gif") returned 5 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.png") returned 0 [0061.930] lstrlenA (lpString="*.png") returned 5 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.doc") returned 0 [0061.930] lstrlenA (lpString="*.doc") returned 5 [0061.930] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.docx") returned 0 [0061.931] lstrlenA (lpString="*.docx") returned 6 [0061.931] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.xls") returned 0 [0061.931] lstrlenA (lpString="*.xls") returned 5 [0061.931] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0061.931] lstrlenA (lpString="*.xlsx") returned 6 [0061.931] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0061.931] lstrlenA (lpString="*.ppt") returned 5 [0061.931] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0061.931] lstrlenA (lpString="*.pptx") returned 6 [0061.931] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.txt") returned 0 [0061.931] lstrlenA (lpString="*.txt") returned 5 [0061.931] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0061.931] lstrlenA (lpString="*.pdf") returned 5 [0061.931] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0061.931] lstrlenA (lpString="*.djvu") returned 6 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.htm") returned 0 [0061.932] lstrlenA (lpString="*.htm") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.html") returned 0 [0061.932] lstrlenA (lpString="*.html") returned 6 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0061.932] lstrlenA (lpString="*.mdb") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.cer") returned 0 [0061.932] lstrlenA (lpString="*.cer") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.p12") returned 0 [0061.932] lstrlenA (lpString="*.p12") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0061.932] lstrlenA (lpString="*.pfx") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0061.932] lstrlenA (lpString="*.kwm") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0061.932] lstrlenA (lpString="*.pwm") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0061.932] lstrlenA (lpString="*.1cd") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.md") returned 0 [0061.932] lstrlenA (lpString="*.md") returned 4 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0061.932] lstrlenA (lpString="*.mdf") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0061.932] lstrlenA (lpString="*.dbf") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.odt") returned 0 [0061.932] lstrlenA (lpString="*.odt") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.vob") returned 0 [0061.932] lstrlenA (lpString="*.vob") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0061.932] lstrlenA (lpString="*.ifo") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0061.932] lstrlenA (lpString="*.lnk") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0061.932] lstrlenA (lpString="*.torrent") returned 9 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mov") returned 0 [0061.932] lstrlenA (lpString="*.mov") returned 5 [0061.932] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0061.933] lstrlenA (lpString="*.m2v") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0061.933] lstrlenA (lpString="*.3gp") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0061.933] lstrlenA (lpString="*.mpeg") returned 6 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0061.933] lstrlenA (lpString="*.mpg") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.flv") returned 0 [0061.933] lstrlenA (lpString="*.flv") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.avi") returned 0 [0061.933] lstrlenA (lpString="*.avi") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0061.933] lstrlenA (lpString="*.mp4") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0061.933] lstrlenA (lpString="*.wmv") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.divx") returned 0 [0061.933] lstrlenA (lpString="*.divx") returned 6 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0061.933] lstrlenA (lpString="*.mkv") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0061.933] lstrlenA (lpString="*.mp3") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.wav") returned 0 [0061.933] lstrlenA (lpString="*.wav") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.flac") returned 0 [0061.933] lstrlenA (lpString="*.flac") returned 6 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.ape") returned 0 [0061.933] lstrlenA (lpString="*.ape") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.wma") returned 0 [0061.933] lstrlenA (lpString="*.wma") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0061.933] lstrlenA (lpString="*.ac3") returned 5 [0061.933] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", pszSpec="*.doc") returned 0 [0061.933] lstrlenA (lpString="*.doc") returned 5 [0061.933] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.933] FindClose (in: hFindFile=0x759e90 | out: hFindFile=0x759e90) returned 1 [0061.934] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1029", cAlternateFileName="")) returned 1 [0061.934] lstrcmpA (lpString1=".", lpString2="1029") returned -1 [0061.934] lstrcmpA (lpString1="..", lpString2="1029") returned -1 [0061.934] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0061.934] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1029" | out: lpString1="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0061.934] lstrlenA (lpString="C:\\588bce7c90097ed212\\1029") returned 26 [0061.934] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0061.934] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.935] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.935] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.935] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.935] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.935] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.935] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0061.935] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0061.935] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0061.935] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1029\\*.*") returned="*.*" [0061.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0061.935] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1029\\" | out: pszPath="C:\\588bce7c90097ed212\\1029\\") returned="" [0061.935] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1029\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1029\\HOW TO DECRYPT FILES.txt" [0061.935] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1029\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\how to decrypt files.txt")) returned 0xffffffff [0061.935] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1029\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0061.937] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0061.937] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0061.938] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.938] CloseHandle (hObject=0x208) returned 1 [0061.938] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf" [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.zip") returned 0 [0061.939] lstrlenA (lpString="*.zip") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.rar") returned 0 [0061.939] lstrlenA (lpString="*.rar") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.7z") returned 0 [0061.939] lstrlenA (lpString="*.7z") returned 4 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.tar") returned 0 [0061.939] lstrlenA (lpString="*.tar") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.gzip") returned 0 [0061.939] lstrlenA (lpString="*.gzip") returned 6 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.jpg") returned 0 [0061.939] lstrlenA (lpString="*.jpg") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.jpeg") returned 0 [0061.939] lstrlenA (lpString="*.jpeg") returned 6 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.psd") returned 0 [0061.939] lstrlenA (lpString="*.psd") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.cdr") returned 0 [0061.939] lstrlenA (lpString="*.cdr") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.dwg") returned 0 [0061.939] lstrlenA (lpString="*.dwg") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.max") returned 0 [0061.939] lstrlenA (lpString="*.max") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.bmp") returned 0 [0061.939] lstrlenA (lpString="*.bmp") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.gif") returned 0 [0061.939] lstrlenA (lpString="*.gif") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.png") returned 0 [0061.939] lstrlenA (lpString="*.png") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.doc") returned 0 [0061.939] lstrlenA (lpString="*.doc") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.docx") returned 0 [0061.939] lstrlenA (lpString="*.docx") returned 6 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.xls") returned 0 [0061.939] lstrlenA (lpString="*.xls") returned 5 [0061.939] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.xlsx") returned 0 [0061.939] lstrlenA (lpString="*.xlsx") returned 6 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.ppt") returned 0 [0061.940] lstrlenA (lpString="*.ppt") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.pptx") returned 0 [0061.940] lstrlenA (lpString="*.pptx") returned 6 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.txt") returned 0 [0061.940] lstrlenA (lpString="*.txt") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.pdf") returned 0 [0061.940] lstrlenA (lpString="*.pdf") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.djvu") returned 0 [0061.940] lstrlenA (lpString="*.djvu") returned 6 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.htm") returned 0 [0061.940] lstrlenA (lpString="*.htm") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.html") returned 0 [0061.940] lstrlenA (lpString="*.html") returned 6 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mdb") returned 0 [0061.940] lstrlenA (lpString="*.mdb") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.cer") returned 0 [0061.940] lstrlenA (lpString="*.cer") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.p12") returned 0 [0061.940] lstrlenA (lpString="*.p12") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.pfx") returned 0 [0061.940] lstrlenA (lpString="*.pfx") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.kwm") returned 0 [0061.940] lstrlenA (lpString="*.kwm") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.pwm") returned 0 [0061.940] lstrlenA (lpString="*.pwm") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.1cd") returned 0 [0061.940] lstrlenA (lpString="*.1cd") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.md") returned 0 [0061.940] lstrlenA (lpString="*.md") returned 4 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mdf") returned 0 [0061.940] lstrlenA (lpString="*.mdf") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.dbf") returned 0 [0061.940] lstrlenA (lpString="*.dbf") returned 5 [0061.940] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.odt") returned 0 [0061.940] lstrlenA (lpString="*.odt") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.vob") returned 0 [0061.941] lstrlenA (lpString="*.vob") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.ifo") returned 0 [0061.941] lstrlenA (lpString="*.ifo") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.lnk") returned 0 [0061.941] lstrlenA (lpString="*.lnk") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.torrent") returned 0 [0061.941] lstrlenA (lpString="*.torrent") returned 9 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mov") returned 0 [0061.941] lstrlenA (lpString="*.mov") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.m2v") returned 0 [0061.941] lstrlenA (lpString="*.m2v") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.3gp") returned 0 [0061.941] lstrlenA (lpString="*.3gp") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mpeg") returned 0 [0061.941] lstrlenA (lpString="*.mpeg") returned 6 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mpg") returned 0 [0061.941] lstrlenA (lpString="*.mpg") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.flv") returned 0 [0061.941] lstrlenA (lpString="*.flv") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.avi") returned 0 [0061.941] lstrlenA (lpString="*.avi") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mp4") returned 0 [0061.941] lstrlenA (lpString="*.mp4") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.wmv") returned 0 [0061.941] lstrlenA (lpString="*.wmv") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.divx") returned 0 [0061.941] lstrlenA (lpString="*.divx") returned 6 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mkv") returned 0 [0061.941] lstrlenA (lpString="*.mkv") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.mp3") returned 0 [0061.941] lstrlenA (lpString="*.mp3") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.wav") returned 0 [0061.941] lstrlenA (lpString="*.wav") returned 5 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.flac") returned 0 [0061.941] lstrlenA (lpString="*.flac") returned 6 [0061.941] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.ape") returned 0 [0061.942] lstrlenA (lpString="*.ape") returned 5 [0061.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.wma") returned 0 [0061.942] lstrlenA (lpString="*.wma") returned 5 [0061.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.ac3") returned 0 [0061.942] lstrlenA (lpString="*.ac3") returned 5 [0061.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\eula.rtf", pszSpec="*.doc") returned 0 [0061.942] lstrlenA (lpString="*.doc") returned 5 [0061.942] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.942] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.942] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0061.942] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0061.942] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0061.942] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned="eula.rtf" [0061.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0061.942] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1029\\" | out: pszPath="C:\\588bce7c90097ed212\\1029\\") returned="" [0061.942] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1029\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1029\\HOW TO DECRYPT FILES.txt" [0061.942] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1029\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\how to decrypt files.txt")) returned 0x20 [0061.942] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" [0061.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0061.942] lstrlenA (lpString="*.zip") returned 5 [0061.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0061.942] lstrlenA (lpString="*.rar") returned 5 [0061.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0061.942] lstrlenA (lpString="*.7z") returned 4 [0061.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0061.942] lstrlenA (lpString="*.tar") returned 5 [0061.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0061.942] lstrlenA (lpString="*.gzip") returned 6 [0061.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0061.942] lstrlenA (lpString="*.jpg") returned 5 [0061.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0061.942] lstrlenA (lpString="*.jpeg") returned 6 [0061.942] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0061.942] lstrlenA (lpString="*.psd") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0061.943] lstrlenA (lpString="*.cdr") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0061.943] lstrlenA (lpString="*.dwg") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.max") returned 0 [0061.943] lstrlenA (lpString="*.max") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0061.943] lstrlenA (lpString="*.bmp") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0061.943] lstrlenA (lpString="*.gif") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.png") returned 0 [0061.943] lstrlenA (lpString="*.png") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0061.943] lstrlenA (lpString="*.doc") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0061.943] lstrlenA (lpString="*.docx") returned 6 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0061.943] lstrlenA (lpString="*.xls") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0061.943] lstrlenA (lpString="*.xlsx") returned 6 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0061.943] lstrlenA (lpString="*.ppt") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0061.943] lstrlenA (lpString="*.pptx") returned 6 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0061.943] lstrlenA (lpString="*.txt") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0061.943] lstrlenA (lpString="*.pdf") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0061.943] lstrlenA (lpString="*.djvu") returned 6 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0061.943] lstrlenA (lpString="*.htm") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.html") returned 0 [0061.943] lstrlenA (lpString="*.html") returned 6 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0061.943] lstrlenA (lpString="*.mdb") returned 5 [0061.943] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0061.944] lstrlenA (lpString="*.cer") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0061.944] lstrlenA (lpString="*.p12") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0061.944] lstrlenA (lpString="*.pfx") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0061.944] lstrlenA (lpString="*.kwm") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0061.944] lstrlenA (lpString="*.pwm") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0061.944] lstrlenA (lpString="*.1cd") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.md") returned 0 [0061.944] lstrlenA (lpString="*.md") returned 4 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0061.944] lstrlenA (lpString="*.mdf") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0061.944] lstrlenA (lpString="*.dbf") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0061.944] lstrlenA (lpString="*.odt") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0061.944] lstrlenA (lpString="*.vob") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0061.944] lstrlenA (lpString="*.ifo") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0061.944] lstrlenA (lpString="*.lnk") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0061.944] lstrlenA (lpString="*.torrent") returned 9 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0061.944] lstrlenA (lpString="*.mov") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0061.944] lstrlenA (lpString="*.m2v") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0061.944] lstrlenA (lpString="*.3gp") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0061.944] lstrlenA (lpString="*.mpeg") returned 6 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0061.944] lstrlenA (lpString="*.mpg") returned 5 [0061.944] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0061.945] lstrlenA (lpString="*.flv") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0061.945] lstrlenA (lpString="*.avi") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0061.945] lstrlenA (lpString="*.mp4") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0061.945] lstrlenA (lpString="*.wmv") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0061.945] lstrlenA (lpString="*.divx") returned 6 [0061.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0061.945] lstrlenA (lpString="*.mkv") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0061.945] lstrlenA (lpString="*.mp3") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0061.945] lstrlenA (lpString="*.wav") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0061.945] lstrlenA (lpString="*.flac") returned 6 [0061.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0061.945] lstrlenA (lpString="*.ape") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0061.945] lstrlenA (lpString="*.wma") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0061.945] lstrlenA (lpString="*.ac3") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0061.945] lstrlenA (lpString="*.doc") returned 5 [0061.945] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.945] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.945] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0061.945] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0061.945] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0061.945] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned="LocalizedData.xml" [0061.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0061.945] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1029\\" | out: pszPath="C:\\588bce7c90097ed212\\1029\\") returned="" [0061.945] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1029\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1029\\HOW TO DECRYPT FILES.txt" [0061.945] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1029\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\how to decrypt files.txt")) returned 0x20 [0061.946] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.zip") returned 0 [0061.946] lstrlenA (lpString="*.zip") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.rar") returned 0 [0061.946] lstrlenA (lpString="*.rar") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.7z") returned 0 [0061.946] lstrlenA (lpString="*.7z") returned 4 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.tar") returned 0 [0061.946] lstrlenA (lpString="*.tar") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0061.946] lstrlenA (lpString="*.gzip") returned 6 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0061.946] lstrlenA (lpString="*.jpg") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0061.946] lstrlenA (lpString="*.jpeg") returned 6 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.psd") returned 0 [0061.946] lstrlenA (lpString="*.psd") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0061.946] lstrlenA (lpString="*.cdr") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0061.946] lstrlenA (lpString="*.dwg") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.max") returned 0 [0061.946] lstrlenA (lpString="*.max") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0061.946] lstrlenA (lpString="*.bmp") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.gif") returned 0 [0061.946] lstrlenA (lpString="*.gif") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.png") returned 0 [0061.946] lstrlenA (lpString="*.png") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.doc") returned 0 [0061.946] lstrlenA (lpString="*.doc") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.docx") returned 0 [0061.946] lstrlenA (lpString="*.docx") returned 6 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.xls") returned 0 [0061.946] lstrlenA (lpString="*.xls") returned 5 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0061.946] lstrlenA (lpString="*.xlsx") returned 6 [0061.946] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0061.947] lstrlenA (lpString="*.ppt") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0061.947] lstrlenA (lpString="*.pptx") returned 6 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.txt") returned 0 [0061.947] lstrlenA (lpString="*.txt") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0061.947] lstrlenA (lpString="*.pdf") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0061.947] lstrlenA (lpString="*.djvu") returned 6 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.htm") returned 0 [0061.947] lstrlenA (lpString="*.htm") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.html") returned 0 [0061.947] lstrlenA (lpString="*.html") returned 6 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0061.947] lstrlenA (lpString="*.mdb") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.cer") returned 0 [0061.947] lstrlenA (lpString="*.cer") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.p12") returned 0 [0061.947] lstrlenA (lpString="*.p12") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0061.947] lstrlenA (lpString="*.pfx") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0061.947] lstrlenA (lpString="*.kwm") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0061.947] lstrlenA (lpString="*.pwm") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0061.947] lstrlenA (lpString="*.1cd") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.md") returned 0 [0061.947] lstrlenA (lpString="*.md") returned 4 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0061.947] lstrlenA (lpString="*.mdf") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0061.947] lstrlenA (lpString="*.dbf") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.odt") returned 0 [0061.947] lstrlenA (lpString="*.odt") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.vob") returned 0 [0061.947] lstrlenA (lpString="*.vob") returned 5 [0061.947] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0061.948] lstrlenA (lpString="*.ifo") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0061.948] lstrlenA (lpString="*.lnk") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0061.948] lstrlenA (lpString="*.torrent") returned 9 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mov") returned 0 [0061.948] lstrlenA (lpString="*.mov") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0061.948] lstrlenA (lpString="*.m2v") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0061.948] lstrlenA (lpString="*.3gp") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0061.948] lstrlenA (lpString="*.mpeg") returned 6 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0061.948] lstrlenA (lpString="*.mpg") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.flv") returned 0 [0061.948] lstrlenA (lpString="*.flv") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.avi") returned 0 [0061.948] lstrlenA (lpString="*.avi") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0061.948] lstrlenA (lpString="*.mp4") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0061.948] lstrlenA (lpString="*.wmv") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.divx") returned 0 [0061.948] lstrlenA (lpString="*.divx") returned 6 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0061.948] lstrlenA (lpString="*.mkv") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0061.948] lstrlenA (lpString="*.mp3") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.wav") returned 0 [0061.948] lstrlenA (lpString="*.wav") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.flac") returned 0 [0061.948] lstrlenA (lpString="*.flac") returned 6 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.ape") returned 0 [0061.948] lstrlenA (lpString="*.ape") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.wma") returned 0 [0061.948] lstrlenA (lpString="*.wma") returned 5 [0061.948] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0061.949] lstrlenA (lpString="*.ac3") returned 5 [0061.949] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", pszSpec="*.doc") returned 0 [0061.949] lstrlenA (lpString="*.doc") returned 5 [0061.949] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.949] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0061.949] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1030", cAlternateFileName="")) returned 1 [0061.949] lstrcmpA (lpString1=".", lpString2="1030") returned -1 [0061.949] lstrcmpA (lpString1="..", lpString2="1030") returned -1 [0061.949] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0061.949] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1030" | out: lpString1="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0061.949] lstrlenA (lpString="C:\\588bce7c90097ed212\\1030") returned 26 [0061.949] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759f10 [0061.977] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.977] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.977] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.977] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.977] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.977] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.977] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0061.977] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0061.977] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0061.977] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1030\\*.*") returned="*.*" [0061.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0061.978] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1030\\" | out: pszPath="C:\\588bce7c90097ed212\\1030\\") returned="" [0061.978] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1030\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1030\\HOW TO DECRYPT FILES.txt" [0061.978] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1030\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\how to decrypt files.txt")) returned 0xffffffff [0061.978] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1030\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0061.980] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0061.980] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0061.981] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.981] CloseHandle (hObject=0x208) returned 1 [0061.982] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf" [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.zip") returned 0 [0061.982] lstrlenA (lpString="*.zip") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.rar") returned 0 [0061.982] lstrlenA (lpString="*.rar") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.7z") returned 0 [0061.982] lstrlenA (lpString="*.7z") returned 4 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.tar") returned 0 [0061.982] lstrlenA (lpString="*.tar") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.gzip") returned 0 [0061.982] lstrlenA (lpString="*.gzip") returned 6 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.jpg") returned 0 [0061.982] lstrlenA (lpString="*.jpg") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.jpeg") returned 0 [0061.982] lstrlenA (lpString="*.jpeg") returned 6 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.psd") returned 0 [0061.982] lstrlenA (lpString="*.psd") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.cdr") returned 0 [0061.982] lstrlenA (lpString="*.cdr") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.dwg") returned 0 [0061.982] lstrlenA (lpString="*.dwg") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.max") returned 0 [0061.982] lstrlenA (lpString="*.max") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.bmp") returned 0 [0061.982] lstrlenA (lpString="*.bmp") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.gif") returned 0 [0061.982] lstrlenA (lpString="*.gif") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.png") returned 0 [0061.982] lstrlenA (lpString="*.png") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.doc") returned 0 [0061.982] lstrlenA (lpString="*.doc") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.docx") returned 0 [0061.982] lstrlenA (lpString="*.docx") returned 6 [0061.982] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.xls") returned 0 [0061.983] lstrlenA (lpString="*.xls") returned 5 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.xlsx") returned 0 [0061.983] lstrlenA (lpString="*.xlsx") returned 6 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.ppt") returned 0 [0061.983] lstrlenA (lpString="*.ppt") returned 5 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.pptx") returned 0 [0061.983] lstrlenA (lpString="*.pptx") returned 6 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.txt") returned 0 [0061.983] lstrlenA (lpString="*.txt") returned 5 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.pdf") returned 0 [0061.983] lstrlenA (lpString="*.pdf") returned 5 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.djvu") returned 0 [0061.983] lstrlenA (lpString="*.djvu") returned 6 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.htm") returned 0 [0061.983] lstrlenA (lpString="*.htm") returned 5 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.html") returned 0 [0061.983] lstrlenA (lpString="*.html") returned 6 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mdb") returned 0 [0061.983] lstrlenA (lpString="*.mdb") returned 5 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.cer") returned 0 [0061.983] lstrlenA (lpString="*.cer") returned 5 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.p12") returned 0 [0061.983] lstrlenA (lpString="*.p12") returned 5 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.pfx") returned 0 [0061.983] lstrlenA (lpString="*.pfx") returned 5 [0061.983] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.kwm") returned 0 [0061.983] lstrlenA (lpString="*.kwm") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.pwm") returned 0 [0061.984] lstrlenA (lpString="*.pwm") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.1cd") returned 0 [0061.984] lstrlenA (lpString="*.1cd") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.md") returned 0 [0061.984] lstrlenA (lpString="*.md") returned 4 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mdf") returned 0 [0061.984] lstrlenA (lpString="*.mdf") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.dbf") returned 0 [0061.984] lstrlenA (lpString="*.dbf") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.odt") returned 0 [0061.984] lstrlenA (lpString="*.odt") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.vob") returned 0 [0061.984] lstrlenA (lpString="*.vob") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.ifo") returned 0 [0061.984] lstrlenA (lpString="*.ifo") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.lnk") returned 0 [0061.984] lstrlenA (lpString="*.lnk") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.torrent") returned 0 [0061.984] lstrlenA (lpString="*.torrent") returned 9 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mov") returned 0 [0061.984] lstrlenA (lpString="*.mov") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.m2v") returned 0 [0061.984] lstrlenA (lpString="*.m2v") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.3gp") returned 0 [0061.984] lstrlenA (lpString="*.3gp") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mpeg") returned 0 [0061.984] lstrlenA (lpString="*.mpeg") returned 6 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mpg") returned 0 [0061.984] lstrlenA (lpString="*.mpg") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.flv") returned 0 [0061.984] lstrlenA (lpString="*.flv") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.avi") returned 0 [0061.984] lstrlenA (lpString="*.avi") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mp4") returned 0 [0061.984] lstrlenA (lpString="*.mp4") returned 5 [0061.984] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.wmv") returned 0 [0061.984] lstrlenA (lpString="*.wmv") returned 5 [0061.985] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.divx") returned 0 [0061.985] lstrlenA (lpString="*.divx") returned 6 [0061.985] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mkv") returned 0 [0061.985] lstrlenA (lpString="*.mkv") returned 5 [0061.985] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.mp3") returned 0 [0061.985] lstrlenA (lpString="*.mp3") returned 5 [0061.985] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.wav") returned 0 [0061.985] lstrlenA (lpString="*.wav") returned 5 [0061.985] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.flac") returned 0 [0061.985] lstrlenA (lpString="*.flac") returned 6 [0061.985] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.ape") returned 0 [0061.985] lstrlenA (lpString="*.ape") returned 5 [0061.985] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.wma") returned 0 [0061.985] lstrlenA (lpString="*.wma") returned 5 [0061.985] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.ac3") returned 0 [0061.985] lstrlenA (lpString="*.ac3") returned 5 [0061.985] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\eula.rtf", pszSpec="*.doc") returned 0 [0061.985] lstrlenA (lpString="*.doc") returned 5 [0061.985] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.985] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0061.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0061.985] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0061.985] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned="eula.rtf" [0061.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0061.985] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1030\\" | out: pszPath="C:\\588bce7c90097ed212\\1030\\") returned="" [0061.985] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1030\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1030\\HOW TO DECRYPT FILES.txt" [0061.985] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1030\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\how to decrypt files.txt")) returned 0x20 [0061.985] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" [0061.985] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0061.986] lstrlenA (lpString="*.zip") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0061.986] lstrlenA (lpString="*.rar") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0061.986] lstrlenA (lpString="*.7z") returned 4 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0061.986] lstrlenA (lpString="*.tar") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0061.986] lstrlenA (lpString="*.gzip") returned 6 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0061.986] lstrlenA (lpString="*.jpg") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0061.986] lstrlenA (lpString="*.jpeg") returned 6 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0061.986] lstrlenA (lpString="*.psd") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0061.986] lstrlenA (lpString="*.cdr") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0061.986] lstrlenA (lpString="*.dwg") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.max") returned 0 [0061.986] lstrlenA (lpString="*.max") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0061.986] lstrlenA (lpString="*.bmp") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0061.986] lstrlenA (lpString="*.gif") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.png") returned 0 [0061.986] lstrlenA (lpString="*.png") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0061.986] lstrlenA (lpString="*.doc") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0061.986] lstrlenA (lpString="*.docx") returned 6 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0061.986] lstrlenA (lpString="*.xls") returned 5 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0061.986] lstrlenA (lpString="*.xlsx") returned 6 [0061.986] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0061.986] lstrlenA (lpString="*.ppt") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0061.987] lstrlenA (lpString="*.pptx") returned 6 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0061.987] lstrlenA (lpString="*.txt") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0061.987] lstrlenA (lpString="*.pdf") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0061.987] lstrlenA (lpString="*.djvu") returned 6 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0061.987] lstrlenA (lpString="*.htm") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.html") returned 0 [0061.987] lstrlenA (lpString="*.html") returned 6 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0061.987] lstrlenA (lpString="*.mdb") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0061.987] lstrlenA (lpString="*.cer") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0061.987] lstrlenA (lpString="*.p12") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0061.987] lstrlenA (lpString="*.pfx") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0061.987] lstrlenA (lpString="*.kwm") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0061.987] lstrlenA (lpString="*.pwm") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0061.987] lstrlenA (lpString="*.1cd") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.md") returned 0 [0061.987] lstrlenA (lpString="*.md") returned 4 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0061.987] lstrlenA (lpString="*.mdf") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0061.987] lstrlenA (lpString="*.dbf") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0061.987] lstrlenA (lpString="*.odt") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0061.987] lstrlenA (lpString="*.vob") returned 5 [0061.987] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0061.987] lstrlenA (lpString="*.ifo") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0061.988] lstrlenA (lpString="*.lnk") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0061.988] lstrlenA (lpString="*.torrent") returned 9 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0061.988] lstrlenA (lpString="*.mov") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0061.988] lstrlenA (lpString="*.m2v") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0061.988] lstrlenA (lpString="*.3gp") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0061.988] lstrlenA (lpString="*.mpeg") returned 6 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0061.988] lstrlenA (lpString="*.mpg") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0061.988] lstrlenA (lpString="*.flv") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0061.988] lstrlenA (lpString="*.avi") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0061.988] lstrlenA (lpString="*.mp4") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0061.988] lstrlenA (lpString="*.wmv") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0061.988] lstrlenA (lpString="*.divx") returned 6 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0061.988] lstrlenA (lpString="*.mkv") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0061.988] lstrlenA (lpString="*.mp3") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0061.988] lstrlenA (lpString="*.wav") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0061.988] lstrlenA (lpString="*.flac") returned 6 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0061.988] lstrlenA (lpString="*.ape") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0061.988] lstrlenA (lpString="*.wma") returned 5 [0061.988] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0061.988] lstrlenA (lpString="*.ac3") returned 5 [0061.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0061.989] lstrlenA (lpString="*.doc") returned 5 [0061.989] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.989] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.989] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0061.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0061.989] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0061.989] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned="LocalizedData.xml" [0061.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0061.989] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1030\\" | out: pszPath="C:\\588bce7c90097ed212\\1030\\") returned="" [0061.989] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1030\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1030\\HOW TO DECRYPT FILES.txt" [0061.989] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1030\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\how to decrypt files.txt")) returned 0x20 [0061.989] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" [0061.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.zip") returned 0 [0061.989] lstrlenA (lpString="*.zip") returned 5 [0061.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.rar") returned 0 [0061.989] lstrlenA (lpString="*.rar") returned 5 [0061.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.7z") returned 0 [0061.989] lstrlenA (lpString="*.7z") returned 4 [0061.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.tar") returned 0 [0061.989] lstrlenA (lpString="*.tar") returned 5 [0061.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0061.989] lstrlenA (lpString="*.gzip") returned 6 [0061.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0061.989] lstrlenA (lpString="*.jpg") returned 5 [0061.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0061.989] lstrlenA (lpString="*.jpeg") returned 6 [0061.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.psd") returned 0 [0061.989] lstrlenA (lpString="*.psd") returned 5 [0061.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0061.989] lstrlenA (lpString="*.cdr") returned 5 [0061.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0061.989] lstrlenA (lpString="*.dwg") returned 5 [0061.989] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.max") returned 0 [0061.990] lstrlenA (lpString="*.max") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0061.990] lstrlenA (lpString="*.bmp") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.gif") returned 0 [0061.990] lstrlenA (lpString="*.gif") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.png") returned 0 [0061.990] lstrlenA (lpString="*.png") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.doc") returned 0 [0061.990] lstrlenA (lpString="*.doc") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.docx") returned 0 [0061.990] lstrlenA (lpString="*.docx") returned 6 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.xls") returned 0 [0061.990] lstrlenA (lpString="*.xls") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0061.990] lstrlenA (lpString="*.xlsx") returned 6 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0061.990] lstrlenA (lpString="*.ppt") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0061.990] lstrlenA (lpString="*.pptx") returned 6 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.txt") returned 0 [0061.990] lstrlenA (lpString="*.txt") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0061.990] lstrlenA (lpString="*.pdf") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0061.990] lstrlenA (lpString="*.djvu") returned 6 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.htm") returned 0 [0061.990] lstrlenA (lpString="*.htm") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.html") returned 0 [0061.990] lstrlenA (lpString="*.html") returned 6 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0061.990] lstrlenA (lpString="*.mdb") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.cer") returned 0 [0061.990] lstrlenA (lpString="*.cer") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.p12") returned 0 [0061.990] lstrlenA (lpString="*.p12") returned 5 [0061.990] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0061.990] lstrlenA (lpString="*.pfx") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0061.991] lstrlenA (lpString="*.kwm") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0061.991] lstrlenA (lpString="*.pwm") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0061.991] lstrlenA (lpString="*.1cd") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.md") returned 0 [0061.991] lstrlenA (lpString="*.md") returned 4 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0061.991] lstrlenA (lpString="*.mdf") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0061.991] lstrlenA (lpString="*.dbf") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.odt") returned 0 [0061.991] lstrlenA (lpString="*.odt") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.vob") returned 0 [0061.991] lstrlenA (lpString="*.vob") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0061.991] lstrlenA (lpString="*.ifo") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0061.991] lstrlenA (lpString="*.lnk") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0061.991] lstrlenA (lpString="*.torrent") returned 9 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mov") returned 0 [0061.991] lstrlenA (lpString="*.mov") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0061.991] lstrlenA (lpString="*.m2v") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0061.991] lstrlenA (lpString="*.3gp") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0061.991] lstrlenA (lpString="*.mpeg") returned 6 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0061.991] lstrlenA (lpString="*.mpg") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.flv") returned 0 [0061.991] lstrlenA (lpString="*.flv") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.avi") returned 0 [0061.991] lstrlenA (lpString="*.avi") returned 5 [0061.991] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0061.991] lstrlenA (lpString="*.mp4") returned 5 [0061.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0061.992] lstrlenA (lpString="*.wmv") returned 5 [0061.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.divx") returned 0 [0061.992] lstrlenA (lpString="*.divx") returned 6 [0061.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0061.992] lstrlenA (lpString="*.mkv") returned 5 [0061.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0061.992] lstrlenA (lpString="*.mp3") returned 5 [0061.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.wav") returned 0 [0061.992] lstrlenA (lpString="*.wav") returned 5 [0061.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.flac") returned 0 [0061.992] lstrlenA (lpString="*.flac") returned 6 [0061.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.ape") returned 0 [0061.992] lstrlenA (lpString="*.ape") returned 5 [0061.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.wma") returned 0 [0061.992] lstrlenA (lpString="*.wma") returned 5 [0061.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0061.992] lstrlenA (lpString="*.ac3") returned 5 [0061.992] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", pszSpec="*.doc") returned 0 [0061.992] lstrlenA (lpString="*.doc") returned 5 [0061.992] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.992] FindClose (in: hFindFile=0x759f10 | out: hFindFile=0x759f10) returned 1 [0061.992] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1031", cAlternateFileName="")) returned 1 [0061.992] lstrcmpA (lpString1=".", lpString2="1031") returned -1 [0061.992] lstrcmpA (lpString1="..", lpString2="1031") returned -1 [0061.992] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0061.992] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1031" | out: lpString1="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0061.992] lstrlenA (lpString="C:\\588bce7c90097ed212\\1031") returned 26 [0061.992] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759f50 [0061.993] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.993] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.993] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.993] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.993] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.993] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0061.993] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0061.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0061.994] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0061.994] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1031\\*.*") returned="*.*" [0061.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1031\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0061.994] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1031\\" | out: pszPath="C:\\588bce7c90097ed212\\1031\\") returned="" [0061.994] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1031\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1031\\HOW TO DECRYPT FILES.txt" [0061.994] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1031\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\how to decrypt files.txt")) returned 0xffffffff [0061.994] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1031\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0061.995] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0061.995] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0061.996] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.997] CloseHandle (hObject=0x208) returned 1 [0061.997] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf" [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.zip") returned 0 [0061.997] lstrlenA (lpString="*.zip") returned 5 [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.rar") returned 0 [0061.997] lstrlenA (lpString="*.rar") returned 5 [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.7z") returned 0 [0061.997] lstrlenA (lpString="*.7z") returned 4 [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.tar") returned 0 [0061.997] lstrlenA (lpString="*.tar") returned 5 [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.gzip") returned 0 [0061.997] lstrlenA (lpString="*.gzip") returned 6 [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.jpg") returned 0 [0061.997] lstrlenA (lpString="*.jpg") returned 5 [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.jpeg") returned 0 [0061.997] lstrlenA (lpString="*.jpeg") returned 6 [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.psd") returned 0 [0061.997] lstrlenA (lpString="*.psd") returned 5 [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.cdr") returned 0 [0061.997] lstrlenA (lpString="*.cdr") returned 5 [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.dwg") returned 0 [0061.997] lstrlenA (lpString="*.dwg") returned 5 [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.max") returned 0 [0061.997] lstrlenA (lpString="*.max") returned 5 [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.bmp") returned 0 [0061.997] lstrlenA (lpString="*.bmp") returned 5 [0061.997] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.gif") returned 0 [0061.997] lstrlenA (lpString="*.gif") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.png") returned 0 [0061.998] lstrlenA (lpString="*.png") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.doc") returned 0 [0061.998] lstrlenA (lpString="*.doc") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.docx") returned 0 [0061.998] lstrlenA (lpString="*.docx") returned 6 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.xls") returned 0 [0061.998] lstrlenA (lpString="*.xls") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.xlsx") returned 0 [0061.998] lstrlenA (lpString="*.xlsx") returned 6 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.ppt") returned 0 [0061.998] lstrlenA (lpString="*.ppt") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.pptx") returned 0 [0061.998] lstrlenA (lpString="*.pptx") returned 6 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.txt") returned 0 [0061.998] lstrlenA (lpString="*.txt") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.pdf") returned 0 [0061.998] lstrlenA (lpString="*.pdf") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.djvu") returned 0 [0061.998] lstrlenA (lpString="*.djvu") returned 6 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.htm") returned 0 [0061.998] lstrlenA (lpString="*.htm") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.html") returned 0 [0061.998] lstrlenA (lpString="*.html") returned 6 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mdb") returned 0 [0061.998] lstrlenA (lpString="*.mdb") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.cer") returned 0 [0061.998] lstrlenA (lpString="*.cer") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.p12") returned 0 [0061.998] lstrlenA (lpString="*.p12") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.pfx") returned 0 [0061.998] lstrlenA (lpString="*.pfx") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.kwm") returned 0 [0061.998] lstrlenA (lpString="*.kwm") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.pwm") returned 0 [0061.998] lstrlenA (lpString="*.pwm") returned 5 [0061.998] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.1cd") returned 0 [0061.998] lstrlenA (lpString="*.1cd") returned 5 [0061.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.md") returned 0 [0061.999] lstrlenA (lpString="*.md") returned 4 [0061.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mdf") returned 0 [0061.999] lstrlenA (lpString="*.mdf") returned 5 [0061.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.dbf") returned 0 [0061.999] lstrlenA (lpString="*.dbf") returned 5 [0061.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.odt") returned 0 [0061.999] lstrlenA (lpString="*.odt") returned 5 [0061.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.vob") returned 0 [0061.999] lstrlenA (lpString="*.vob") returned 5 [0061.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.ifo") returned 0 [0061.999] lstrlenA (lpString="*.ifo") returned 5 [0061.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.lnk") returned 0 [0061.999] lstrlenA (lpString="*.lnk") returned 5 [0061.999] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.000] lstrlenA (lpString="*.torrent") returned 9 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mov") returned 0 [0062.000] lstrlenA (lpString="*.mov") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.000] lstrlenA (lpString="*.m2v") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.000] lstrlenA (lpString="*.3gp") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.000] lstrlenA (lpString="*.mpeg") returned 6 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.000] lstrlenA (lpString="*.mpg") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.flv") returned 0 [0062.000] lstrlenA (lpString="*.flv") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.avi") returned 0 [0062.000] lstrlenA (lpString="*.avi") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.000] lstrlenA (lpString="*.mp4") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.000] lstrlenA (lpString="*.wmv") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.divx") returned 0 [0062.000] lstrlenA (lpString="*.divx") returned 6 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.000] lstrlenA (lpString="*.mkv") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.000] lstrlenA (lpString="*.mp3") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.wav") returned 0 [0062.000] lstrlenA (lpString="*.wav") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.flac") returned 0 [0062.000] lstrlenA (lpString="*.flac") returned 6 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.ape") returned 0 [0062.000] lstrlenA (lpString="*.ape") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.wma") returned 0 [0062.000] lstrlenA (lpString="*.wma") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.000] lstrlenA (lpString="*.ac3") returned 5 [0062.000] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\eula.rtf", pszSpec="*.doc") returned 0 [0062.000] lstrlenA (lpString="*.doc") returned 5 [0062.000] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.001] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.001] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.001] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned="eula.rtf" [0062.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1031\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0062.001] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1031\\" | out: pszPath="C:\\588bce7c90097ed212\\1031\\") returned="" [0062.001] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1031\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1031\\HOW TO DECRYPT FILES.txt" [0062.001] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1031\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\how to decrypt files.txt")) returned 0x20 [0062.001] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" [0062.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.001] lstrlenA (lpString="*.zip") returned 5 [0062.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.001] lstrlenA (lpString="*.rar") returned 5 [0062.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.001] lstrlenA (lpString="*.7z") returned 4 [0062.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.001] lstrlenA (lpString="*.tar") returned 5 [0062.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.001] lstrlenA (lpString="*.gzip") returned 6 [0062.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.001] lstrlenA (lpString="*.jpg") returned 5 [0062.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.001] lstrlenA (lpString="*.jpeg") returned 6 [0062.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.001] lstrlenA (lpString="*.psd") returned 5 [0062.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.001] lstrlenA (lpString="*.cdr") returned 5 [0062.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.001] lstrlenA (lpString="*.dwg") returned 5 [0062.001] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.001] lstrlenA (lpString="*.max") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.002] lstrlenA (lpString="*.bmp") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.002] lstrlenA (lpString="*.gif") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.002] lstrlenA (lpString="*.png") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.002] lstrlenA (lpString="*.doc") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.002] lstrlenA (lpString="*.docx") returned 6 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.002] lstrlenA (lpString="*.xls") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.002] lstrlenA (lpString="*.xlsx") returned 6 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.002] lstrlenA (lpString="*.ppt") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.002] lstrlenA (lpString="*.pptx") returned 6 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.002] lstrlenA (lpString="*.txt") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.002] lstrlenA (lpString="*.pdf") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.002] lstrlenA (lpString="*.djvu") returned 6 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.002] lstrlenA (lpString="*.htm") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.002] lstrlenA (lpString="*.html") returned 6 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.002] lstrlenA (lpString="*.mdb") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.002] lstrlenA (lpString="*.cer") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.002] lstrlenA (lpString="*.p12") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.002] lstrlenA (lpString="*.pfx") returned 5 [0062.002] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.003] lstrlenA (lpString="*.kwm") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.003] lstrlenA (lpString="*.pwm") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.003] lstrlenA (lpString="*.1cd") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.003] lstrlenA (lpString="*.md") returned 4 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.003] lstrlenA (lpString="*.mdf") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.003] lstrlenA (lpString="*.dbf") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.003] lstrlenA (lpString="*.odt") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.003] lstrlenA (lpString="*.vob") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.003] lstrlenA (lpString="*.ifo") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.003] lstrlenA (lpString="*.lnk") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.003] lstrlenA (lpString="*.torrent") returned 9 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.003] lstrlenA (lpString="*.mov") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.003] lstrlenA (lpString="*.m2v") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.003] lstrlenA (lpString="*.3gp") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.003] lstrlenA (lpString="*.mpeg") returned 6 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.003] lstrlenA (lpString="*.mpg") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.003] lstrlenA (lpString="*.flv") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.003] lstrlenA (lpString="*.avi") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.003] lstrlenA (lpString="*.mp4") returned 5 [0062.004] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.004] lstrlenA (lpString="*.wmv") returned 5 [0062.004] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.004] lstrlenA (lpString="*.divx") returned 6 [0062.004] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.004] lstrlenA (lpString="*.mkv") returned 5 [0062.004] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.004] lstrlenA (lpString="*.mp3") returned 5 [0062.004] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.004] lstrlenA (lpString="*.wav") returned 5 [0062.004] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.004] lstrlenA (lpString="*.flac") returned 6 [0062.004] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.004] lstrlenA (lpString="*.ape") returned 5 [0062.004] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.004] lstrlenA (lpString="*.wma") returned 5 [0062.004] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.004] lstrlenA (lpString="*.ac3") returned 5 [0062.004] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.004] lstrlenA (lpString="*.doc") returned 5 [0062.004] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.004] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.004] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.004] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.004] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned="LocalizedData.xml" [0062.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1031\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0062.004] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1031\\" | out: pszPath="C:\\588bce7c90097ed212\\1031\\") returned="" [0062.004] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1031\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1031\\HOW TO DECRYPT FILES.txt" [0062.004] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1031\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\how to decrypt files.txt")) returned 0x20 [0062.004] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" [0062.004] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.004] lstrlenA (lpString="*.zip") returned 5 [0062.004] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.005] lstrlenA (lpString="*.rar") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.005] lstrlenA (lpString="*.7z") returned 4 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.005] lstrlenA (lpString="*.tar") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.005] lstrlenA (lpString="*.gzip") returned 6 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.005] lstrlenA (lpString="*.jpg") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.005] lstrlenA (lpString="*.jpeg") returned 6 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.005] lstrlenA (lpString="*.psd") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.005] lstrlenA (lpString="*.cdr") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.005] lstrlenA (lpString="*.dwg") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.005] lstrlenA (lpString="*.max") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.005] lstrlenA (lpString="*.bmp") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.005] lstrlenA (lpString="*.gif") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.005] lstrlenA (lpString="*.png") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.005] lstrlenA (lpString="*.doc") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.005] lstrlenA (lpString="*.docx") returned 6 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.005] lstrlenA (lpString="*.xls") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.005] lstrlenA (lpString="*.xlsx") returned 6 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.005] lstrlenA (lpString="*.ppt") returned 5 [0062.005] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.005] lstrlenA (lpString="*.pptx") returned 6 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.006] lstrlenA (lpString="*.txt") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.006] lstrlenA (lpString="*.pdf") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.006] lstrlenA (lpString="*.djvu") returned 6 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.006] lstrlenA (lpString="*.htm") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.006] lstrlenA (lpString="*.html") returned 6 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.006] lstrlenA (lpString="*.mdb") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.006] lstrlenA (lpString="*.cer") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.006] lstrlenA (lpString="*.p12") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.006] lstrlenA (lpString="*.pfx") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.006] lstrlenA (lpString="*.kwm") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.006] lstrlenA (lpString="*.pwm") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.006] lstrlenA (lpString="*.1cd") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.006] lstrlenA (lpString="*.md") returned 4 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.006] lstrlenA (lpString="*.mdf") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.006] lstrlenA (lpString="*.dbf") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.006] lstrlenA (lpString="*.odt") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.006] lstrlenA (lpString="*.vob") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.006] lstrlenA (lpString="*.ifo") returned 5 [0062.006] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.007] lstrlenA (lpString="*.lnk") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.007] lstrlenA (lpString="*.torrent") returned 9 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.007] lstrlenA (lpString="*.mov") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.007] lstrlenA (lpString="*.m2v") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.007] lstrlenA (lpString="*.3gp") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.007] lstrlenA (lpString="*.mpeg") returned 6 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.007] lstrlenA (lpString="*.mpg") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.007] lstrlenA (lpString="*.flv") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.007] lstrlenA (lpString="*.avi") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.007] lstrlenA (lpString="*.mp4") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.007] lstrlenA (lpString="*.wmv") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.007] lstrlenA (lpString="*.divx") returned 6 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.007] lstrlenA (lpString="*.mkv") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.007] lstrlenA (lpString="*.mp3") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.007] lstrlenA (lpString="*.wav") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.007] lstrlenA (lpString="*.flac") returned 6 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.007] lstrlenA (lpString="*.ape") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.007] lstrlenA (lpString="*.wma") returned 5 [0062.007] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.007] lstrlenA (lpString="*.ac3") returned 5 [0062.008] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.008] lstrlenA (lpString="*.doc") returned 5 [0062.008] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.008] FindClose (in: hFindFile=0x759f50 | out: hFindFile=0x759f50) returned 1 [0062.008] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1032", cAlternateFileName="")) returned 1 [0062.008] lstrcmpA (lpString1=".", lpString2="1032") returned -1 [0062.008] lstrcmpA (lpString1="..", lpString2="1032") returned -1 [0062.008] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.008] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1032" | out: lpString1="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0062.008] lstrlenA (lpString="C:\\588bce7c90097ed212\\1032") returned 26 [0062.008] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0062.009] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.009] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.009] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.009] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.009] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.009] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.009] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.009] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1032\\*.*") returned="*.*" [0062.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1032\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0062.009] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1032\\" | out: pszPath="C:\\588bce7c90097ed212\\1032\\") returned="" [0062.009] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1032\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1032\\HOW TO DECRYPT FILES.txt" [0062.009] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1032\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\how to decrypt files.txt")) returned 0xffffffff [0062.009] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1032\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.038] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.038] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.039] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.039] CloseHandle (hObject=0x208) returned 1 [0062.040] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf" [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.zip") returned 0 [0062.040] lstrlenA (lpString="*.zip") returned 5 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.rar") returned 0 [0062.040] lstrlenA (lpString="*.rar") returned 5 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.7z") returned 0 [0062.040] lstrlenA (lpString="*.7z") returned 4 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.tar") returned 0 [0062.040] lstrlenA (lpString="*.tar") returned 5 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.040] lstrlenA (lpString="*.gzip") returned 6 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.040] lstrlenA (lpString="*.jpg") returned 5 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.040] lstrlenA (lpString="*.jpeg") returned 6 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.psd") returned 0 [0062.040] lstrlenA (lpString="*.psd") returned 5 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.040] lstrlenA (lpString="*.cdr") returned 5 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.040] lstrlenA (lpString="*.dwg") returned 5 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.max") returned 0 [0062.040] lstrlenA (lpString="*.max") returned 5 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.040] lstrlenA (lpString="*.bmp") returned 5 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.gif") returned 0 [0062.040] lstrlenA (lpString="*.gif") returned 5 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.png") returned 0 [0062.040] lstrlenA (lpString="*.png") returned 5 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.doc") returned 0 [0062.040] lstrlenA (lpString="*.doc") returned 5 [0062.040] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.docx") returned 0 [0062.040] lstrlenA (lpString="*.docx") returned 6 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.xls") returned 0 [0062.041] lstrlenA (lpString="*.xls") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.041] lstrlenA (lpString="*.xlsx") returned 6 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.041] lstrlenA (lpString="*.ppt") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.041] lstrlenA (lpString="*.pptx") returned 6 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.txt") returned 0 [0062.041] lstrlenA (lpString="*.txt") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.041] lstrlenA (lpString="*.pdf") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.041] lstrlenA (lpString="*.djvu") returned 6 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.htm") returned 0 [0062.041] lstrlenA (lpString="*.htm") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.html") returned 0 [0062.041] lstrlenA (lpString="*.html") returned 6 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.041] lstrlenA (lpString="*.mdb") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.cer") returned 0 [0062.041] lstrlenA (lpString="*.cer") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.p12") returned 0 [0062.041] lstrlenA (lpString="*.p12") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.041] lstrlenA (lpString="*.pfx") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.041] lstrlenA (lpString="*.kwm") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.041] lstrlenA (lpString="*.pwm") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.041] lstrlenA (lpString="*.1cd") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.md") returned 0 [0062.041] lstrlenA (lpString="*.md") returned 4 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.041] lstrlenA (lpString="*.mdf") returned 5 [0062.041] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.042] lstrlenA (lpString="*.dbf") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.odt") returned 0 [0062.042] lstrlenA (lpString="*.odt") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.vob") returned 0 [0062.042] lstrlenA (lpString="*.vob") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.042] lstrlenA (lpString="*.ifo") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.042] lstrlenA (lpString="*.lnk") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.042] lstrlenA (lpString="*.torrent") returned 9 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mov") returned 0 [0062.042] lstrlenA (lpString="*.mov") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.042] lstrlenA (lpString="*.m2v") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.042] lstrlenA (lpString="*.3gp") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.042] lstrlenA (lpString="*.mpeg") returned 6 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.042] lstrlenA (lpString="*.mpg") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.flv") returned 0 [0062.042] lstrlenA (lpString="*.flv") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.avi") returned 0 [0062.042] lstrlenA (lpString="*.avi") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.042] lstrlenA (lpString="*.mp4") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.042] lstrlenA (lpString="*.wmv") returned 5 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.divx") returned 0 [0062.042] lstrlenA (lpString="*.divx") returned 6 [0062.042] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.042] lstrlenA (lpString="*.mkv") returned 5 [0062.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.043] lstrlenA (lpString="*.mp3") returned 5 [0062.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.wav") returned 0 [0062.043] lstrlenA (lpString="*.wav") returned 5 [0062.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.flac") returned 0 [0062.043] lstrlenA (lpString="*.flac") returned 6 [0062.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.ape") returned 0 [0062.043] lstrlenA (lpString="*.ape") returned 5 [0062.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.wma") returned 0 [0062.043] lstrlenA (lpString="*.wma") returned 5 [0062.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.043] lstrlenA (lpString="*.ac3") returned 5 [0062.043] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\eula.rtf", pszSpec="*.doc") returned 0 [0062.043] lstrlenA (lpString="*.doc") returned 5 [0062.043] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.043] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.043] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.043] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.043] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned="eula.rtf" [0062.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1032\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0062.043] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1032\\" | out: pszPath="C:\\588bce7c90097ed212\\1032\\") returned="" [0062.043] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1032\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1032\\HOW TO DECRYPT FILES.txt" [0062.043] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1032\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\how to decrypt files.txt")) returned 0x20 [0062.043] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.044] lstrlenA (lpString="*.zip") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.044] lstrlenA (lpString="*.rar") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.044] lstrlenA (lpString="*.7z") returned 4 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.044] lstrlenA (lpString="*.tar") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.044] lstrlenA (lpString="*.gzip") returned 6 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.044] lstrlenA (lpString="*.jpg") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.044] lstrlenA (lpString="*.jpeg") returned 6 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.044] lstrlenA (lpString="*.psd") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.044] lstrlenA (lpString="*.cdr") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.044] lstrlenA (lpString="*.dwg") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.044] lstrlenA (lpString="*.max") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.044] lstrlenA (lpString="*.bmp") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.044] lstrlenA (lpString="*.gif") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.044] lstrlenA (lpString="*.png") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.044] lstrlenA (lpString="*.doc") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.045] lstrlenA (lpString="*.docx") returned 6 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.045] lstrlenA (lpString="*.xls") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.045] lstrlenA (lpString="*.xlsx") returned 6 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.045] lstrlenA (lpString="*.ppt") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.045] lstrlenA (lpString="*.pptx") returned 6 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.045] lstrlenA (lpString="*.txt") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.045] lstrlenA (lpString="*.pdf") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.045] lstrlenA (lpString="*.djvu") returned 6 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.045] lstrlenA (lpString="*.htm") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.045] lstrlenA (lpString="*.html") returned 6 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.045] lstrlenA (lpString="*.mdb") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.045] lstrlenA (lpString="*.cer") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.045] lstrlenA (lpString="*.p12") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.045] lstrlenA (lpString="*.pfx") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.045] lstrlenA (lpString="*.kwm") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.045] lstrlenA (lpString="*.pwm") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.045] lstrlenA (lpString="*.1cd") returned 5 [0062.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.047] lstrlenA (lpString="*.md") returned 4 [0062.047] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.047] lstrlenA (lpString="*.mdf") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.048] lstrlenA (lpString="*.dbf") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.048] lstrlenA (lpString="*.odt") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.048] lstrlenA (lpString="*.vob") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.048] lstrlenA (lpString="*.ifo") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.048] lstrlenA (lpString="*.lnk") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.048] lstrlenA (lpString="*.torrent") returned 9 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.048] lstrlenA (lpString="*.mov") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.048] lstrlenA (lpString="*.m2v") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.048] lstrlenA (lpString="*.3gp") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.048] lstrlenA (lpString="*.mpeg") returned 6 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.048] lstrlenA (lpString="*.mpg") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.048] lstrlenA (lpString="*.flv") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.048] lstrlenA (lpString="*.avi") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.048] lstrlenA (lpString="*.mp4") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.048] lstrlenA (lpString="*.wmv") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.048] lstrlenA (lpString="*.divx") returned 6 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.048] lstrlenA (lpString="*.mkv") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.048] lstrlenA (lpString="*.mp3") returned 5 [0062.048] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.048] lstrlenA (lpString="*.wav") returned 5 [0062.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.049] lstrlenA (lpString="*.flac") returned 6 [0062.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.049] lstrlenA (lpString="*.ape") returned 5 [0062.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.049] lstrlenA (lpString="*.wma") returned 5 [0062.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.049] lstrlenA (lpString="*.ac3") returned 5 [0062.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.049] lstrlenA (lpString="*.doc") returned 5 [0062.049] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.049] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.049] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.049] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.049] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned="LocalizedData.xml" [0062.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1032\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0062.049] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1032\\" | out: pszPath="C:\\588bce7c90097ed212\\1032\\") returned="" [0062.049] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1032\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1032\\HOW TO DECRYPT FILES.txt" [0062.049] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1032\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\how to decrypt files.txt")) returned 0x20 [0062.049] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" [0062.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.049] lstrlenA (lpString="*.zip") returned 5 [0062.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.049] lstrlenA (lpString="*.rar") returned 5 [0062.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.049] lstrlenA (lpString="*.7z") returned 4 [0062.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.049] lstrlenA (lpString="*.tar") returned 5 [0062.049] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.050] lstrlenA (lpString="*.gzip") returned 6 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.050] lstrlenA (lpString="*.jpg") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.050] lstrlenA (lpString="*.jpeg") returned 6 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.050] lstrlenA (lpString="*.psd") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.050] lstrlenA (lpString="*.cdr") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.050] lstrlenA (lpString="*.dwg") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.050] lstrlenA (lpString="*.max") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.050] lstrlenA (lpString="*.bmp") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.050] lstrlenA (lpString="*.gif") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.050] lstrlenA (lpString="*.png") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.050] lstrlenA (lpString="*.doc") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.050] lstrlenA (lpString="*.docx") returned 6 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.050] lstrlenA (lpString="*.xls") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.050] lstrlenA (lpString="*.xlsx") returned 6 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.050] lstrlenA (lpString="*.ppt") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.050] lstrlenA (lpString="*.pptx") returned 6 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.050] lstrlenA (lpString="*.txt") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.050] lstrlenA (lpString="*.pdf") returned 5 [0062.050] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.050] lstrlenA (lpString="*.djvu") returned 6 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.051] lstrlenA (lpString="*.htm") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.051] lstrlenA (lpString="*.html") returned 6 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.051] lstrlenA (lpString="*.mdb") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.051] lstrlenA (lpString="*.cer") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.051] lstrlenA (lpString="*.p12") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.051] lstrlenA (lpString="*.pfx") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.051] lstrlenA (lpString="*.kwm") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.051] lstrlenA (lpString="*.pwm") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.051] lstrlenA (lpString="*.1cd") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.051] lstrlenA (lpString="*.md") returned 4 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.051] lstrlenA (lpString="*.mdf") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.051] lstrlenA (lpString="*.dbf") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.051] lstrlenA (lpString="*.odt") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.051] lstrlenA (lpString="*.vob") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.051] lstrlenA (lpString="*.ifo") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.051] lstrlenA (lpString="*.lnk") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.051] lstrlenA (lpString="*.torrent") returned 9 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.051] lstrlenA (lpString="*.mov") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.052] lstrlenA (lpString="*.m2v") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.052] lstrlenA (lpString="*.3gp") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.052] lstrlenA (lpString="*.mpeg") returned 6 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.052] lstrlenA (lpString="*.mpg") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.052] lstrlenA (lpString="*.flv") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.052] lstrlenA (lpString="*.avi") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.052] lstrlenA (lpString="*.mp4") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.052] lstrlenA (lpString="*.wmv") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.052] lstrlenA (lpString="*.divx") returned 6 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.052] lstrlenA (lpString="*.mkv") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.052] lstrlenA (lpString="*.mp3") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.052] lstrlenA (lpString="*.wav") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.052] lstrlenA (lpString="*.flac") returned 6 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.052] lstrlenA (lpString="*.ape") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.052] lstrlenA (lpString="*.wma") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.052] lstrlenA (lpString="*.ac3") returned 5 [0062.052] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.052] lstrlenA (lpString="*.doc") returned 5 [0062.052] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.052] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0062.053] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1033", cAlternateFileName="")) returned 1 [0062.053] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0062.053] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0062.053] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.053] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1033" | out: lpString1="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0062.053] lstrlenA (lpString="C:\\588bce7c90097ed212\\1033") returned 26 [0062.053] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0062.054] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.054] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.054] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.054] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.054] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.054] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.054] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.054] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.054] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.054] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1033\\*.*") returned="*.*" [0062.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1033\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0062.054] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1033\\" | out: pszPath="C:\\588bce7c90097ed212\\1033\\") returned="" [0062.054] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1033\\HOW TO DECRYPT FILES.txt" [0062.054] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\how to decrypt files.txt")) returned 0xffffffff [0062.054] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.057] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.057] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.058] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.058] CloseHandle (hObject=0x208) returned 1 [0062.059] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf" [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.zip") returned 0 [0062.059] lstrlenA (lpString="*.zip") returned 5 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.rar") returned 0 [0062.059] lstrlenA (lpString="*.rar") returned 5 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.7z") returned 0 [0062.059] lstrlenA (lpString="*.7z") returned 4 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.tar") returned 0 [0062.059] lstrlenA (lpString="*.tar") returned 5 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.059] lstrlenA (lpString="*.gzip") returned 6 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.059] lstrlenA (lpString="*.jpg") returned 5 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.059] lstrlenA (lpString="*.jpeg") returned 6 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.psd") returned 0 [0062.059] lstrlenA (lpString="*.psd") returned 5 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.059] lstrlenA (lpString="*.cdr") returned 5 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.059] lstrlenA (lpString="*.dwg") returned 5 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.max") returned 0 [0062.059] lstrlenA (lpString="*.max") returned 5 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.059] lstrlenA (lpString="*.bmp") returned 5 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.gif") returned 0 [0062.059] lstrlenA (lpString="*.gif") returned 5 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.png") returned 0 [0062.059] lstrlenA (lpString="*.png") returned 5 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.doc") returned 0 [0062.059] lstrlenA (lpString="*.doc") returned 5 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.docx") returned 0 [0062.059] lstrlenA (lpString="*.docx") returned 6 [0062.059] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.xls") returned 0 [0062.060] lstrlenA (lpString="*.xls") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.060] lstrlenA (lpString="*.xlsx") returned 6 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.060] lstrlenA (lpString="*.ppt") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.060] lstrlenA (lpString="*.pptx") returned 6 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.txt") returned 0 [0062.060] lstrlenA (lpString="*.txt") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.060] lstrlenA (lpString="*.pdf") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.060] lstrlenA (lpString="*.djvu") returned 6 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.htm") returned 0 [0062.060] lstrlenA (lpString="*.htm") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.html") returned 0 [0062.060] lstrlenA (lpString="*.html") returned 6 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.060] lstrlenA (lpString="*.mdb") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.cer") returned 0 [0062.060] lstrlenA (lpString="*.cer") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.p12") returned 0 [0062.060] lstrlenA (lpString="*.p12") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.060] lstrlenA (lpString="*.pfx") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.060] lstrlenA (lpString="*.kwm") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.060] lstrlenA (lpString="*.pwm") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.060] lstrlenA (lpString="*.1cd") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.md") returned 0 [0062.060] lstrlenA (lpString="*.md") returned 4 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.060] lstrlenA (lpString="*.mdf") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.060] lstrlenA (lpString="*.dbf") returned 5 [0062.060] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.odt") returned 0 [0062.061] lstrlenA (lpString="*.odt") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.vob") returned 0 [0062.061] lstrlenA (lpString="*.vob") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.061] lstrlenA (lpString="*.ifo") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.061] lstrlenA (lpString="*.lnk") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.061] lstrlenA (lpString="*.torrent") returned 9 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mov") returned 0 [0062.061] lstrlenA (lpString="*.mov") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.061] lstrlenA (lpString="*.m2v") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.061] lstrlenA (lpString="*.3gp") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.061] lstrlenA (lpString="*.mpeg") returned 6 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.061] lstrlenA (lpString="*.mpg") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.flv") returned 0 [0062.061] lstrlenA (lpString="*.flv") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.avi") returned 0 [0062.061] lstrlenA (lpString="*.avi") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.061] lstrlenA (lpString="*.mp4") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.061] lstrlenA (lpString="*.wmv") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.divx") returned 0 [0062.061] lstrlenA (lpString="*.divx") returned 6 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.061] lstrlenA (lpString="*.mkv") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.061] lstrlenA (lpString="*.mp3") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.wav") returned 0 [0062.061] lstrlenA (lpString="*.wav") returned 5 [0062.061] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.flac") returned 0 [0062.061] lstrlenA (lpString="*.flac") returned 6 [0062.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.ape") returned 0 [0062.062] lstrlenA (lpString="*.ape") returned 5 [0062.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.wma") returned 0 [0062.062] lstrlenA (lpString="*.wma") returned 5 [0062.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.062] lstrlenA (lpString="*.ac3") returned 5 [0062.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\eula.rtf", pszSpec="*.doc") returned 0 [0062.062] lstrlenA (lpString="*.doc") returned 5 [0062.062] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.062] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.062] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.062] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned="eula.rtf" [0062.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1033\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0062.062] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1033\\" | out: pszPath="C:\\588bce7c90097ed212\\1033\\") returned="" [0062.062] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1033\\HOW TO DECRYPT FILES.txt" [0062.062] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\how to decrypt files.txt")) returned 0x20 [0062.062] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" [0062.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.062] lstrlenA (lpString="*.zip") returned 5 [0062.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.062] lstrlenA (lpString="*.rar") returned 5 [0062.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.062] lstrlenA (lpString="*.7z") returned 4 [0062.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.062] lstrlenA (lpString="*.tar") returned 5 [0062.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.062] lstrlenA (lpString="*.gzip") returned 6 [0062.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.062] lstrlenA (lpString="*.jpg") returned 5 [0062.062] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.063] lstrlenA (lpString="*.jpeg") returned 6 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.063] lstrlenA (lpString="*.psd") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.063] lstrlenA (lpString="*.cdr") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.063] lstrlenA (lpString="*.dwg") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.063] lstrlenA (lpString="*.max") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.063] lstrlenA (lpString="*.bmp") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.063] lstrlenA (lpString="*.gif") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.063] lstrlenA (lpString="*.png") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.063] lstrlenA (lpString="*.doc") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.063] lstrlenA (lpString="*.docx") returned 6 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.063] lstrlenA (lpString="*.xls") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.063] lstrlenA (lpString="*.xlsx") returned 6 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.063] lstrlenA (lpString="*.ppt") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.063] lstrlenA (lpString="*.pptx") returned 6 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.063] lstrlenA (lpString="*.txt") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.063] lstrlenA (lpString="*.pdf") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.063] lstrlenA (lpString="*.djvu") returned 6 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.065] lstrlenA (lpString="*.htm") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.065] lstrlenA (lpString="*.html") returned 6 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.065] lstrlenA (lpString="*.mdb") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.065] lstrlenA (lpString="*.cer") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.065] lstrlenA (lpString="*.p12") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.065] lstrlenA (lpString="*.pfx") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.065] lstrlenA (lpString="*.kwm") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.065] lstrlenA (lpString="*.pwm") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.065] lstrlenA (lpString="*.1cd") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.065] lstrlenA (lpString="*.md") returned 4 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.065] lstrlenA (lpString="*.mdf") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.065] lstrlenA (lpString="*.dbf") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.065] lstrlenA (lpString="*.odt") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.065] lstrlenA (lpString="*.vob") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.065] lstrlenA (lpString="*.ifo") returned 5 [0062.065] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.065] lstrlenA (lpString="*.lnk") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.066] lstrlenA (lpString="*.torrent") returned 9 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.066] lstrlenA (lpString="*.mov") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.066] lstrlenA (lpString="*.m2v") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.066] lstrlenA (lpString="*.3gp") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.066] lstrlenA (lpString="*.mpeg") returned 6 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.066] lstrlenA (lpString="*.mpg") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.066] lstrlenA (lpString="*.flv") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.066] lstrlenA (lpString="*.avi") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.066] lstrlenA (lpString="*.mp4") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.066] lstrlenA (lpString="*.wmv") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.066] lstrlenA (lpString="*.divx") returned 6 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.066] lstrlenA (lpString="*.mkv") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.066] lstrlenA (lpString="*.mp3") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.066] lstrlenA (lpString="*.wav") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.066] lstrlenA (lpString="*.flac") returned 6 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.066] lstrlenA (lpString="*.ape") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.066] lstrlenA (lpString="*.wma") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.066] lstrlenA (lpString="*.ac3") returned 5 [0062.066] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.066] lstrlenA (lpString="*.doc") returned 5 [0062.067] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.067] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.067] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.067] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned="LocalizedData.xml" [0062.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1033\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0062.067] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1033\\" | out: pszPath="C:\\588bce7c90097ed212\\1033\\") returned="" [0062.067] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1033\\HOW TO DECRYPT FILES.txt" [0062.067] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\how to decrypt files.txt")) returned 0x20 [0062.067] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" [0062.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.067] lstrlenA (lpString="*.zip") returned 5 [0062.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.067] lstrlenA (lpString="*.rar") returned 5 [0062.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.067] lstrlenA (lpString="*.7z") returned 4 [0062.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.067] lstrlenA (lpString="*.tar") returned 5 [0062.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.067] lstrlenA (lpString="*.gzip") returned 6 [0062.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.067] lstrlenA (lpString="*.jpg") returned 5 [0062.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.067] lstrlenA (lpString="*.jpeg") returned 6 [0062.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.067] lstrlenA (lpString="*.psd") returned 5 [0062.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.067] lstrlenA (lpString="*.cdr") returned 5 [0062.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.067] lstrlenA (lpString="*.dwg") returned 5 [0062.067] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.067] lstrlenA (lpString="*.max") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.068] lstrlenA (lpString="*.bmp") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.068] lstrlenA (lpString="*.gif") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.068] lstrlenA (lpString="*.png") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.068] lstrlenA (lpString="*.doc") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.068] lstrlenA (lpString="*.docx") returned 6 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.068] lstrlenA (lpString="*.xls") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.068] lstrlenA (lpString="*.xlsx") returned 6 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.068] lstrlenA (lpString="*.ppt") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.068] lstrlenA (lpString="*.pptx") returned 6 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.068] lstrlenA (lpString="*.txt") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.068] lstrlenA (lpString="*.pdf") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.068] lstrlenA (lpString="*.djvu") returned 6 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.068] lstrlenA (lpString="*.htm") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.068] lstrlenA (lpString="*.html") returned 6 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.068] lstrlenA (lpString="*.mdb") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.068] lstrlenA (lpString="*.cer") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.068] lstrlenA (lpString="*.p12") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.068] lstrlenA (lpString="*.pfx") returned 5 [0062.068] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.068] lstrlenA (lpString="*.kwm") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.069] lstrlenA (lpString="*.pwm") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.069] lstrlenA (lpString="*.1cd") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.069] lstrlenA (lpString="*.md") returned 4 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.069] lstrlenA (lpString="*.mdf") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.069] lstrlenA (lpString="*.dbf") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.069] lstrlenA (lpString="*.odt") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.069] lstrlenA (lpString="*.vob") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.069] lstrlenA (lpString="*.ifo") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.069] lstrlenA (lpString="*.lnk") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.069] lstrlenA (lpString="*.torrent") returned 9 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.069] lstrlenA (lpString="*.mov") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.069] lstrlenA (lpString="*.m2v") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.069] lstrlenA (lpString="*.3gp") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.069] lstrlenA (lpString="*.mpeg") returned 6 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.069] lstrlenA (lpString="*.mpg") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.069] lstrlenA (lpString="*.flv") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.069] lstrlenA (lpString="*.avi") returned 5 [0062.069] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.069] lstrlenA (lpString="*.mp4") returned 5 [0062.070] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.070] lstrlenA (lpString="*.wmv") returned 5 [0062.070] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.070] lstrlenA (lpString="*.divx") returned 6 [0062.070] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.070] lstrlenA (lpString="*.mkv") returned 5 [0062.070] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.070] lstrlenA (lpString="*.mp3") returned 5 [0062.070] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.070] lstrlenA (lpString="*.wav") returned 5 [0062.070] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.070] lstrlenA (lpString="*.flac") returned 6 [0062.070] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.070] lstrlenA (lpString="*.ape") returned 5 [0062.070] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.070] lstrlenA (lpString="*.wma") returned 5 [0062.070] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.070] lstrlenA (lpString="*.ac3") returned 5 [0062.070] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.070] lstrlenA (lpString="*.doc") returned 5 [0062.070] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.070] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0062.070] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1035", cAlternateFileName="")) returned 1 [0062.070] lstrcmpA (lpString1=".", lpString2="1035") returned -1 [0062.070] lstrcmpA (lpString1="..", lpString2="1035") returned -1 [0062.070] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.070] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1035" | out: lpString1="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0062.070] lstrlenA (lpString="C:\\588bce7c90097ed212\\1035") returned 26 [0062.070] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0062.071] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.071] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.071] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.071] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.071] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.071] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.071] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.071] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.071] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.071] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1035\\*.*") returned="*.*" [0062.071] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1035\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0062.071] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1035\\" | out: pszPath="C:\\588bce7c90097ed212\\1035\\") returned="" [0062.071] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1035\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1035\\HOW TO DECRYPT FILES.txt" [0062.072] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1035\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\how to decrypt files.txt")) returned 0xffffffff [0062.072] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1035\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.073] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.073] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.082] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.083] CloseHandle (hObject=0x208) returned 1 [0062.083] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf" [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.zip") returned 0 [0062.083] lstrlenA (lpString="*.zip") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.rar") returned 0 [0062.083] lstrlenA (lpString="*.rar") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.7z") returned 0 [0062.083] lstrlenA (lpString="*.7z") returned 4 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.tar") returned 0 [0062.083] lstrlenA (lpString="*.tar") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.083] lstrlenA (lpString="*.gzip") returned 6 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.083] lstrlenA (lpString="*.jpg") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.083] lstrlenA (lpString="*.jpeg") returned 6 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.psd") returned 0 [0062.083] lstrlenA (lpString="*.psd") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.083] lstrlenA (lpString="*.cdr") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.083] lstrlenA (lpString="*.dwg") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.max") returned 0 [0062.083] lstrlenA (lpString="*.max") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.083] lstrlenA (lpString="*.bmp") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.gif") returned 0 [0062.083] lstrlenA (lpString="*.gif") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.png") returned 0 [0062.083] lstrlenA (lpString="*.png") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.doc") returned 0 [0062.084] lstrlenA (lpString="*.doc") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.docx") returned 0 [0062.084] lstrlenA (lpString="*.docx") returned 6 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.xls") returned 0 [0062.084] lstrlenA (lpString="*.xls") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.084] lstrlenA (lpString="*.xlsx") returned 6 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.084] lstrlenA (lpString="*.ppt") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.084] lstrlenA (lpString="*.pptx") returned 6 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.txt") returned 0 [0062.084] lstrlenA (lpString="*.txt") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.084] lstrlenA (lpString="*.pdf") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.084] lstrlenA (lpString="*.djvu") returned 6 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.htm") returned 0 [0062.084] lstrlenA (lpString="*.htm") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.html") returned 0 [0062.084] lstrlenA (lpString="*.html") returned 6 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.084] lstrlenA (lpString="*.mdb") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.cer") returned 0 [0062.084] lstrlenA (lpString="*.cer") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.p12") returned 0 [0062.084] lstrlenA (lpString="*.p12") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.084] lstrlenA (lpString="*.pfx") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.084] lstrlenA (lpString="*.kwm") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.084] lstrlenA (lpString="*.pwm") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.084] lstrlenA (lpString="*.1cd") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.md") returned 0 [0062.084] lstrlenA (lpString="*.md") returned 4 [0062.084] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.085] lstrlenA (lpString="*.mdf") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.085] lstrlenA (lpString="*.dbf") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.odt") returned 0 [0062.085] lstrlenA (lpString="*.odt") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.vob") returned 0 [0062.085] lstrlenA (lpString="*.vob") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.085] lstrlenA (lpString="*.ifo") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.085] lstrlenA (lpString="*.lnk") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.085] lstrlenA (lpString="*.torrent") returned 9 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mov") returned 0 [0062.085] lstrlenA (lpString="*.mov") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.085] lstrlenA (lpString="*.m2v") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.085] lstrlenA (lpString="*.3gp") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.085] lstrlenA (lpString="*.mpeg") returned 6 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.085] lstrlenA (lpString="*.mpg") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.flv") returned 0 [0062.085] lstrlenA (lpString="*.flv") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.avi") returned 0 [0062.085] lstrlenA (lpString="*.avi") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.085] lstrlenA (lpString="*.mp4") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.085] lstrlenA (lpString="*.wmv") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.divx") returned 0 [0062.085] lstrlenA (lpString="*.divx") returned 6 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.085] lstrlenA (lpString="*.mkv") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.086] lstrlenA (lpString="*.mp3") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.wav") returned 0 [0062.086] lstrlenA (lpString="*.wav") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.flac") returned 0 [0062.086] lstrlenA (lpString="*.flac") returned 6 [0062.086] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.ape") returned 0 [0062.086] lstrlenA (lpString="*.ape") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.wma") returned 0 [0062.086] lstrlenA (lpString="*.wma") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.086] lstrlenA (lpString="*.ac3") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\eula.rtf", pszSpec="*.doc") returned 0 [0062.086] lstrlenA (lpString="*.doc") returned 5 [0062.086] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.086] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.086] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.086] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.086] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.086] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned="eula.rtf" [0062.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1035\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0062.086] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1035\\" | out: pszPath="C:\\588bce7c90097ed212\\1035\\") returned="" [0062.086] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1035\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1035\\HOW TO DECRYPT FILES.txt" [0062.086] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1035\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\how to decrypt files.txt")) returned 0x20 [0062.086] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" [0062.086] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.086] lstrlenA (lpString="*.zip") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.086] lstrlenA (lpString="*.rar") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.086] lstrlenA (lpString="*.7z") returned 4 [0062.086] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.086] lstrlenA (lpString="*.tar") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.087] lstrlenA (lpString="*.gzip") returned 6 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.087] lstrlenA (lpString="*.jpg") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.087] lstrlenA (lpString="*.jpeg") returned 6 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.087] lstrlenA (lpString="*.psd") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.087] lstrlenA (lpString="*.cdr") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.087] lstrlenA (lpString="*.dwg") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.087] lstrlenA (lpString="*.max") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.087] lstrlenA (lpString="*.bmp") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.087] lstrlenA (lpString="*.gif") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.087] lstrlenA (lpString="*.png") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.087] lstrlenA (lpString="*.doc") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.087] lstrlenA (lpString="*.docx") returned 6 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.087] lstrlenA (lpString="*.xls") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.087] lstrlenA (lpString="*.xlsx") returned 6 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.087] lstrlenA (lpString="*.ppt") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.087] lstrlenA (lpString="*.pptx") returned 6 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.087] lstrlenA (lpString="*.txt") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.087] lstrlenA (lpString="*.pdf") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.087] lstrlenA (lpString="*.djvu") returned 6 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.088] lstrlenA (lpString="*.htm") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.088] lstrlenA (lpString="*.html") returned 6 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.088] lstrlenA (lpString="*.mdb") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.088] lstrlenA (lpString="*.cer") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.088] lstrlenA (lpString="*.p12") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.088] lstrlenA (lpString="*.pfx") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.088] lstrlenA (lpString="*.kwm") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.088] lstrlenA (lpString="*.pwm") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.088] lstrlenA (lpString="*.1cd") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.088] lstrlenA (lpString="*.md") returned 4 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.088] lstrlenA (lpString="*.mdf") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.088] lstrlenA (lpString="*.dbf") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.088] lstrlenA (lpString="*.odt") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.088] lstrlenA (lpString="*.vob") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.088] lstrlenA (lpString="*.ifo") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.088] lstrlenA (lpString="*.lnk") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.088] lstrlenA (lpString="*.torrent") returned 9 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.088] lstrlenA (lpString="*.mov") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.088] lstrlenA (lpString="*.m2v") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.089] lstrlenA (lpString="*.3gp") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.089] lstrlenA (lpString="*.mpeg") returned 6 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.089] lstrlenA (lpString="*.mpg") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.089] lstrlenA (lpString="*.flv") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.089] lstrlenA (lpString="*.avi") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.089] lstrlenA (lpString="*.mp4") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.089] lstrlenA (lpString="*.wmv") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.089] lstrlenA (lpString="*.divx") returned 6 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.089] lstrlenA (lpString="*.mkv") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.089] lstrlenA (lpString="*.mp3") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.089] lstrlenA (lpString="*.wav") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.089] lstrlenA (lpString="*.flac") returned 6 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.089] lstrlenA (lpString="*.ape") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.089] lstrlenA (lpString="*.wma") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.089] lstrlenA (lpString="*.ac3") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.089] lstrlenA (lpString="*.doc") returned 5 [0062.089] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.089] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.089] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.089] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned="LocalizedData.xml" [0062.090] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1035\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0062.090] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1035\\" | out: pszPath="C:\\588bce7c90097ed212\\1035\\") returned="" [0062.090] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1035\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1035\\HOW TO DECRYPT FILES.txt" [0062.090] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1035\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\how to decrypt files.txt")) returned 0x20 [0062.090] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.090] lstrlenA (lpString="*.zip") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.090] lstrlenA (lpString="*.rar") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.090] lstrlenA (lpString="*.7z") returned 4 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.090] lstrlenA (lpString="*.tar") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.090] lstrlenA (lpString="*.gzip") returned 6 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.090] lstrlenA (lpString="*.jpg") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.090] lstrlenA (lpString="*.jpeg") returned 6 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.090] lstrlenA (lpString="*.psd") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.090] lstrlenA (lpString="*.cdr") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.090] lstrlenA (lpString="*.dwg") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.090] lstrlenA (lpString="*.max") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.090] lstrlenA (lpString="*.bmp") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.090] lstrlenA (lpString="*.gif") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.090] lstrlenA (lpString="*.png") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.090] lstrlenA (lpString="*.doc") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.091] lstrlenA (lpString="*.docx") returned 6 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.091] lstrlenA (lpString="*.xls") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.091] lstrlenA (lpString="*.xlsx") returned 6 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.091] lstrlenA (lpString="*.ppt") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.091] lstrlenA (lpString="*.pptx") returned 6 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.091] lstrlenA (lpString="*.txt") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.091] lstrlenA (lpString="*.pdf") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.091] lstrlenA (lpString="*.djvu") returned 6 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.091] lstrlenA (lpString="*.htm") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.091] lstrlenA (lpString="*.html") returned 6 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.091] lstrlenA (lpString="*.mdb") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.091] lstrlenA (lpString="*.cer") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.091] lstrlenA (lpString="*.p12") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.091] lstrlenA (lpString="*.pfx") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.091] lstrlenA (lpString="*.kwm") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.091] lstrlenA (lpString="*.pwm") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.091] lstrlenA (lpString="*.1cd") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.091] lstrlenA (lpString="*.md") returned 4 [0062.091] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.091] lstrlenA (lpString="*.mdf") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.092] lstrlenA (lpString="*.dbf") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.092] lstrlenA (lpString="*.odt") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.092] lstrlenA (lpString="*.vob") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.092] lstrlenA (lpString="*.ifo") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.092] lstrlenA (lpString="*.lnk") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.092] lstrlenA (lpString="*.torrent") returned 9 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.092] lstrlenA (lpString="*.mov") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.092] lstrlenA (lpString="*.m2v") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.092] lstrlenA (lpString="*.3gp") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.092] lstrlenA (lpString="*.mpeg") returned 6 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.092] lstrlenA (lpString="*.mpg") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.092] lstrlenA (lpString="*.flv") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.092] lstrlenA (lpString="*.avi") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.092] lstrlenA (lpString="*.mp4") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.092] lstrlenA (lpString="*.wmv") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.092] lstrlenA (lpString="*.divx") returned 6 [0062.093] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.093] lstrlenA (lpString="*.mkv") returned 5 [0062.093] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.093] lstrlenA (lpString="*.mp3") returned 5 [0062.093] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.093] lstrlenA (lpString="*.wav") returned 5 [0062.093] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.093] lstrlenA (lpString="*.flac") returned 6 [0062.093] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.093] lstrlenA (lpString="*.ape") returned 5 [0062.093] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.093] lstrlenA (lpString="*.wma") returned 5 [0062.093] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.093] lstrlenA (lpString="*.ac3") returned 5 [0062.093] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.093] lstrlenA (lpString="*.doc") returned 5 [0062.093] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.093] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0062.093] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1036", cAlternateFileName="")) returned 1 [0062.093] lstrcmpA (lpString1=".", lpString2="1036") returned -1 [0062.093] lstrcmpA (lpString1="..", lpString2="1036") returned -1 [0062.094] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.094] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1036" | out: lpString1="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0062.094] lstrlenA (lpString="C:\\588bce7c90097ed212\\1036") returned 26 [0062.094] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0062.094] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.094] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.094] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.094] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.094] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.094] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.094] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.095] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.095] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1036\\*.*") returned="*.*" [0062.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1036\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0062.095] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1036\\" | out: pszPath="C:\\588bce7c90097ed212\\1036\\") returned="" [0062.095] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1036\\HOW TO DECRYPT FILES.txt" [0062.095] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\how to decrypt files.txt")) returned 0xffffffff [0062.095] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.096] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.096] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.097] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.101] CloseHandle (hObject=0x208) returned 1 [0062.101] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf" [0062.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.zip") returned 0 [0062.101] lstrlenA (lpString="*.zip") returned 5 [0062.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.rar") returned 0 [0062.101] lstrlenA (lpString="*.rar") returned 5 [0062.101] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.7z") returned 0 [0062.102] lstrlenA (lpString="*.7z") returned 4 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.tar") returned 0 [0062.102] lstrlenA (lpString="*.tar") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.102] lstrlenA (lpString="*.gzip") returned 6 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.102] lstrlenA (lpString="*.jpg") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.102] lstrlenA (lpString="*.jpeg") returned 6 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.psd") returned 0 [0062.102] lstrlenA (lpString="*.psd") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.102] lstrlenA (lpString="*.cdr") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.102] lstrlenA (lpString="*.dwg") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.max") returned 0 [0062.102] lstrlenA (lpString="*.max") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.102] lstrlenA (lpString="*.bmp") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.gif") returned 0 [0062.102] lstrlenA (lpString="*.gif") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.png") returned 0 [0062.102] lstrlenA (lpString="*.png") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.doc") returned 0 [0062.102] lstrlenA (lpString="*.doc") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.docx") returned 0 [0062.102] lstrlenA (lpString="*.docx") returned 6 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.xls") returned 0 [0062.102] lstrlenA (lpString="*.xls") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.102] lstrlenA (lpString="*.xlsx") returned 6 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.102] lstrlenA (lpString="*.ppt") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.102] lstrlenA (lpString="*.pptx") returned 6 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.txt") returned 0 [0062.102] lstrlenA (lpString="*.txt") returned 5 [0062.102] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.103] lstrlenA (lpString="*.pdf") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.103] lstrlenA (lpString="*.djvu") returned 6 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.htm") returned 0 [0062.103] lstrlenA (lpString="*.htm") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.html") returned 0 [0062.103] lstrlenA (lpString="*.html") returned 6 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.103] lstrlenA (lpString="*.mdb") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.cer") returned 0 [0062.103] lstrlenA (lpString="*.cer") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.p12") returned 0 [0062.103] lstrlenA (lpString="*.p12") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.103] lstrlenA (lpString="*.pfx") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.103] lstrlenA (lpString="*.kwm") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.103] lstrlenA (lpString="*.pwm") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.103] lstrlenA (lpString="*.1cd") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.md") returned 0 [0062.103] lstrlenA (lpString="*.md") returned 4 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.103] lstrlenA (lpString="*.mdf") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.103] lstrlenA (lpString="*.dbf") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.odt") returned 0 [0062.103] lstrlenA (lpString="*.odt") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.vob") returned 0 [0062.103] lstrlenA (lpString="*.vob") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.103] lstrlenA (lpString="*.ifo") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.103] lstrlenA (lpString="*.lnk") returned 5 [0062.103] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.103] lstrlenA (lpString="*.torrent") returned 9 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mov") returned 0 [0062.104] lstrlenA (lpString="*.mov") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.104] lstrlenA (lpString="*.m2v") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.104] lstrlenA (lpString="*.3gp") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.104] lstrlenA (lpString="*.mpeg") returned 6 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.104] lstrlenA (lpString="*.mpg") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.flv") returned 0 [0062.104] lstrlenA (lpString="*.flv") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.avi") returned 0 [0062.104] lstrlenA (lpString="*.avi") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.104] lstrlenA (lpString="*.mp4") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.104] lstrlenA (lpString="*.wmv") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.divx") returned 0 [0062.104] lstrlenA (lpString="*.divx") returned 6 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.104] lstrlenA (lpString="*.mkv") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.104] lstrlenA (lpString="*.mp3") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.wav") returned 0 [0062.104] lstrlenA (lpString="*.wav") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.flac") returned 0 [0062.104] lstrlenA (lpString="*.flac") returned 6 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.ape") returned 0 [0062.104] lstrlenA (lpString="*.ape") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.wma") returned 0 [0062.104] lstrlenA (lpString="*.wma") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.104] lstrlenA (lpString="*.ac3") returned 5 [0062.104] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\eula.rtf", pszSpec="*.doc") returned 0 [0062.104] lstrlenA (lpString="*.doc") returned 5 [0062.104] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.104] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.105] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.105] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.105] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned="eula.rtf" [0062.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1036\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0062.105] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1036\\" | out: pszPath="C:\\588bce7c90097ed212\\1036\\") returned="" [0062.105] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1036\\HOW TO DECRYPT FILES.txt" [0062.105] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\how to decrypt files.txt")) returned 0x20 [0062.105] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" [0062.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.105] lstrlenA (lpString="*.zip") returned 5 [0062.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.105] lstrlenA (lpString="*.rar") returned 5 [0062.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.105] lstrlenA (lpString="*.7z") returned 4 [0062.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.105] lstrlenA (lpString="*.tar") returned 5 [0062.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.105] lstrlenA (lpString="*.gzip") returned 6 [0062.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.105] lstrlenA (lpString="*.jpg") returned 5 [0062.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.105] lstrlenA (lpString="*.jpeg") returned 6 [0062.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.105] lstrlenA (lpString="*.psd") returned 5 [0062.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.105] lstrlenA (lpString="*.cdr") returned 5 [0062.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.105] lstrlenA (lpString="*.dwg") returned 5 [0062.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.105] lstrlenA (lpString="*.max") returned 5 [0062.105] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.106] lstrlenA (lpString="*.bmp") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.106] lstrlenA (lpString="*.gif") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.106] lstrlenA (lpString="*.png") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.106] lstrlenA (lpString="*.doc") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.106] lstrlenA (lpString="*.docx") returned 6 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.106] lstrlenA (lpString="*.xls") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.106] lstrlenA (lpString="*.xlsx") returned 6 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.106] lstrlenA (lpString="*.ppt") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.106] lstrlenA (lpString="*.pptx") returned 6 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.106] lstrlenA (lpString="*.txt") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.106] lstrlenA (lpString="*.pdf") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.106] lstrlenA (lpString="*.djvu") returned 6 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.106] lstrlenA (lpString="*.htm") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.106] lstrlenA (lpString="*.html") returned 6 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.106] lstrlenA (lpString="*.mdb") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.106] lstrlenA (lpString="*.cer") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.106] lstrlenA (lpString="*.p12") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.106] lstrlenA (lpString="*.pfx") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.106] lstrlenA (lpString="*.kwm") returned 5 [0062.106] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.107] lstrlenA (lpString="*.pwm") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.107] lstrlenA (lpString="*.1cd") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.107] lstrlenA (lpString="*.md") returned 4 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.107] lstrlenA (lpString="*.mdf") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.107] lstrlenA (lpString="*.dbf") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.107] lstrlenA (lpString="*.odt") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.107] lstrlenA (lpString="*.vob") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.107] lstrlenA (lpString="*.ifo") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.107] lstrlenA (lpString="*.lnk") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.107] lstrlenA (lpString="*.torrent") returned 9 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.107] lstrlenA (lpString="*.mov") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.107] lstrlenA (lpString="*.m2v") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.107] lstrlenA (lpString="*.3gp") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.107] lstrlenA (lpString="*.mpeg") returned 6 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.107] lstrlenA (lpString="*.mpg") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.107] lstrlenA (lpString="*.flv") returned 5 [0062.107] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.107] lstrlenA (lpString="*.avi") returned 5 [0062.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.108] lstrlenA (lpString="*.mp4") returned 5 [0062.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.108] lstrlenA (lpString="*.wmv") returned 5 [0062.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.108] lstrlenA (lpString="*.divx") returned 6 [0062.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.108] lstrlenA (lpString="*.mkv") returned 5 [0062.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.108] lstrlenA (lpString="*.mp3") returned 5 [0062.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.108] lstrlenA (lpString="*.wav") returned 5 [0062.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.108] lstrlenA (lpString="*.flac") returned 6 [0062.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.108] lstrlenA (lpString="*.ape") returned 5 [0062.108] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.109] lstrlenA (lpString="*.wma") returned 5 [0062.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.109] lstrlenA (lpString="*.ac3") returned 5 [0062.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.109] lstrlenA (lpString="*.doc") returned 5 [0062.109] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.109] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.109] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.109] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.109] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.109] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned="LocalizedData.xml" [0062.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1036\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0062.109] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1036\\" | out: pszPath="C:\\588bce7c90097ed212\\1036\\") returned="" [0062.109] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1036\\HOW TO DECRYPT FILES.txt" [0062.109] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\how to decrypt files.txt")) returned 0x20 [0062.109] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" [0062.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.109] lstrlenA (lpString="*.zip") returned 5 [0062.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.109] lstrlenA (lpString="*.rar") returned 5 [0062.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.109] lstrlenA (lpString="*.7z") returned 4 [0062.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.109] lstrlenA (lpString="*.tar") returned 5 [0062.109] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.109] lstrlenA (lpString="*.gzip") returned 6 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.110] lstrlenA (lpString="*.jpg") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.110] lstrlenA (lpString="*.jpeg") returned 6 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.110] lstrlenA (lpString="*.psd") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.110] lstrlenA (lpString="*.cdr") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.110] lstrlenA (lpString="*.dwg") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.110] lstrlenA (lpString="*.max") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.110] lstrlenA (lpString="*.bmp") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.110] lstrlenA (lpString="*.gif") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.110] lstrlenA (lpString="*.png") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.110] lstrlenA (lpString="*.doc") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.110] lstrlenA (lpString="*.docx") returned 6 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.110] lstrlenA (lpString="*.xls") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.110] lstrlenA (lpString="*.xlsx") returned 6 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.110] lstrlenA (lpString="*.ppt") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.110] lstrlenA (lpString="*.pptx") returned 6 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.110] lstrlenA (lpString="*.txt") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.110] lstrlenA (lpString="*.pdf") returned 5 [0062.110] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.110] lstrlenA (lpString="*.djvu") returned 6 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.111] lstrlenA (lpString="*.htm") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.111] lstrlenA (lpString="*.html") returned 6 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.111] lstrlenA (lpString="*.mdb") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.111] lstrlenA (lpString="*.cer") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.111] lstrlenA (lpString="*.p12") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.111] lstrlenA (lpString="*.pfx") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.111] lstrlenA (lpString="*.kwm") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.111] lstrlenA (lpString="*.pwm") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.111] lstrlenA (lpString="*.1cd") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.111] lstrlenA (lpString="*.md") returned 4 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.111] lstrlenA (lpString="*.mdf") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.111] lstrlenA (lpString="*.dbf") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.111] lstrlenA (lpString="*.odt") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.111] lstrlenA (lpString="*.vob") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.111] lstrlenA (lpString="*.ifo") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.111] lstrlenA (lpString="*.lnk") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.111] lstrlenA (lpString="*.torrent") returned 9 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.111] lstrlenA (lpString="*.mov") returned 5 [0062.111] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.111] lstrlenA (lpString="*.m2v") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.112] lstrlenA (lpString="*.3gp") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.112] lstrlenA (lpString="*.mpeg") returned 6 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.112] lstrlenA (lpString="*.mpg") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.112] lstrlenA (lpString="*.flv") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.112] lstrlenA (lpString="*.avi") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.112] lstrlenA (lpString="*.mp4") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.112] lstrlenA (lpString="*.wmv") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.112] lstrlenA (lpString="*.divx") returned 6 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.112] lstrlenA (lpString="*.mkv") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.112] lstrlenA (lpString="*.mp3") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.112] lstrlenA (lpString="*.wav") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.112] lstrlenA (lpString="*.flac") returned 6 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.112] lstrlenA (lpString="*.ape") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.112] lstrlenA (lpString="*.wma") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.112] lstrlenA (lpString="*.ac3") returned 5 [0062.112] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.112] lstrlenA (lpString="*.doc") returned 5 [0062.112] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.112] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0062.113] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1037", cAlternateFileName="")) returned 1 [0062.113] lstrcmpA (lpString1=".", lpString2="1037") returned -1 [0062.113] lstrcmpA (lpString1="..", lpString2="1037") returned -1 [0062.113] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.113] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1037" | out: lpString1="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0062.113] lstrlenA (lpString="C:\\588bce7c90097ed212\\1037") returned 26 [0062.113] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0062.114] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.114] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.114] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.114] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.114] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.114] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.114] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.114] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1037\\*.*") returned="*.*" [0062.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1037\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0062.114] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1037\\" | out: pszPath="C:\\588bce7c90097ed212\\1037\\") returned="" [0062.114] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1037\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1037\\HOW TO DECRYPT FILES.txt" [0062.114] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1037\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\how to decrypt files.txt")) returned 0xffffffff [0062.114] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1037\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.116] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.116] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.134] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.134] CloseHandle (hObject=0x208) returned 1 [0062.135] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf" [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.zip") returned 0 [0062.135] lstrlenA (lpString="*.zip") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.rar") returned 0 [0062.135] lstrlenA (lpString="*.rar") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.7z") returned 0 [0062.135] lstrlenA (lpString="*.7z") returned 4 [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.tar") returned 0 [0062.135] lstrlenA (lpString="*.tar") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.135] lstrlenA (lpString="*.gzip") returned 6 [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.135] lstrlenA (lpString="*.jpg") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.135] lstrlenA (lpString="*.jpeg") returned 6 [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.psd") returned 0 [0062.135] lstrlenA (lpString="*.psd") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.135] lstrlenA (lpString="*.cdr") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.135] lstrlenA (lpString="*.dwg") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.max") returned 0 [0062.135] lstrlenA (lpString="*.max") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.135] lstrlenA (lpString="*.bmp") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.gif") returned 0 [0062.136] lstrlenA (lpString="*.gif") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.png") returned 0 [0062.136] lstrlenA (lpString="*.png") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.doc") returned 0 [0062.136] lstrlenA (lpString="*.doc") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.docx") returned 0 [0062.136] lstrlenA (lpString="*.docx") returned 6 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.xls") returned 0 [0062.136] lstrlenA (lpString="*.xls") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.136] lstrlenA (lpString="*.xlsx") returned 6 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.136] lstrlenA (lpString="*.ppt") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.136] lstrlenA (lpString="*.pptx") returned 6 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.txt") returned 0 [0062.136] lstrlenA (lpString="*.txt") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.136] lstrlenA (lpString="*.pdf") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.136] lstrlenA (lpString="*.djvu") returned 6 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.htm") returned 0 [0062.136] lstrlenA (lpString="*.htm") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.html") returned 0 [0062.136] lstrlenA (lpString="*.html") returned 6 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.136] lstrlenA (lpString="*.mdb") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.cer") returned 0 [0062.136] lstrlenA (lpString="*.cer") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.p12") returned 0 [0062.136] lstrlenA (lpString="*.p12") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.136] lstrlenA (lpString="*.pfx") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.136] lstrlenA (lpString="*.kwm") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.136] lstrlenA (lpString="*.pwm") returned 5 [0062.136] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.137] lstrlenA (lpString="*.1cd") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.md") returned 0 [0062.137] lstrlenA (lpString="*.md") returned 4 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.137] lstrlenA (lpString="*.mdf") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.137] lstrlenA (lpString="*.dbf") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.odt") returned 0 [0062.137] lstrlenA (lpString="*.odt") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.vob") returned 0 [0062.137] lstrlenA (lpString="*.vob") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.137] lstrlenA (lpString="*.ifo") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.137] lstrlenA (lpString="*.lnk") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.137] lstrlenA (lpString="*.torrent") returned 9 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mov") returned 0 [0062.137] lstrlenA (lpString="*.mov") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.137] lstrlenA (lpString="*.m2v") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.137] lstrlenA (lpString="*.3gp") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.137] lstrlenA (lpString="*.mpeg") returned 6 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.137] lstrlenA (lpString="*.mpg") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.flv") returned 0 [0062.137] lstrlenA (lpString="*.flv") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.avi") returned 0 [0062.137] lstrlenA (lpString="*.avi") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.137] lstrlenA (lpString="*.mp4") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.137] lstrlenA (lpString="*.wmv") returned 5 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.divx") returned 0 [0062.137] lstrlenA (lpString="*.divx") returned 6 [0062.137] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.138] lstrlenA (lpString="*.mkv") returned 5 [0062.138] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.138] lstrlenA (lpString="*.mp3") returned 5 [0062.138] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.wav") returned 0 [0062.138] lstrlenA (lpString="*.wav") returned 5 [0062.138] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.flac") returned 0 [0062.138] lstrlenA (lpString="*.flac") returned 6 [0062.138] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.ape") returned 0 [0062.138] lstrlenA (lpString="*.ape") returned 5 [0062.138] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.wma") returned 0 [0062.138] lstrlenA (lpString="*.wma") returned 5 [0062.138] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.138] lstrlenA (lpString="*.ac3") returned 5 [0062.138] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\eula.rtf", pszSpec="*.doc") returned 0 [0062.138] lstrlenA (lpString="*.doc") returned 5 [0062.138] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.138] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.138] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.138] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.138] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned="eula.rtf" [0062.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1037\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0062.138] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1037\\" | out: pszPath="C:\\588bce7c90097ed212\\1037\\") returned="" [0062.138] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1037\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1037\\HOW TO DECRYPT FILES.txt" [0062.138] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1037\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\how to decrypt files.txt")) returned 0x20 [0062.138] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" [0062.138] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.138] lstrlenA (lpString="*.zip") returned 5 [0062.138] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.138] lstrlenA (lpString="*.rar") returned 5 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.139] lstrlenA (lpString="*.7z") returned 4 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.139] lstrlenA (lpString="*.tar") returned 5 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.139] lstrlenA (lpString="*.gzip") returned 6 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.139] lstrlenA (lpString="*.jpg") returned 5 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.139] lstrlenA (lpString="*.jpeg") returned 6 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.139] lstrlenA (lpString="*.psd") returned 5 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.139] lstrlenA (lpString="*.cdr") returned 5 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.139] lstrlenA (lpString="*.dwg") returned 5 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.139] lstrlenA (lpString="*.max") returned 5 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.139] lstrlenA (lpString="*.bmp") returned 5 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.139] lstrlenA (lpString="*.gif") returned 5 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.139] lstrlenA (lpString="*.png") returned 5 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.139] lstrlenA (lpString="*.doc") returned 5 [0062.139] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.139] lstrlenA (lpString="*.docx") returned 6 [0062.140] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.140] lstrlenA (lpString="*.xls") returned 5 [0062.140] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.140] lstrlenA (lpString="*.xlsx") returned 6 [0062.140] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.140] lstrlenA (lpString="*.ppt") returned 5 [0062.140] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.140] lstrlenA (lpString="*.pptx") returned 6 [0062.140] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.140] lstrlenA (lpString="*.txt") returned 5 [0062.140] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.140] lstrlenA (lpString="*.pdf") returned 5 [0062.140] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.140] lstrlenA (lpString="*.djvu") returned 6 [0062.140] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.140] lstrlenA (lpString="*.htm") returned 5 [0062.140] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.140] lstrlenA (lpString="*.html") returned 6 [0062.140] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.140] lstrlenA (lpString="*.mdb") returned 5 [0062.140] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.140] lstrlenA (lpString="*.cer") returned 5 [0062.140] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.140] lstrlenA (lpString="*.p12") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.141] lstrlenA (lpString="*.pfx") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.141] lstrlenA (lpString="*.kwm") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.141] lstrlenA (lpString="*.pwm") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.141] lstrlenA (lpString="*.1cd") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.141] lstrlenA (lpString="*.md") returned 4 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.141] lstrlenA (lpString="*.mdf") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.141] lstrlenA (lpString="*.dbf") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.141] lstrlenA (lpString="*.odt") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.141] lstrlenA (lpString="*.vob") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.141] lstrlenA (lpString="*.ifo") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.141] lstrlenA (lpString="*.lnk") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.141] lstrlenA (lpString="*.torrent") returned 9 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.141] lstrlenA (lpString="*.mov") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.141] lstrlenA (lpString="*.m2v") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.141] lstrlenA (lpString="*.3gp") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.141] lstrlenA (lpString="*.mpeg") returned 6 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.141] lstrlenA (lpString="*.mpg") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.141] lstrlenA (lpString="*.flv") returned 5 [0062.142] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.142] lstrlenA (lpString="*.avi") returned 5 [0062.142] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.142] lstrlenA (lpString="*.mp4") returned 5 [0062.142] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.142] lstrlenA (lpString="*.wmv") returned 5 [0062.142] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.142] lstrlenA (lpString="*.divx") returned 6 [0062.142] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.142] lstrlenA (lpString="*.mkv") returned 5 [0062.142] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.142] lstrlenA (lpString="*.mp3") returned 5 [0062.142] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.142] lstrlenA (lpString="*.wav") returned 5 [0062.142] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.142] lstrlenA (lpString="*.flac") returned 6 [0062.142] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.142] lstrlenA (lpString="*.ape") returned 5 [0062.142] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.142] lstrlenA (lpString="*.wma") returned 5 [0062.142] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.142] lstrlenA (lpString="*.ac3") returned 5 [0062.142] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.142] lstrlenA (lpString="*.doc") returned 5 [0062.142] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.142] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.142] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.142] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.142] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned="LocalizedData.xml" [0062.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1037\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0062.142] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1037\\" | out: pszPath="C:\\588bce7c90097ed212\\1037\\") returned="" [0062.142] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1037\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1037\\HOW TO DECRYPT FILES.txt" [0062.142] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1037\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\how to decrypt files.txt")) returned 0x20 [0062.143] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.143] lstrlenA (lpString="*.zip") returned 5 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.143] lstrlenA (lpString="*.rar") returned 5 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.143] lstrlenA (lpString="*.7z") returned 4 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.143] lstrlenA (lpString="*.tar") returned 5 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.143] lstrlenA (lpString="*.gzip") returned 6 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.143] lstrlenA (lpString="*.jpg") returned 5 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.143] lstrlenA (lpString="*.jpeg") returned 6 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.143] lstrlenA (lpString="*.psd") returned 5 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.143] lstrlenA (lpString="*.cdr") returned 5 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.143] lstrlenA (lpString="*.dwg") returned 5 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.143] lstrlenA (lpString="*.max") returned 5 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.143] lstrlenA (lpString="*.bmp") returned 5 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.143] lstrlenA (lpString="*.gif") returned 5 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.143] lstrlenA (lpString="*.png") returned 5 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.143] lstrlenA (lpString="*.doc") returned 5 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.143] lstrlenA (lpString="*.docx") returned 6 [0062.143] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.143] lstrlenA (lpString="*.xls") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.144] lstrlenA (lpString="*.xlsx") returned 6 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.144] lstrlenA (lpString="*.ppt") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.144] lstrlenA (lpString="*.pptx") returned 6 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.144] lstrlenA (lpString="*.txt") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.144] lstrlenA (lpString="*.pdf") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.144] lstrlenA (lpString="*.djvu") returned 6 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.144] lstrlenA (lpString="*.htm") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.144] lstrlenA (lpString="*.html") returned 6 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.144] lstrlenA (lpString="*.mdb") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.144] lstrlenA (lpString="*.cer") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.144] lstrlenA (lpString="*.p12") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.144] lstrlenA (lpString="*.pfx") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.144] lstrlenA (lpString="*.kwm") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.144] lstrlenA (lpString="*.pwm") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.144] lstrlenA (lpString="*.1cd") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.144] lstrlenA (lpString="*.md") returned 4 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.144] lstrlenA (lpString="*.mdf") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.144] lstrlenA (lpString="*.dbf") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.144] lstrlenA (lpString="*.odt") returned 5 [0062.144] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.145] lstrlenA (lpString="*.vob") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.145] lstrlenA (lpString="*.ifo") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.145] lstrlenA (lpString="*.lnk") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.145] lstrlenA (lpString="*.torrent") returned 9 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.145] lstrlenA (lpString="*.mov") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.145] lstrlenA (lpString="*.m2v") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.145] lstrlenA (lpString="*.3gp") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.145] lstrlenA (lpString="*.mpeg") returned 6 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.145] lstrlenA (lpString="*.mpg") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.145] lstrlenA (lpString="*.flv") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.145] lstrlenA (lpString="*.avi") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.145] lstrlenA (lpString="*.mp4") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.145] lstrlenA (lpString="*.wmv") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.145] lstrlenA (lpString="*.divx") returned 6 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.145] lstrlenA (lpString="*.mkv") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.145] lstrlenA (lpString="*.mp3") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.145] lstrlenA (lpString="*.wav") returned 5 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.145] lstrlenA (lpString="*.flac") returned 6 [0062.145] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.146] lstrlenA (lpString="*.ape") returned 5 [0062.146] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.146] lstrlenA (lpString="*.wma") returned 5 [0062.146] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.146] lstrlenA (lpString="*.ac3") returned 5 [0062.146] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.146] lstrlenA (lpString="*.doc") returned 5 [0062.146] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.146] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0062.146] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1038", cAlternateFileName="")) returned 1 [0062.146] lstrcmpA (lpString1=".", lpString2="1038") returned -1 [0062.146] lstrcmpA (lpString1="..", lpString2="1038") returned -1 [0062.146] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.146] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1038" | out: lpString1="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0062.146] lstrlenA (lpString="C:\\588bce7c90097ed212\\1038") returned 26 [0062.146] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0062.146] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.146] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.146] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.146] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.146] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.146] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.146] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.147] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.147] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1038\\*.*") returned="*.*" [0062.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1038\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0062.147] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1038\\" | out: pszPath="C:\\588bce7c90097ed212\\1038\\") returned="" [0062.147] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1038\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1038\\HOW TO DECRYPT FILES.txt" [0062.147] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1038\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\how to decrypt files.txt")) returned 0xffffffff [0062.147] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1038\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.149] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.149] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.150] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.150] CloseHandle (hObject=0x208) returned 1 [0062.151] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf" [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.zip") returned 0 [0062.151] lstrlenA (lpString="*.zip") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.rar") returned 0 [0062.151] lstrlenA (lpString="*.rar") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.7z") returned 0 [0062.151] lstrlenA (lpString="*.7z") returned 4 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.tar") returned 0 [0062.151] lstrlenA (lpString="*.tar") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.151] lstrlenA (lpString="*.gzip") returned 6 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.151] lstrlenA (lpString="*.jpg") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.151] lstrlenA (lpString="*.jpeg") returned 6 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.psd") returned 0 [0062.151] lstrlenA (lpString="*.psd") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.151] lstrlenA (lpString="*.cdr") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.151] lstrlenA (lpString="*.dwg") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.max") returned 0 [0062.151] lstrlenA (lpString="*.max") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.151] lstrlenA (lpString="*.bmp") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.gif") returned 0 [0062.151] lstrlenA (lpString="*.gif") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.png") returned 0 [0062.151] lstrlenA (lpString="*.png") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.doc") returned 0 [0062.152] lstrlenA (lpString="*.doc") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.docx") returned 0 [0062.152] lstrlenA (lpString="*.docx") returned 6 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.xls") returned 0 [0062.152] lstrlenA (lpString="*.xls") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.152] lstrlenA (lpString="*.xlsx") returned 6 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.152] lstrlenA (lpString="*.ppt") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.152] lstrlenA (lpString="*.pptx") returned 6 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.txt") returned 0 [0062.152] lstrlenA (lpString="*.txt") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.152] lstrlenA (lpString="*.pdf") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.152] lstrlenA (lpString="*.djvu") returned 6 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.htm") returned 0 [0062.152] lstrlenA (lpString="*.htm") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.html") returned 0 [0062.152] lstrlenA (lpString="*.html") returned 6 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.152] lstrlenA (lpString="*.mdb") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.cer") returned 0 [0062.152] lstrlenA (lpString="*.cer") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.p12") returned 0 [0062.152] lstrlenA (lpString="*.p12") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.152] lstrlenA (lpString="*.pfx") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.152] lstrlenA (lpString="*.kwm") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.152] lstrlenA (lpString="*.pwm") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.152] lstrlenA (lpString="*.1cd") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.md") returned 0 [0062.152] lstrlenA (lpString="*.md") returned 4 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.153] lstrlenA (lpString="*.mdf") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.153] lstrlenA (lpString="*.dbf") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.odt") returned 0 [0062.153] lstrlenA (lpString="*.odt") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.vob") returned 0 [0062.153] lstrlenA (lpString="*.vob") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.153] lstrlenA (lpString="*.ifo") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.153] lstrlenA (lpString="*.lnk") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.153] lstrlenA (lpString="*.torrent") returned 9 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mov") returned 0 [0062.153] lstrlenA (lpString="*.mov") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.153] lstrlenA (lpString="*.m2v") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.153] lstrlenA (lpString="*.3gp") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.153] lstrlenA (lpString="*.mpeg") returned 6 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.153] lstrlenA (lpString="*.mpg") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.flv") returned 0 [0062.153] lstrlenA (lpString="*.flv") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.avi") returned 0 [0062.153] lstrlenA (lpString="*.avi") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.153] lstrlenA (lpString="*.mp4") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.153] lstrlenA (lpString="*.wmv") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.divx") returned 0 [0062.153] lstrlenA (lpString="*.divx") returned 6 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.153] lstrlenA (lpString="*.mkv") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.154] lstrlenA (lpString="*.mp3") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.wav") returned 0 [0062.154] lstrlenA (lpString="*.wav") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.flac") returned 0 [0062.154] lstrlenA (lpString="*.flac") returned 6 [0062.154] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.ape") returned 0 [0062.154] lstrlenA (lpString="*.ape") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.wma") returned 0 [0062.154] lstrlenA (lpString="*.wma") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.154] lstrlenA (lpString="*.ac3") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\eula.rtf", pszSpec="*.doc") returned 0 [0062.154] lstrlenA (lpString="*.doc") returned 5 [0062.154] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.154] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.154] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.154] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.154] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned="eula.rtf" [0062.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1038\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0062.154] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1038\\" | out: pszPath="C:\\588bce7c90097ed212\\1038\\") returned="" [0062.154] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1038\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1038\\HOW TO DECRYPT FILES.txt" [0062.154] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1038\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\how to decrypt files.txt")) returned 0x20 [0062.154] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" [0062.154] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.154] lstrlenA (lpString="*.zip") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.154] lstrlenA (lpString="*.rar") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.154] lstrlenA (lpString="*.7z") returned 4 [0062.154] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.154] lstrlenA (lpString="*.tar") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.155] lstrlenA (lpString="*.gzip") returned 6 [0062.155] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.155] lstrlenA (lpString="*.jpg") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.155] lstrlenA (lpString="*.jpeg") returned 6 [0062.155] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.155] lstrlenA (lpString="*.psd") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.155] lstrlenA (lpString="*.cdr") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.155] lstrlenA (lpString="*.dwg") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.156] lstrlenA (lpString="*.max") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.156] lstrlenA (lpString="*.bmp") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.156] lstrlenA (lpString="*.gif") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.156] lstrlenA (lpString="*.png") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.156] lstrlenA (lpString="*.doc") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.156] lstrlenA (lpString="*.docx") returned 6 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.156] lstrlenA (lpString="*.xls") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.156] lstrlenA (lpString="*.xlsx") returned 6 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.156] lstrlenA (lpString="*.ppt") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.156] lstrlenA (lpString="*.pptx") returned 6 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.156] lstrlenA (lpString="*.txt") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.156] lstrlenA (lpString="*.pdf") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.156] lstrlenA (lpString="*.djvu") returned 6 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.156] lstrlenA (lpString="*.htm") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.156] lstrlenA (lpString="*.html") returned 6 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.156] lstrlenA (lpString="*.mdb") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.156] lstrlenA (lpString="*.cer") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.156] lstrlenA (lpString="*.p12") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.157] lstrlenA (lpString="*.pfx") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.157] lstrlenA (lpString="*.kwm") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.157] lstrlenA (lpString="*.pwm") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.157] lstrlenA (lpString="*.1cd") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.157] lstrlenA (lpString="*.md") returned 4 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.157] lstrlenA (lpString="*.mdf") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.157] lstrlenA (lpString="*.dbf") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.157] lstrlenA (lpString="*.odt") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.157] lstrlenA (lpString="*.vob") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.157] lstrlenA (lpString="*.ifo") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.157] lstrlenA (lpString="*.lnk") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.157] lstrlenA (lpString="*.torrent") returned 9 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.157] lstrlenA (lpString="*.mov") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.157] lstrlenA (lpString="*.m2v") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.157] lstrlenA (lpString="*.3gp") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.157] lstrlenA (lpString="*.mpeg") returned 6 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.157] lstrlenA (lpString="*.mpg") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.157] lstrlenA (lpString="*.flv") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.158] lstrlenA (lpString="*.avi") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.158] lstrlenA (lpString="*.mp4") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.158] lstrlenA (lpString="*.wmv") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.158] lstrlenA (lpString="*.divx") returned 6 [0062.158] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.158] lstrlenA (lpString="*.mkv") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.158] lstrlenA (lpString="*.mp3") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.158] lstrlenA (lpString="*.wav") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.158] lstrlenA (lpString="*.flac") returned 6 [0062.158] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.158] lstrlenA (lpString="*.ape") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.158] lstrlenA (lpString="*.wma") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.158] lstrlenA (lpString="*.ac3") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.158] lstrlenA (lpString="*.doc") returned 5 [0062.158] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.158] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.158] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.158] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned="LocalizedData.xml" [0062.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1038\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0062.158] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1038\\" | out: pszPath="C:\\588bce7c90097ed212\\1038\\") returned="" [0062.158] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1038\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1038\\HOW TO DECRYPT FILES.txt" [0062.158] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1038\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\how to decrypt files.txt")) returned 0x20 [0062.159] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.159] lstrlenA (lpString="*.zip") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.159] lstrlenA (lpString="*.rar") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.159] lstrlenA (lpString="*.7z") returned 4 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.159] lstrlenA (lpString="*.tar") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.159] lstrlenA (lpString="*.gzip") returned 6 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.159] lstrlenA (lpString="*.jpg") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.159] lstrlenA (lpString="*.jpeg") returned 6 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.159] lstrlenA (lpString="*.psd") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.159] lstrlenA (lpString="*.cdr") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.159] lstrlenA (lpString="*.dwg") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.159] lstrlenA (lpString="*.max") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.159] lstrlenA (lpString="*.bmp") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.159] lstrlenA (lpString="*.gif") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.159] lstrlenA (lpString="*.png") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.159] lstrlenA (lpString="*.doc") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.159] lstrlenA (lpString="*.docx") returned 6 [0062.159] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.159] lstrlenA (lpString="*.xls") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.160] lstrlenA (lpString="*.xlsx") returned 6 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.160] lstrlenA (lpString="*.ppt") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.160] lstrlenA (lpString="*.pptx") returned 6 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.160] lstrlenA (lpString="*.txt") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.160] lstrlenA (lpString="*.pdf") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.160] lstrlenA (lpString="*.djvu") returned 6 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.160] lstrlenA (lpString="*.htm") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.160] lstrlenA (lpString="*.html") returned 6 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.160] lstrlenA (lpString="*.mdb") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.160] lstrlenA (lpString="*.cer") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.160] lstrlenA (lpString="*.p12") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.160] lstrlenA (lpString="*.pfx") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.160] lstrlenA (lpString="*.kwm") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.160] lstrlenA (lpString="*.pwm") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.160] lstrlenA (lpString="*.1cd") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.160] lstrlenA (lpString="*.md") returned 4 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.160] lstrlenA (lpString="*.mdf") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.160] lstrlenA (lpString="*.dbf") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.160] lstrlenA (lpString="*.odt") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.161] lstrlenA (lpString="*.vob") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.161] lstrlenA (lpString="*.ifo") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.161] lstrlenA (lpString="*.lnk") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.161] lstrlenA (lpString="*.torrent") returned 9 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.161] lstrlenA (lpString="*.mov") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.161] lstrlenA (lpString="*.m2v") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.161] lstrlenA (lpString="*.3gp") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.161] lstrlenA (lpString="*.mpeg") returned 6 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.161] lstrlenA (lpString="*.mpg") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.161] lstrlenA (lpString="*.flv") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.161] lstrlenA (lpString="*.avi") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.161] lstrlenA (lpString="*.mp4") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.161] lstrlenA (lpString="*.wmv") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.161] lstrlenA (lpString="*.divx") returned 6 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.161] lstrlenA (lpString="*.mkv") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.161] lstrlenA (lpString="*.mp3") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.161] lstrlenA (lpString="*.wav") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.161] lstrlenA (lpString="*.flac") returned 6 [0062.162] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.162] lstrlenA (lpString="*.ape") returned 5 [0062.162] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.162] lstrlenA (lpString="*.wma") returned 5 [0062.162] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.162] lstrlenA (lpString="*.ac3") returned 5 [0062.162] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.162] lstrlenA (lpString="*.doc") returned 5 [0062.162] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.162] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0062.162] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1040", cAlternateFileName="")) returned 1 [0062.162] lstrcmpA (lpString1=".", lpString2="1040") returned -1 [0062.162] lstrcmpA (lpString1="..", lpString2="1040") returned -1 [0062.162] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.162] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1040" | out: lpString1="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0062.162] lstrlenA (lpString="C:\\588bce7c90097ed212\\1040") returned 26 [0062.162] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0062.163] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.163] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.163] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.163] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.163] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.163] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.163] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.163] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.163] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1040\\*.*") returned="*.*" [0062.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1040\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0062.163] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1040\\" | out: pszPath="C:\\588bce7c90097ed212\\1040\\") returned="" [0062.163] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1040\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1040\\HOW TO DECRYPT FILES.txt" [0062.163] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1040\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\how to decrypt files.txt")) returned 0xffffffff [0062.163] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1040\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.165] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.165] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.166] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.166] CloseHandle (hObject=0x208) returned 1 [0062.166] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf" [0062.166] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.zip") returned 0 [0062.166] lstrlenA (lpString="*.zip") returned 5 [0062.166] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.rar") returned 0 [0062.166] lstrlenA (lpString="*.rar") returned 5 [0062.166] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.7z") returned 0 [0062.166] lstrlenA (lpString="*.7z") returned 4 [0062.166] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.tar") returned 0 [0062.166] lstrlenA (lpString="*.tar") returned 5 [0062.166] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.167] lstrlenA (lpString="*.gzip") returned 6 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.167] lstrlenA (lpString="*.jpg") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.167] lstrlenA (lpString="*.jpeg") returned 6 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.psd") returned 0 [0062.167] lstrlenA (lpString="*.psd") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.167] lstrlenA (lpString="*.cdr") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.167] lstrlenA (lpString="*.dwg") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.max") returned 0 [0062.167] lstrlenA (lpString="*.max") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.167] lstrlenA (lpString="*.bmp") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.gif") returned 0 [0062.167] lstrlenA (lpString="*.gif") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.png") returned 0 [0062.167] lstrlenA (lpString="*.png") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.doc") returned 0 [0062.167] lstrlenA (lpString="*.doc") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.docx") returned 0 [0062.167] lstrlenA (lpString="*.docx") returned 6 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.xls") returned 0 [0062.167] lstrlenA (lpString="*.xls") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.167] lstrlenA (lpString="*.xlsx") returned 6 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.167] lstrlenA (lpString="*.ppt") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.167] lstrlenA (lpString="*.pptx") returned 6 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.txt") returned 0 [0062.167] lstrlenA (lpString="*.txt") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.167] lstrlenA (lpString="*.pdf") returned 5 [0062.167] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.167] lstrlenA (lpString="*.djvu") returned 6 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.htm") returned 0 [0062.168] lstrlenA (lpString="*.htm") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.html") returned 0 [0062.168] lstrlenA (lpString="*.html") returned 6 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.168] lstrlenA (lpString="*.mdb") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.cer") returned 0 [0062.168] lstrlenA (lpString="*.cer") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.p12") returned 0 [0062.168] lstrlenA (lpString="*.p12") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.168] lstrlenA (lpString="*.pfx") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.168] lstrlenA (lpString="*.kwm") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.168] lstrlenA (lpString="*.pwm") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.168] lstrlenA (lpString="*.1cd") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.md") returned 0 [0062.168] lstrlenA (lpString="*.md") returned 4 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.168] lstrlenA (lpString="*.mdf") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.168] lstrlenA (lpString="*.dbf") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.odt") returned 0 [0062.168] lstrlenA (lpString="*.odt") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.vob") returned 0 [0062.168] lstrlenA (lpString="*.vob") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.168] lstrlenA (lpString="*.ifo") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.168] lstrlenA (lpString="*.lnk") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.168] lstrlenA (lpString="*.torrent") returned 9 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mov") returned 0 [0062.168] lstrlenA (lpString="*.mov") returned 5 [0062.168] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.168] lstrlenA (lpString="*.m2v") returned 5 [0062.169] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.195] lstrlenA (lpString="*.3gp") returned 5 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.195] lstrlenA (lpString="*.mpeg") returned 6 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.195] lstrlenA (lpString="*.mpg") returned 5 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.flv") returned 0 [0062.195] lstrlenA (lpString="*.flv") returned 5 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.avi") returned 0 [0062.195] lstrlenA (lpString="*.avi") returned 5 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.195] lstrlenA (lpString="*.mp4") returned 5 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.195] lstrlenA (lpString="*.wmv") returned 5 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.divx") returned 0 [0062.195] lstrlenA (lpString="*.divx") returned 6 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.195] lstrlenA (lpString="*.mkv") returned 5 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.195] lstrlenA (lpString="*.mp3") returned 5 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.wav") returned 0 [0062.195] lstrlenA (lpString="*.wav") returned 5 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.flac") returned 0 [0062.195] lstrlenA (lpString="*.flac") returned 6 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.ape") returned 0 [0062.195] lstrlenA (lpString="*.ape") returned 5 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.wma") returned 0 [0062.195] lstrlenA (lpString="*.wma") returned 5 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.195] lstrlenA (lpString="*.ac3") returned 5 [0062.195] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\eula.rtf", pszSpec="*.doc") returned 0 [0062.195] lstrlenA (lpString="*.doc") returned 5 [0062.196] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.196] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.196] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.196] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.196] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.196] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned="eula.rtf" [0062.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1040\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0062.196] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1040\\" | out: pszPath="C:\\588bce7c90097ed212\\1040\\") returned="" [0062.196] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1040\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1040\\HOW TO DECRYPT FILES.txt" [0062.196] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1040\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\how to decrypt files.txt")) returned 0x20 [0062.196] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" [0062.196] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.196] lstrlenA (lpString="*.zip") returned 5 [0062.196] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.196] lstrlenA (lpString="*.rar") returned 5 [0062.196] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.196] lstrlenA (lpString="*.7z") returned 4 [0062.196] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.196] lstrlenA (lpString="*.tar") returned 5 [0062.196] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.196] lstrlenA (lpString="*.gzip") returned 6 [0062.196] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.196] lstrlenA (lpString="*.jpg") returned 5 [0062.196] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.196] lstrlenA (lpString="*.jpeg") returned 6 [0062.196] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.196] lstrlenA (lpString="*.psd") returned 5 [0062.196] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.196] lstrlenA (lpString="*.cdr") returned 5 [0062.196] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.196] lstrlenA (lpString="*.dwg") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.197] lstrlenA (lpString="*.max") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.197] lstrlenA (lpString="*.bmp") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.197] lstrlenA (lpString="*.gif") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.197] lstrlenA (lpString="*.png") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.197] lstrlenA (lpString="*.doc") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.197] lstrlenA (lpString="*.docx") returned 6 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.197] lstrlenA (lpString="*.xls") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.197] lstrlenA (lpString="*.xlsx") returned 6 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.197] lstrlenA (lpString="*.ppt") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.197] lstrlenA (lpString="*.pptx") returned 6 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.197] lstrlenA (lpString="*.txt") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.197] lstrlenA (lpString="*.pdf") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.197] lstrlenA (lpString="*.djvu") returned 6 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.197] lstrlenA (lpString="*.htm") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.197] lstrlenA (lpString="*.html") returned 6 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.197] lstrlenA (lpString="*.mdb") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.197] lstrlenA (lpString="*.cer") returned 5 [0062.197] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.197] lstrlenA (lpString="*.p12") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.198] lstrlenA (lpString="*.pfx") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.198] lstrlenA (lpString="*.kwm") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.198] lstrlenA (lpString="*.pwm") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.198] lstrlenA (lpString="*.1cd") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.198] lstrlenA (lpString="*.md") returned 4 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.198] lstrlenA (lpString="*.mdf") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.198] lstrlenA (lpString="*.dbf") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.198] lstrlenA (lpString="*.odt") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.198] lstrlenA (lpString="*.vob") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.198] lstrlenA (lpString="*.ifo") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.198] lstrlenA (lpString="*.lnk") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.198] lstrlenA (lpString="*.torrent") returned 9 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.198] lstrlenA (lpString="*.mov") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.198] lstrlenA (lpString="*.m2v") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.198] lstrlenA (lpString="*.3gp") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.198] lstrlenA (lpString="*.mpeg") returned 6 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.198] lstrlenA (lpString="*.mpg") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.198] lstrlenA (lpString="*.flv") returned 5 [0062.198] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.198] lstrlenA (lpString="*.avi") returned 5 [0062.199] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.199] lstrlenA (lpString="*.mp4") returned 5 [0062.199] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.199] lstrlenA (lpString="*.wmv") returned 5 [0062.199] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.199] lstrlenA (lpString="*.divx") returned 6 [0062.199] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.199] lstrlenA (lpString="*.mkv") returned 5 [0062.199] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.199] lstrlenA (lpString="*.mp3") returned 5 [0062.199] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.199] lstrlenA (lpString="*.wav") returned 5 [0062.199] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.199] lstrlenA (lpString="*.flac") returned 6 [0062.199] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.199] lstrlenA (lpString="*.ape") returned 5 [0062.199] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.199] lstrlenA (lpString="*.wma") returned 5 [0062.199] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.199] lstrlenA (lpString="*.ac3") returned 5 [0062.199] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.199] lstrlenA (lpString="*.doc") returned 5 [0062.199] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.199] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.199] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.199] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.199] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned="LocalizedData.xml" [0062.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1040\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0062.199] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1040\\" | out: pszPath="C:\\588bce7c90097ed212\\1040\\") returned="" [0062.199] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1040\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1040\\HOW TO DECRYPT FILES.txt" [0062.199] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1040\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\how to decrypt files.txt")) returned 0x20 [0062.199] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" [0062.199] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.199] lstrlenA (lpString="*.zip") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.200] lstrlenA (lpString="*.rar") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.200] lstrlenA (lpString="*.7z") returned 4 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.200] lstrlenA (lpString="*.tar") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.200] lstrlenA (lpString="*.gzip") returned 6 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.200] lstrlenA (lpString="*.jpg") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.200] lstrlenA (lpString="*.jpeg") returned 6 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.200] lstrlenA (lpString="*.psd") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.200] lstrlenA (lpString="*.cdr") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.200] lstrlenA (lpString="*.dwg") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.200] lstrlenA (lpString="*.max") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.200] lstrlenA (lpString="*.bmp") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.200] lstrlenA (lpString="*.gif") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.200] lstrlenA (lpString="*.png") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.200] lstrlenA (lpString="*.doc") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.200] lstrlenA (lpString="*.docx") returned 6 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.200] lstrlenA (lpString="*.xls") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.200] lstrlenA (lpString="*.xlsx") returned 6 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.200] lstrlenA (lpString="*.ppt") returned 5 [0062.200] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.200] lstrlenA (lpString="*.pptx") returned 6 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.201] lstrlenA (lpString="*.txt") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.201] lstrlenA (lpString="*.pdf") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.201] lstrlenA (lpString="*.djvu") returned 6 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.201] lstrlenA (lpString="*.htm") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.201] lstrlenA (lpString="*.html") returned 6 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.201] lstrlenA (lpString="*.mdb") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.201] lstrlenA (lpString="*.cer") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.201] lstrlenA (lpString="*.p12") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.201] lstrlenA (lpString="*.pfx") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.201] lstrlenA (lpString="*.kwm") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.201] lstrlenA (lpString="*.pwm") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.201] lstrlenA (lpString="*.1cd") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.201] lstrlenA (lpString="*.md") returned 4 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.201] lstrlenA (lpString="*.mdf") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.201] lstrlenA (lpString="*.dbf") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.201] lstrlenA (lpString="*.odt") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.201] lstrlenA (lpString="*.vob") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.201] lstrlenA (lpString="*.ifo") returned 5 [0062.201] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.202] lstrlenA (lpString="*.lnk") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.202] lstrlenA (lpString="*.torrent") returned 9 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.202] lstrlenA (lpString="*.mov") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.202] lstrlenA (lpString="*.m2v") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.202] lstrlenA (lpString="*.3gp") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.202] lstrlenA (lpString="*.mpeg") returned 6 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.202] lstrlenA (lpString="*.mpg") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.202] lstrlenA (lpString="*.flv") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.202] lstrlenA (lpString="*.avi") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.202] lstrlenA (lpString="*.mp4") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.202] lstrlenA (lpString="*.wmv") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.202] lstrlenA (lpString="*.divx") returned 6 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.202] lstrlenA (lpString="*.mkv") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.202] lstrlenA (lpString="*.mp3") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.202] lstrlenA (lpString="*.wav") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.203] lstrlenA (lpString="*.flac") returned 6 [0062.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.203] lstrlenA (lpString="*.ape") returned 5 [0062.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.203] lstrlenA (lpString="*.wma") returned 5 [0062.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.203] lstrlenA (lpString="*.ac3") returned 5 [0062.203] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.203] lstrlenA (lpString="*.doc") returned 5 [0062.203] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.203] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0062.203] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1041", cAlternateFileName="")) returned 1 [0062.203] lstrcmpA (lpString1=".", lpString2="1041") returned -1 [0062.203] lstrcmpA (lpString1="..", lpString2="1041") returned -1 [0062.203] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.203] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1041" | out: lpString1="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0062.203] lstrlenA (lpString="C:\\588bce7c90097ed212\\1041") returned 26 [0062.203] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d90 [0062.204] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.204] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.204] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.204] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.204] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.204] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.204] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.204] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.204] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1041\\*.*") returned="*.*" [0062.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1041\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0062.204] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1041\\" | out: pszPath="C:\\588bce7c90097ed212\\1041\\") returned="" [0062.204] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1041\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1041\\HOW TO DECRYPT FILES.txt" [0062.204] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1041\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\how to decrypt files.txt")) returned 0xffffffff [0062.204] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1041\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.207] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.207] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.208] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.208] CloseHandle (hObject=0x208) returned 1 [0062.208] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf" [0062.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.zip") returned 0 [0062.208] lstrlenA (lpString="*.zip") returned 5 [0062.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.rar") returned 0 [0062.208] lstrlenA (lpString="*.rar") returned 5 [0062.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.7z") returned 0 [0062.208] lstrlenA (lpString="*.7z") returned 4 [0062.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.tar") returned 0 [0062.208] lstrlenA (lpString="*.tar") returned 5 [0062.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.208] lstrlenA (lpString="*.gzip") returned 6 [0062.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.208] lstrlenA (lpString="*.jpg") returned 5 [0062.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.208] lstrlenA (lpString="*.jpeg") returned 6 [0062.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.psd") returned 0 [0062.208] lstrlenA (lpString="*.psd") returned 5 [0062.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.208] lstrlenA (lpString="*.cdr") returned 5 [0062.208] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.209] lstrlenA (lpString="*.dwg") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.max") returned 0 [0062.209] lstrlenA (lpString="*.max") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.209] lstrlenA (lpString="*.bmp") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.gif") returned 0 [0062.209] lstrlenA (lpString="*.gif") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.png") returned 0 [0062.209] lstrlenA (lpString="*.png") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.doc") returned 0 [0062.209] lstrlenA (lpString="*.doc") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.docx") returned 0 [0062.209] lstrlenA (lpString="*.docx") returned 6 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.xls") returned 0 [0062.209] lstrlenA (lpString="*.xls") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.209] lstrlenA (lpString="*.xlsx") returned 6 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.209] lstrlenA (lpString="*.ppt") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.209] lstrlenA (lpString="*.pptx") returned 6 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.txt") returned 0 [0062.209] lstrlenA (lpString="*.txt") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.209] lstrlenA (lpString="*.pdf") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.209] lstrlenA (lpString="*.djvu") returned 6 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.htm") returned 0 [0062.209] lstrlenA (lpString="*.htm") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.html") returned 0 [0062.209] lstrlenA (lpString="*.html") returned 6 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.209] lstrlenA (lpString="*.mdb") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.cer") returned 0 [0062.209] lstrlenA (lpString="*.cer") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.p12") returned 0 [0062.209] lstrlenA (lpString="*.p12") returned 5 [0062.209] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.210] lstrlenA (lpString="*.pfx") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.210] lstrlenA (lpString="*.kwm") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.210] lstrlenA (lpString="*.pwm") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.210] lstrlenA (lpString="*.1cd") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.md") returned 0 [0062.210] lstrlenA (lpString="*.md") returned 4 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.210] lstrlenA (lpString="*.mdf") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.210] lstrlenA (lpString="*.dbf") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.odt") returned 0 [0062.210] lstrlenA (lpString="*.odt") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.vob") returned 0 [0062.210] lstrlenA (lpString="*.vob") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.210] lstrlenA (lpString="*.ifo") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.210] lstrlenA (lpString="*.lnk") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.210] lstrlenA (lpString="*.torrent") returned 9 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mov") returned 0 [0062.210] lstrlenA (lpString="*.mov") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.210] lstrlenA (lpString="*.m2v") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.210] lstrlenA (lpString="*.3gp") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.210] lstrlenA (lpString="*.mpeg") returned 6 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.210] lstrlenA (lpString="*.mpg") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.flv") returned 0 [0062.210] lstrlenA (lpString="*.flv") returned 5 [0062.210] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.avi") returned 0 [0062.210] lstrlenA (lpString="*.avi") returned 5 [0062.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.211] lstrlenA (lpString="*.mp4") returned 5 [0062.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.211] lstrlenA (lpString="*.wmv") returned 5 [0062.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.divx") returned 0 [0062.211] lstrlenA (lpString="*.divx") returned 6 [0062.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.211] lstrlenA (lpString="*.mkv") returned 5 [0062.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.211] lstrlenA (lpString="*.mp3") returned 5 [0062.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.wav") returned 0 [0062.211] lstrlenA (lpString="*.wav") returned 5 [0062.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.flac") returned 0 [0062.211] lstrlenA (lpString="*.flac") returned 6 [0062.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.ape") returned 0 [0062.211] lstrlenA (lpString="*.ape") returned 5 [0062.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.wma") returned 0 [0062.211] lstrlenA (lpString="*.wma") returned 5 [0062.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.211] lstrlenA (lpString="*.ac3") returned 5 [0062.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\eula.rtf", pszSpec="*.doc") returned 0 [0062.211] lstrlenA (lpString="*.doc") returned 5 [0062.211] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.211] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.211] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.211] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned="eula.rtf" [0062.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1041\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0062.211] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1041\\" | out: pszPath="C:\\588bce7c90097ed212\\1041\\") returned="" [0062.211] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1041\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1041\\HOW TO DECRYPT FILES.txt" [0062.211] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1041\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\how to decrypt files.txt")) returned 0x20 [0062.211] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" [0062.211] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.212] lstrlenA (lpString="*.zip") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.212] lstrlenA (lpString="*.rar") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.212] lstrlenA (lpString="*.7z") returned 4 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.212] lstrlenA (lpString="*.tar") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.212] lstrlenA (lpString="*.gzip") returned 6 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.212] lstrlenA (lpString="*.jpg") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.212] lstrlenA (lpString="*.jpeg") returned 6 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.212] lstrlenA (lpString="*.psd") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.212] lstrlenA (lpString="*.cdr") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.212] lstrlenA (lpString="*.dwg") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.212] lstrlenA (lpString="*.max") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.212] lstrlenA (lpString="*.bmp") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.212] lstrlenA (lpString="*.gif") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.212] lstrlenA (lpString="*.png") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.212] lstrlenA (lpString="*.doc") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.212] lstrlenA (lpString="*.docx") returned 6 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.212] lstrlenA (lpString="*.xls") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.212] lstrlenA (lpString="*.xlsx") returned 6 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.212] lstrlenA (lpString="*.ppt") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.212] lstrlenA (lpString="*.pptx") returned 6 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.213] lstrlenA (lpString="*.txt") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.213] lstrlenA (lpString="*.pdf") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.213] lstrlenA (lpString="*.djvu") returned 6 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.213] lstrlenA (lpString="*.htm") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.213] lstrlenA (lpString="*.html") returned 6 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.213] lstrlenA (lpString="*.mdb") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.213] lstrlenA (lpString="*.cer") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.213] lstrlenA (lpString="*.p12") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.213] lstrlenA (lpString="*.pfx") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.213] lstrlenA (lpString="*.kwm") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.213] lstrlenA (lpString="*.pwm") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.213] lstrlenA (lpString="*.1cd") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.213] lstrlenA (lpString="*.md") returned 4 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.213] lstrlenA (lpString="*.mdf") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.213] lstrlenA (lpString="*.dbf") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.213] lstrlenA (lpString="*.odt") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.213] lstrlenA (lpString="*.vob") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.213] lstrlenA (lpString="*.ifo") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.214] lstrlenA (lpString="*.lnk") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.214] lstrlenA (lpString="*.torrent") returned 9 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.214] lstrlenA (lpString="*.mov") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.214] lstrlenA (lpString="*.m2v") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.214] lstrlenA (lpString="*.3gp") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.214] lstrlenA (lpString="*.mpeg") returned 6 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.214] lstrlenA (lpString="*.mpg") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.214] lstrlenA (lpString="*.flv") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.214] lstrlenA (lpString="*.avi") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.214] lstrlenA (lpString="*.mp4") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.214] lstrlenA (lpString="*.wmv") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.214] lstrlenA (lpString="*.divx") returned 6 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.214] lstrlenA (lpString="*.mkv") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.214] lstrlenA (lpString="*.mp3") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.214] lstrlenA (lpString="*.wav") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.214] lstrlenA (lpString="*.flac") returned 6 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.214] lstrlenA (lpString="*.ape") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.214] lstrlenA (lpString="*.wma") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.214] lstrlenA (lpString="*.ac3") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.215] lstrlenA (lpString="*.doc") returned 5 [0062.215] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.215] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.215] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.215] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.215] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned="LocalizedData.xml" [0062.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1041\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0062.215] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1041\\" | out: pszPath="C:\\588bce7c90097ed212\\1041\\") returned="" [0062.215] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1041\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1041\\HOW TO DECRYPT FILES.txt" [0062.215] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1041\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\how to decrypt files.txt")) returned 0x20 [0062.215] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.215] lstrlenA (lpString="*.zip") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.215] lstrlenA (lpString="*.rar") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.215] lstrlenA (lpString="*.7z") returned 4 [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.215] lstrlenA (lpString="*.tar") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.215] lstrlenA (lpString="*.gzip") returned 6 [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.215] lstrlenA (lpString="*.jpg") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.215] lstrlenA (lpString="*.jpeg") returned 6 [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.215] lstrlenA (lpString="*.psd") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.215] lstrlenA (lpString="*.cdr") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.215] lstrlenA (lpString="*.dwg") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.215] lstrlenA (lpString="*.max") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.216] lstrlenA (lpString="*.bmp") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.216] lstrlenA (lpString="*.gif") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.216] lstrlenA (lpString="*.png") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.216] lstrlenA (lpString="*.doc") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.216] lstrlenA (lpString="*.docx") returned 6 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.216] lstrlenA (lpString="*.xls") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.216] lstrlenA (lpString="*.xlsx") returned 6 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.216] lstrlenA (lpString="*.ppt") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.216] lstrlenA (lpString="*.pptx") returned 6 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.216] lstrlenA (lpString="*.txt") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.216] lstrlenA (lpString="*.pdf") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.216] lstrlenA (lpString="*.djvu") returned 6 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.216] lstrlenA (lpString="*.htm") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.216] lstrlenA (lpString="*.html") returned 6 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.216] lstrlenA (lpString="*.mdb") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.216] lstrlenA (lpString="*.cer") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.216] lstrlenA (lpString="*.p12") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.216] lstrlenA (lpString="*.pfx") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.216] lstrlenA (lpString="*.kwm") returned 5 [0062.216] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.217] lstrlenA (lpString="*.pwm") returned 5 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.217] lstrlenA (lpString="*.1cd") returned 5 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.217] lstrlenA (lpString="*.md") returned 4 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.217] lstrlenA (lpString="*.mdf") returned 5 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.217] lstrlenA (lpString="*.dbf") returned 5 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.217] lstrlenA (lpString="*.odt") returned 5 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.217] lstrlenA (lpString="*.vob") returned 5 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.217] lstrlenA (lpString="*.ifo") returned 5 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.217] lstrlenA (lpString="*.lnk") returned 5 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.217] lstrlenA (lpString="*.torrent") returned 9 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.217] lstrlenA (lpString="*.mov") returned 5 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.217] lstrlenA (lpString="*.m2v") returned 5 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.217] lstrlenA (lpString="*.3gp") returned 5 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.217] lstrlenA (lpString="*.mpeg") returned 6 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.217] lstrlenA (lpString="*.mpg") returned 5 [0062.217] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.217] lstrlenA (lpString="*.flv") returned 5 [0062.219] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.219] lstrlenA (lpString="*.avi") returned 5 [0062.219] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.219] lstrlenA (lpString="*.mp4") returned 5 [0062.219] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.219] lstrlenA (lpString="*.wmv") returned 5 [0062.219] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.219] lstrlenA (lpString="*.divx") returned 6 [0062.219] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.219] lstrlenA (lpString="*.mkv") returned 5 [0062.219] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.219] lstrlenA (lpString="*.mp3") returned 5 [0062.219] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.219] lstrlenA (lpString="*.wav") returned 5 [0062.219] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.219] lstrlenA (lpString="*.flac") returned 6 [0062.219] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.219] lstrlenA (lpString="*.ape") returned 5 [0062.219] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.219] lstrlenA (lpString="*.wma") returned 5 [0062.219] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.219] lstrlenA (lpString="*.ac3") returned 5 [0062.220] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.220] lstrlenA (lpString="*.doc") returned 5 [0062.220] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.220] FindClose (in: hFindFile=0x759d90 | out: hFindFile=0x759d90) returned 1 [0062.220] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1042", cAlternateFileName="")) returned 1 [0062.220] lstrcmpA (lpString1=".", lpString2="1042") returned -1 [0062.220] lstrcmpA (lpString1="..", lpString2="1042") returned -1 [0062.220] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.220] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1042" | out: lpString1="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0062.220] lstrlenA (lpString="C:\\588bce7c90097ed212\\1042") returned 26 [0062.220] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0062.220] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.220] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.220] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.220] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.220] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.220] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.220] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.220] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1042\\*.*") returned="*.*" [0062.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1042\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0062.220] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1042\\" | out: pszPath="C:\\588bce7c90097ed212\\1042\\") returned="" [0062.221] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1042\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1042\\HOW TO DECRYPT FILES.txt" [0062.221] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1042\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\how to decrypt files.txt")) returned 0xffffffff [0062.221] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1042\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.222] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.222] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.223] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.223] CloseHandle (hObject=0x208) returned 1 [0062.224] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf" [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.zip") returned 0 [0062.224] lstrlenA (lpString="*.zip") returned 5 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.rar") returned 0 [0062.224] lstrlenA (lpString="*.rar") returned 5 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.7z") returned 0 [0062.224] lstrlenA (lpString="*.7z") returned 4 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.tar") returned 0 [0062.224] lstrlenA (lpString="*.tar") returned 5 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.224] lstrlenA (lpString="*.gzip") returned 6 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.224] lstrlenA (lpString="*.jpg") returned 5 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.224] lstrlenA (lpString="*.jpeg") returned 6 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.psd") returned 0 [0062.224] lstrlenA (lpString="*.psd") returned 5 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.224] lstrlenA (lpString="*.cdr") returned 5 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.224] lstrlenA (lpString="*.dwg") returned 5 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.max") returned 0 [0062.224] lstrlenA (lpString="*.max") returned 5 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.224] lstrlenA (lpString="*.bmp") returned 5 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.gif") returned 0 [0062.224] lstrlenA (lpString="*.gif") returned 5 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.png") returned 0 [0062.224] lstrlenA (lpString="*.png") returned 5 [0062.224] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.doc") returned 0 [0062.224] lstrlenA (lpString="*.doc") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.docx") returned 0 [0062.225] lstrlenA (lpString="*.docx") returned 6 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.xls") returned 0 [0062.225] lstrlenA (lpString="*.xls") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.225] lstrlenA (lpString="*.xlsx") returned 6 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.225] lstrlenA (lpString="*.ppt") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.225] lstrlenA (lpString="*.pptx") returned 6 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.txt") returned 0 [0062.225] lstrlenA (lpString="*.txt") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.225] lstrlenA (lpString="*.pdf") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.225] lstrlenA (lpString="*.djvu") returned 6 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.htm") returned 0 [0062.225] lstrlenA (lpString="*.htm") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.html") returned 0 [0062.225] lstrlenA (lpString="*.html") returned 6 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.225] lstrlenA (lpString="*.mdb") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.cer") returned 0 [0062.225] lstrlenA (lpString="*.cer") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.p12") returned 0 [0062.225] lstrlenA (lpString="*.p12") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.225] lstrlenA (lpString="*.pfx") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.225] lstrlenA (lpString="*.kwm") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.225] lstrlenA (lpString="*.pwm") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.225] lstrlenA (lpString="*.1cd") returned 5 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.md") returned 0 [0062.225] lstrlenA (lpString="*.md") returned 4 [0062.225] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.226] lstrlenA (lpString="*.mdf") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.226] lstrlenA (lpString="*.dbf") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.odt") returned 0 [0062.226] lstrlenA (lpString="*.odt") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.vob") returned 0 [0062.226] lstrlenA (lpString="*.vob") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.226] lstrlenA (lpString="*.ifo") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.226] lstrlenA (lpString="*.lnk") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.226] lstrlenA (lpString="*.torrent") returned 9 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mov") returned 0 [0062.226] lstrlenA (lpString="*.mov") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.226] lstrlenA (lpString="*.m2v") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.226] lstrlenA (lpString="*.3gp") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.226] lstrlenA (lpString="*.mpeg") returned 6 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.226] lstrlenA (lpString="*.mpg") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.flv") returned 0 [0062.226] lstrlenA (lpString="*.flv") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.avi") returned 0 [0062.226] lstrlenA (lpString="*.avi") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.226] lstrlenA (lpString="*.mp4") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.226] lstrlenA (lpString="*.wmv") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.divx") returned 0 [0062.226] lstrlenA (lpString="*.divx") returned 6 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.226] lstrlenA (lpString="*.mkv") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.226] lstrlenA (lpString="*.mp3") returned 5 [0062.226] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.wav") returned 0 [0062.227] lstrlenA (lpString="*.wav") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.flac") returned 0 [0062.227] lstrlenA (lpString="*.flac") returned 6 [0062.227] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.ape") returned 0 [0062.227] lstrlenA (lpString="*.ape") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.wma") returned 0 [0062.227] lstrlenA (lpString="*.wma") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.227] lstrlenA (lpString="*.ac3") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\eula.rtf", pszSpec="*.doc") returned 0 [0062.227] lstrlenA (lpString="*.doc") returned 5 [0062.227] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.227] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.227] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.227] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.227] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned="eula.rtf" [0062.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1042\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0062.227] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1042\\" | out: pszPath="C:\\588bce7c90097ed212\\1042\\") returned="" [0062.227] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1042\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1042\\HOW TO DECRYPT FILES.txt" [0062.227] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1042\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\how to decrypt files.txt")) returned 0x20 [0062.227] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" [0062.227] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.227] lstrlenA (lpString="*.zip") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.227] lstrlenA (lpString="*.rar") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.227] lstrlenA (lpString="*.7z") returned 4 [0062.227] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.227] lstrlenA (lpString="*.tar") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.227] lstrlenA (lpString="*.gzip") returned 6 [0062.227] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.227] lstrlenA (lpString="*.jpg") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.228] lstrlenA (lpString="*.jpeg") returned 6 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.228] lstrlenA (lpString="*.psd") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.228] lstrlenA (lpString="*.cdr") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.228] lstrlenA (lpString="*.dwg") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.228] lstrlenA (lpString="*.max") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.228] lstrlenA (lpString="*.bmp") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.228] lstrlenA (lpString="*.gif") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.228] lstrlenA (lpString="*.png") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.228] lstrlenA (lpString="*.doc") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.228] lstrlenA (lpString="*.docx") returned 6 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.228] lstrlenA (lpString="*.xls") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.228] lstrlenA (lpString="*.xlsx") returned 6 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.228] lstrlenA (lpString="*.ppt") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.228] lstrlenA (lpString="*.pptx") returned 6 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.228] lstrlenA (lpString="*.txt") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.228] lstrlenA (lpString="*.pdf") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.228] lstrlenA (lpString="*.djvu") returned 6 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.228] lstrlenA (lpString="*.htm") returned 5 [0062.228] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.228] lstrlenA (lpString="*.html") returned 6 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.229] lstrlenA (lpString="*.mdb") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.229] lstrlenA (lpString="*.cer") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.229] lstrlenA (lpString="*.p12") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.229] lstrlenA (lpString="*.pfx") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.229] lstrlenA (lpString="*.kwm") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.229] lstrlenA (lpString="*.pwm") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.229] lstrlenA (lpString="*.1cd") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.229] lstrlenA (lpString="*.md") returned 4 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.229] lstrlenA (lpString="*.mdf") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.229] lstrlenA (lpString="*.dbf") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.229] lstrlenA (lpString="*.odt") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.229] lstrlenA (lpString="*.vob") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.229] lstrlenA (lpString="*.ifo") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.229] lstrlenA (lpString="*.lnk") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.229] lstrlenA (lpString="*.torrent") returned 9 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.229] lstrlenA (lpString="*.mov") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.229] lstrlenA (lpString="*.m2v") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.229] lstrlenA (lpString="*.3gp") returned 5 [0062.229] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.230] lstrlenA (lpString="*.mpeg") returned 6 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.230] lstrlenA (lpString="*.mpg") returned 5 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.230] lstrlenA (lpString="*.flv") returned 5 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.230] lstrlenA (lpString="*.avi") returned 5 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.230] lstrlenA (lpString="*.mp4") returned 5 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.230] lstrlenA (lpString="*.wmv") returned 5 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.230] lstrlenA (lpString="*.divx") returned 6 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.230] lstrlenA (lpString="*.mkv") returned 5 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.230] lstrlenA (lpString="*.mp3") returned 5 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.230] lstrlenA (lpString="*.wav") returned 5 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.230] lstrlenA (lpString="*.flac") returned 6 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.230] lstrlenA (lpString="*.ape") returned 5 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.230] lstrlenA (lpString="*.wma") returned 5 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.230] lstrlenA (lpString="*.ac3") returned 5 [0062.230] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.230] lstrlenA (lpString="*.doc") returned 5 [0062.230] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.230] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.230] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.230] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned="LocalizedData.xml" [0062.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1042\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0062.231] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1042\\" | out: pszPath="C:\\588bce7c90097ed212\\1042\\") returned="" [0062.231] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1042\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1042\\HOW TO DECRYPT FILES.txt" [0062.231] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1042\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\how to decrypt files.txt")) returned 0x20 [0062.231] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.231] lstrlenA (lpString="*.zip") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.231] lstrlenA (lpString="*.rar") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.231] lstrlenA (lpString="*.7z") returned 4 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.231] lstrlenA (lpString="*.tar") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.231] lstrlenA (lpString="*.gzip") returned 6 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.231] lstrlenA (lpString="*.jpg") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.231] lstrlenA (lpString="*.jpeg") returned 6 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.231] lstrlenA (lpString="*.psd") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.231] lstrlenA (lpString="*.cdr") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.231] lstrlenA (lpString="*.dwg") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.231] lstrlenA (lpString="*.max") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.231] lstrlenA (lpString="*.bmp") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.231] lstrlenA (lpString="*.gif") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.231] lstrlenA (lpString="*.png") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.231] lstrlenA (lpString="*.doc") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.232] lstrlenA (lpString="*.docx") returned 6 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.232] lstrlenA (lpString="*.xls") returned 5 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.232] lstrlenA (lpString="*.xlsx") returned 6 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.232] lstrlenA (lpString="*.ppt") returned 5 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.232] lstrlenA (lpString="*.pptx") returned 6 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.232] lstrlenA (lpString="*.txt") returned 5 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.232] lstrlenA (lpString="*.pdf") returned 5 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.232] lstrlenA (lpString="*.djvu") returned 6 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.232] lstrlenA (lpString="*.htm") returned 5 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.232] lstrlenA (lpString="*.html") returned 6 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.232] lstrlenA (lpString="*.mdb") returned 5 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.232] lstrlenA (lpString="*.cer") returned 5 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.232] lstrlenA (lpString="*.p12") returned 5 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.232] lstrlenA (lpString="*.pfx") returned 5 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.232] lstrlenA (lpString="*.kwm") returned 5 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.232] lstrlenA (lpString="*.pwm") returned 5 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.232] lstrlenA (lpString="*.1cd") returned 5 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.232] lstrlenA (lpString="*.md") returned 4 [0062.232] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.232] lstrlenA (lpString="*.mdf") returned 5 [0062.233] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.233] lstrlenA (lpString="*.dbf") returned 5 [0062.233] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.233] lstrlenA (lpString="*.odt") returned 5 [0062.233] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.233] lstrlenA (lpString="*.vob") returned 5 [0062.233] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.233] lstrlenA (lpString="*.ifo") returned 5 [0062.233] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.233] lstrlenA (lpString="*.lnk") returned 5 [0062.233] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.233] lstrlenA (lpString="*.torrent") returned 9 [0062.233] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.233] lstrlenA (lpString="*.mov") returned 5 [0062.233] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.233] lstrlenA (lpString="*.m2v") returned 5 [0062.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.262] lstrlenA (lpString="*.3gp") returned 5 [0062.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.262] lstrlenA (lpString="*.mpeg") returned 6 [0062.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.262] lstrlenA (lpString="*.mpg") returned 5 [0062.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.262] lstrlenA (lpString="*.flv") returned 5 [0062.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.262] lstrlenA (lpString="*.avi") returned 5 [0062.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.262] lstrlenA (lpString="*.mp4") returned 5 [0062.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.262] lstrlenA (lpString="*.wmv") returned 5 [0062.262] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.262] lstrlenA (lpString="*.divx") returned 6 [0062.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.263] lstrlenA (lpString="*.mkv") returned 5 [0062.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.263] lstrlenA (lpString="*.mp3") returned 5 [0062.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.263] lstrlenA (lpString="*.wav") returned 5 [0062.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.263] lstrlenA (lpString="*.flac") returned 6 [0062.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.263] lstrlenA (lpString="*.ape") returned 5 [0062.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.263] lstrlenA (lpString="*.wma") returned 5 [0062.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.263] lstrlenA (lpString="*.ac3") returned 5 [0062.263] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.263] lstrlenA (lpString="*.doc") returned 5 [0062.263] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.263] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0062.263] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1043", cAlternateFileName="")) returned 1 [0062.263] lstrcmpA (lpString1=".", lpString2="1043") returned -1 [0062.263] lstrcmpA (lpString1="..", lpString2="1043") returned -1 [0062.264] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.264] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1043" | out: lpString1="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0062.264] lstrlenA (lpString="C:\\588bce7c90097ed212\\1043") returned 26 [0062.264] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0062.264] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.264] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.264] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.264] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.264] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.264] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.264] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.264] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1043\\*.*") returned="*.*" [0062.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1043\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0062.264] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1043\\" | out: pszPath="C:\\588bce7c90097ed212\\1043\\") returned="" [0062.264] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1043\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1043\\HOW TO DECRYPT FILES.txt" [0062.264] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1043\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\how to decrypt files.txt")) returned 0xffffffff [0062.265] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1043\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.268] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.268] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.269] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.269] CloseHandle (hObject=0x208) returned 1 [0062.269] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf" [0062.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.zip") returned 0 [0062.269] lstrlenA (lpString="*.zip") returned 5 [0062.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.rar") returned 0 [0062.269] lstrlenA (lpString="*.rar") returned 5 [0062.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.7z") returned 0 [0062.269] lstrlenA (lpString="*.7z") returned 4 [0062.269] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.tar") returned 0 [0062.269] lstrlenA (lpString="*.tar") returned 5 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.270] lstrlenA (lpString="*.gzip") returned 6 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.270] lstrlenA (lpString="*.jpg") returned 5 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.270] lstrlenA (lpString="*.jpeg") returned 6 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.psd") returned 0 [0062.270] lstrlenA (lpString="*.psd") returned 5 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.270] lstrlenA (lpString="*.cdr") returned 5 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.270] lstrlenA (lpString="*.dwg") returned 5 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.max") returned 0 [0062.270] lstrlenA (lpString="*.max") returned 5 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.270] lstrlenA (lpString="*.bmp") returned 5 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.gif") returned 0 [0062.270] lstrlenA (lpString="*.gif") returned 5 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.png") returned 0 [0062.270] lstrlenA (lpString="*.png") returned 5 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.doc") returned 0 [0062.270] lstrlenA (lpString="*.doc") returned 5 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.docx") returned 0 [0062.270] lstrlenA (lpString="*.docx") returned 6 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.xls") returned 0 [0062.270] lstrlenA (lpString="*.xls") returned 5 [0062.270] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.270] lstrlenA (lpString="*.xlsx") returned 6 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.271] lstrlenA (lpString="*.ppt") returned 5 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.271] lstrlenA (lpString="*.pptx") returned 6 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.txt") returned 0 [0062.271] lstrlenA (lpString="*.txt") returned 5 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.271] lstrlenA (lpString="*.pdf") returned 5 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.271] lstrlenA (lpString="*.djvu") returned 6 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.htm") returned 0 [0062.271] lstrlenA (lpString="*.htm") returned 5 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.html") returned 0 [0062.271] lstrlenA (lpString="*.html") returned 6 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.271] lstrlenA (lpString="*.mdb") returned 5 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.cer") returned 0 [0062.271] lstrlenA (lpString="*.cer") returned 5 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.p12") returned 0 [0062.271] lstrlenA (lpString="*.p12") returned 5 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.271] lstrlenA (lpString="*.pfx") returned 5 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.271] lstrlenA (lpString="*.kwm") returned 5 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.271] lstrlenA (lpString="*.pwm") returned 5 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.271] lstrlenA (lpString="*.1cd") returned 5 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.md") returned 0 [0062.271] lstrlenA (lpString="*.md") returned 4 [0062.271] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.271] lstrlenA (lpString="*.mdf") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.272] lstrlenA (lpString="*.dbf") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.odt") returned 0 [0062.272] lstrlenA (lpString="*.odt") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.vob") returned 0 [0062.272] lstrlenA (lpString="*.vob") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.272] lstrlenA (lpString="*.ifo") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.272] lstrlenA (lpString="*.lnk") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.272] lstrlenA (lpString="*.torrent") returned 9 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mov") returned 0 [0062.272] lstrlenA (lpString="*.mov") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.272] lstrlenA (lpString="*.m2v") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.272] lstrlenA (lpString="*.3gp") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.272] lstrlenA (lpString="*.mpeg") returned 6 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.272] lstrlenA (lpString="*.mpg") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.flv") returned 0 [0062.272] lstrlenA (lpString="*.flv") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.avi") returned 0 [0062.272] lstrlenA (lpString="*.avi") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.272] lstrlenA (lpString="*.mp4") returned 5 [0062.272] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.272] lstrlenA (lpString="*.wmv") returned 5 [0062.273] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.divx") returned 0 [0062.273] lstrlenA (lpString="*.divx") returned 6 [0062.273] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.273] lstrlenA (lpString="*.mkv") returned 5 [0062.273] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.273] lstrlenA (lpString="*.mp3") returned 5 [0062.273] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.wav") returned 0 [0062.273] lstrlenA (lpString="*.wav") returned 5 [0062.273] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.flac") returned 0 [0062.273] lstrlenA (lpString="*.flac") returned 6 [0062.273] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.ape") returned 0 [0062.273] lstrlenA (lpString="*.ape") returned 5 [0062.273] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.wma") returned 0 [0062.273] lstrlenA (lpString="*.wma") returned 5 [0062.273] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.273] lstrlenA (lpString="*.ac3") returned 5 [0062.273] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\eula.rtf", pszSpec="*.doc") returned 0 [0062.273] lstrlenA (lpString="*.doc") returned 5 [0062.273] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.273] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.273] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.273] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned="eula.rtf" [0062.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1043\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0062.273] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1043\\" | out: pszPath="C:\\588bce7c90097ed212\\1043\\") returned="" [0062.273] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1043\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1043\\HOW TO DECRYPT FILES.txt" [0062.274] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1043\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\how to decrypt files.txt")) returned 0x20 [0062.274] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.274] lstrlenA (lpString="*.zip") returned 5 [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.274] lstrlenA (lpString="*.rar") returned 5 [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.274] lstrlenA (lpString="*.7z") returned 4 [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.274] lstrlenA (lpString="*.tar") returned 5 [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.274] lstrlenA (lpString="*.gzip") returned 6 [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.274] lstrlenA (lpString="*.jpg") returned 5 [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.274] lstrlenA (lpString="*.jpeg") returned 6 [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.274] lstrlenA (lpString="*.psd") returned 5 [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.274] lstrlenA (lpString="*.cdr") returned 5 [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.274] lstrlenA (lpString="*.dwg") returned 5 [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.274] lstrlenA (lpString="*.max") returned 5 [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.274] lstrlenA (lpString="*.bmp") returned 5 [0062.274] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.274] lstrlenA (lpString="*.gif") returned 5 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.275] lstrlenA (lpString="*.png") returned 5 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.275] lstrlenA (lpString="*.doc") returned 5 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.275] lstrlenA (lpString="*.docx") returned 6 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.275] lstrlenA (lpString="*.xls") returned 5 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.275] lstrlenA (lpString="*.xlsx") returned 6 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.275] lstrlenA (lpString="*.ppt") returned 5 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.275] lstrlenA (lpString="*.pptx") returned 6 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.275] lstrlenA (lpString="*.txt") returned 5 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.275] lstrlenA (lpString="*.pdf") returned 5 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.275] lstrlenA (lpString="*.djvu") returned 6 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.275] lstrlenA (lpString="*.htm") returned 5 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.275] lstrlenA (lpString="*.html") returned 6 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.275] lstrlenA (lpString="*.mdb") returned 5 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.275] lstrlenA (lpString="*.cer") returned 5 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.275] lstrlenA (lpString="*.p12") returned 5 [0062.275] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.276] lstrlenA (lpString="*.pfx") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.276] lstrlenA (lpString="*.kwm") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.276] lstrlenA (lpString="*.pwm") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.276] lstrlenA (lpString="*.1cd") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.276] lstrlenA (lpString="*.md") returned 4 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.276] lstrlenA (lpString="*.mdf") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.276] lstrlenA (lpString="*.dbf") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.276] lstrlenA (lpString="*.odt") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.276] lstrlenA (lpString="*.vob") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.276] lstrlenA (lpString="*.ifo") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.276] lstrlenA (lpString="*.lnk") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.276] lstrlenA (lpString="*.torrent") returned 9 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.276] lstrlenA (lpString="*.mov") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.276] lstrlenA (lpString="*.m2v") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.276] lstrlenA (lpString="*.3gp") returned 5 [0062.276] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.277] lstrlenA (lpString="*.mpeg") returned 6 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.277] lstrlenA (lpString="*.mpg") returned 5 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.277] lstrlenA (lpString="*.flv") returned 5 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.277] lstrlenA (lpString="*.avi") returned 5 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.277] lstrlenA (lpString="*.mp4") returned 5 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.277] lstrlenA (lpString="*.wmv") returned 5 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.277] lstrlenA (lpString="*.divx") returned 6 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.277] lstrlenA (lpString="*.mkv") returned 5 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.277] lstrlenA (lpString="*.mp3") returned 5 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.277] lstrlenA (lpString="*.wav") returned 5 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.277] lstrlenA (lpString="*.flac") returned 6 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.277] lstrlenA (lpString="*.ape") returned 5 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.277] lstrlenA (lpString="*.wma") returned 5 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.277] lstrlenA (lpString="*.ac3") returned 5 [0062.277] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.277] lstrlenA (lpString="*.doc") returned 5 [0062.278] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.278] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.278] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.278] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.278] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned="LocalizedData.xml" [0062.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1043\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0062.278] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1043\\" | out: pszPath="C:\\588bce7c90097ed212\\1043\\") returned="" [0062.278] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1043\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1043\\HOW TO DECRYPT FILES.txt" [0062.278] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1043\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\how to decrypt files.txt")) returned 0x20 [0062.278] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" [0062.278] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.278] lstrlenA (lpString="*.zip") returned 5 [0062.278] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.278] lstrlenA (lpString="*.rar") returned 5 [0062.278] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.278] lstrlenA (lpString="*.7z") returned 4 [0062.278] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.278] lstrlenA (lpString="*.tar") returned 5 [0062.278] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.278] lstrlenA (lpString="*.gzip") returned 6 [0062.278] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.278] lstrlenA (lpString="*.jpg") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.279] lstrlenA (lpString="*.jpeg") returned 6 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.279] lstrlenA (lpString="*.psd") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.279] lstrlenA (lpString="*.cdr") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.279] lstrlenA (lpString="*.dwg") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.279] lstrlenA (lpString="*.max") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.279] lstrlenA (lpString="*.bmp") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.279] lstrlenA (lpString="*.gif") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.279] lstrlenA (lpString="*.png") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.279] lstrlenA (lpString="*.doc") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.279] lstrlenA (lpString="*.docx") returned 6 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.279] lstrlenA (lpString="*.xls") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.279] lstrlenA (lpString="*.xlsx") returned 6 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.279] lstrlenA (lpString="*.ppt") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.279] lstrlenA (lpString="*.pptx") returned 6 [0062.280] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.280] lstrlenA (lpString="*.txt") returned 5 [0062.280] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.280] lstrlenA (lpString="*.pdf") returned 5 [0062.280] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.280] lstrlenA (lpString="*.djvu") returned 6 [0062.280] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.280] lstrlenA (lpString="*.htm") returned 5 [0062.280] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.280] lstrlenA (lpString="*.html") returned 6 [0062.281] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.281] lstrlenA (lpString="*.mdb") returned 5 [0062.281] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.281] lstrlenA (lpString="*.cer") returned 5 [0062.281] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.281] lstrlenA (lpString="*.p12") returned 5 [0062.281] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.281] lstrlenA (lpString="*.pfx") returned 5 [0062.281] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.281] lstrlenA (lpString="*.kwm") returned 5 [0062.281] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.281] lstrlenA (lpString="*.pwm") returned 5 [0062.281] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.281] lstrlenA (lpString="*.1cd") returned 5 [0062.281] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.281] lstrlenA (lpString="*.md") returned 4 [0062.281] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.281] lstrlenA (lpString="*.mdf") returned 5 [0062.281] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.281] lstrlenA (lpString="*.dbf") returned 5 [0062.281] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.281] lstrlenA (lpString="*.odt") returned 5 [0062.281] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.281] lstrlenA (lpString="*.vob") returned 5 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.282] lstrlenA (lpString="*.ifo") returned 5 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.282] lstrlenA (lpString="*.lnk") returned 5 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.282] lstrlenA (lpString="*.torrent") returned 9 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.282] lstrlenA (lpString="*.mov") returned 5 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.282] lstrlenA (lpString="*.m2v") returned 5 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.282] lstrlenA (lpString="*.3gp") returned 5 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.282] lstrlenA (lpString="*.mpeg") returned 6 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.282] lstrlenA (lpString="*.mpg") returned 5 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.282] lstrlenA (lpString="*.flv") returned 5 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.282] lstrlenA (lpString="*.avi") returned 5 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.282] lstrlenA (lpString="*.mp4") returned 5 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.282] lstrlenA (lpString="*.wmv") returned 5 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.282] lstrlenA (lpString="*.divx") returned 6 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.282] lstrlenA (lpString="*.mkv") returned 5 [0062.282] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.283] lstrlenA (lpString="*.mp3") returned 5 [0062.283] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.283] lstrlenA (lpString="*.wav") returned 5 [0062.283] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.283] lstrlenA (lpString="*.flac") returned 6 [0062.283] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.283] lstrlenA (lpString="*.ape") returned 5 [0062.283] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.283] lstrlenA (lpString="*.wma") returned 5 [0062.283] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.283] lstrlenA (lpString="*.ac3") returned 5 [0062.283] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.283] lstrlenA (lpString="*.doc") returned 5 [0062.283] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.283] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0062.283] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1044", cAlternateFileName="")) returned 1 [0062.283] lstrcmpA (lpString1=".", lpString2="1044") returned -1 [0062.283] lstrcmpA (lpString1="..", lpString2="1044") returned -1 [0062.283] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.283] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1044" | out: lpString1="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0062.283] lstrlenA (lpString="C:\\588bce7c90097ed212\\1044") returned 26 [0062.284] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0062.285] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.285] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.285] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.285] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.285] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.285] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.285] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.285] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.285] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.285] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1044\\*.*") returned="*.*" [0062.285] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1044\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0062.285] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1044\\" | out: pszPath="C:\\588bce7c90097ed212\\1044\\") returned="" [0062.285] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1044\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1044\\HOW TO DECRYPT FILES.txt" [0062.285] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1044\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\how to decrypt files.txt")) returned 0xffffffff [0062.285] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1044\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.288] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.288] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.289] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.289] CloseHandle (hObject=0x208) returned 1 [0062.290] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf" [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.zip") returned 0 [0062.290] lstrlenA (lpString="*.zip") returned 5 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.rar") returned 0 [0062.290] lstrlenA (lpString="*.rar") returned 5 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.7z") returned 0 [0062.290] lstrlenA (lpString="*.7z") returned 4 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.tar") returned 0 [0062.290] lstrlenA (lpString="*.tar") returned 5 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.290] lstrlenA (lpString="*.gzip") returned 6 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.290] lstrlenA (lpString="*.jpg") returned 5 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.290] lstrlenA (lpString="*.jpeg") returned 6 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.psd") returned 0 [0062.290] lstrlenA (lpString="*.psd") returned 5 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.290] lstrlenA (lpString="*.cdr") returned 5 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.290] lstrlenA (lpString="*.dwg") returned 5 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.max") returned 0 [0062.290] lstrlenA (lpString="*.max") returned 5 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.290] lstrlenA (lpString="*.bmp") returned 5 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.gif") returned 0 [0062.290] lstrlenA (lpString="*.gif") returned 5 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.png") returned 0 [0062.290] lstrlenA (lpString="*.png") returned 5 [0062.290] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.doc") returned 0 [0062.291] lstrlenA (lpString="*.doc") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.docx") returned 0 [0062.291] lstrlenA (lpString="*.docx") returned 6 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.xls") returned 0 [0062.291] lstrlenA (lpString="*.xls") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.291] lstrlenA (lpString="*.xlsx") returned 6 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.291] lstrlenA (lpString="*.ppt") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.291] lstrlenA (lpString="*.pptx") returned 6 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.txt") returned 0 [0062.291] lstrlenA (lpString="*.txt") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.291] lstrlenA (lpString="*.pdf") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.291] lstrlenA (lpString="*.djvu") returned 6 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.htm") returned 0 [0062.291] lstrlenA (lpString="*.htm") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.html") returned 0 [0062.291] lstrlenA (lpString="*.html") returned 6 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.291] lstrlenA (lpString="*.mdb") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.cer") returned 0 [0062.291] lstrlenA (lpString="*.cer") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.p12") returned 0 [0062.291] lstrlenA (lpString="*.p12") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.291] lstrlenA (lpString="*.pfx") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.291] lstrlenA (lpString="*.kwm") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.291] lstrlenA (lpString="*.pwm") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.291] lstrlenA (lpString="*.1cd") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.md") returned 0 [0062.291] lstrlenA (lpString="*.md") returned 4 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.292] lstrlenA (lpString="*.mdf") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.292] lstrlenA (lpString="*.dbf") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.odt") returned 0 [0062.292] lstrlenA (lpString="*.odt") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.vob") returned 0 [0062.292] lstrlenA (lpString="*.vob") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.292] lstrlenA (lpString="*.ifo") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.292] lstrlenA (lpString="*.lnk") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.292] lstrlenA (lpString="*.torrent") returned 9 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mov") returned 0 [0062.292] lstrlenA (lpString="*.mov") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.292] lstrlenA (lpString="*.m2v") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.292] lstrlenA (lpString="*.3gp") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.292] lstrlenA (lpString="*.mpeg") returned 6 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.292] lstrlenA (lpString="*.mpg") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.flv") returned 0 [0062.292] lstrlenA (lpString="*.flv") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.avi") returned 0 [0062.292] lstrlenA (lpString="*.avi") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.292] lstrlenA (lpString="*.mp4") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.292] lstrlenA (lpString="*.wmv") returned 5 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.divx") returned 0 [0062.292] lstrlenA (lpString="*.divx") returned 6 [0062.292] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.292] lstrlenA (lpString="*.mkv") returned 5 [0062.293] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.293] lstrlenA (lpString="*.mp3") returned 5 [0062.293] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.wav") returned 0 [0062.293] lstrlenA (lpString="*.wav") returned 5 [0062.293] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.flac") returned 0 [0062.293] lstrlenA (lpString="*.flac") returned 6 [0062.293] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.ape") returned 0 [0062.293] lstrlenA (lpString="*.ape") returned 5 [0062.293] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.wma") returned 0 [0062.293] lstrlenA (lpString="*.wma") returned 5 [0062.293] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.293] lstrlenA (lpString="*.ac3") returned 5 [0062.293] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\eula.rtf", pszSpec="*.doc") returned 0 [0062.293] lstrlenA (lpString="*.doc") returned 5 [0062.293] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.293] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.293] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.293] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.293] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned="eula.rtf" [0062.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1044\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0062.293] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1044\\" | out: pszPath="C:\\588bce7c90097ed212\\1044\\") returned="" [0062.293] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1044\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1044\\HOW TO DECRYPT FILES.txt" [0062.293] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1044\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\how to decrypt files.txt")) returned 0x20 [0062.293] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" [0062.293] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.293] lstrlenA (lpString="*.zip") returned 5 [0062.293] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.293] lstrlenA (lpString="*.rar") returned 5 [0062.293] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.294] lstrlenA (lpString="*.7z") returned 4 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.294] lstrlenA (lpString="*.tar") returned 5 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.294] lstrlenA (lpString="*.gzip") returned 6 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.294] lstrlenA (lpString="*.jpg") returned 5 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.294] lstrlenA (lpString="*.jpeg") returned 6 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.294] lstrlenA (lpString="*.psd") returned 5 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.294] lstrlenA (lpString="*.cdr") returned 5 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.294] lstrlenA (lpString="*.dwg") returned 5 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.294] lstrlenA (lpString="*.max") returned 5 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.294] lstrlenA (lpString="*.bmp") returned 5 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.294] lstrlenA (lpString="*.gif") returned 5 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.294] lstrlenA (lpString="*.png") returned 5 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.294] lstrlenA (lpString="*.doc") returned 5 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.294] lstrlenA (lpString="*.docx") returned 6 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.294] lstrlenA (lpString="*.xls") returned 5 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.294] lstrlenA (lpString="*.xlsx") returned 6 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.294] lstrlenA (lpString="*.ppt") returned 5 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.294] lstrlenA (lpString="*.pptx") returned 6 [0062.294] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.295] lstrlenA (lpString="*.txt") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.295] lstrlenA (lpString="*.pdf") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.295] lstrlenA (lpString="*.djvu") returned 6 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.295] lstrlenA (lpString="*.htm") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.295] lstrlenA (lpString="*.html") returned 6 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.295] lstrlenA (lpString="*.mdb") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.295] lstrlenA (lpString="*.cer") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.295] lstrlenA (lpString="*.p12") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.295] lstrlenA (lpString="*.pfx") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.295] lstrlenA (lpString="*.kwm") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.295] lstrlenA (lpString="*.pwm") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.295] lstrlenA (lpString="*.1cd") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.295] lstrlenA (lpString="*.md") returned 4 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.295] lstrlenA (lpString="*.mdf") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.295] lstrlenA (lpString="*.dbf") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.295] lstrlenA (lpString="*.odt") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.295] lstrlenA (lpString="*.vob") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.295] lstrlenA (lpString="*.ifo") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.296] lstrlenA (lpString="*.lnk") returned 5 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.296] lstrlenA (lpString="*.torrent") returned 9 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.296] lstrlenA (lpString="*.mov") returned 5 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.296] lstrlenA (lpString="*.m2v") returned 5 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.296] lstrlenA (lpString="*.3gp") returned 5 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.296] lstrlenA (lpString="*.mpeg") returned 6 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.296] lstrlenA (lpString="*.mpg") returned 5 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.296] lstrlenA (lpString="*.flv") returned 5 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.296] lstrlenA (lpString="*.avi") returned 5 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.296] lstrlenA (lpString="*.mp4") returned 5 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.296] lstrlenA (lpString="*.wmv") returned 5 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.296] lstrlenA (lpString="*.divx") returned 6 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.296] lstrlenA (lpString="*.mkv") returned 5 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.296] lstrlenA (lpString="*.mp3") returned 5 [0062.296] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.297] lstrlenA (lpString="*.wav") returned 5 [0062.297] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.297] lstrlenA (lpString="*.flac") returned 6 [0062.297] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.297] lstrlenA (lpString="*.ape") returned 5 [0062.297] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.297] lstrlenA (lpString="*.wma") returned 5 [0062.297] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.297] lstrlenA (lpString="*.ac3") returned 5 [0062.297] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.297] lstrlenA (lpString="*.doc") returned 5 [0062.297] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.297] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.297] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.297] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.297] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned="LocalizedData.xml" [0062.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1044\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0062.297] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1044\\" | out: pszPath="C:\\588bce7c90097ed212\\1044\\") returned="" [0062.297] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1044\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1044\\HOW TO DECRYPT FILES.txt" [0062.297] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1044\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\how to decrypt files.txt")) returned 0x20 [0062.297] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" [0062.297] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.297] lstrlenA (lpString="*.zip") returned 5 [0062.297] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.297] lstrlenA (lpString="*.rar") returned 5 [0062.297] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.297] lstrlenA (lpString="*.7z") returned 4 [0062.297] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.297] lstrlenA (lpString="*.tar") returned 5 [0062.297] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.297] lstrlenA (lpString="*.gzip") returned 6 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.298] lstrlenA (lpString="*.jpg") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.298] lstrlenA (lpString="*.jpeg") returned 6 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.298] lstrlenA (lpString="*.psd") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.298] lstrlenA (lpString="*.cdr") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.298] lstrlenA (lpString="*.dwg") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.298] lstrlenA (lpString="*.max") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.298] lstrlenA (lpString="*.bmp") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.298] lstrlenA (lpString="*.gif") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.298] lstrlenA (lpString="*.png") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.298] lstrlenA (lpString="*.doc") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.298] lstrlenA (lpString="*.docx") returned 6 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.298] lstrlenA (lpString="*.xls") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.298] lstrlenA (lpString="*.xlsx") returned 6 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.298] lstrlenA (lpString="*.ppt") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.298] lstrlenA (lpString="*.pptx") returned 6 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.298] lstrlenA (lpString="*.txt") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.298] lstrlenA (lpString="*.pdf") returned 5 [0062.298] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.299] lstrlenA (lpString="*.djvu") returned 6 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.299] lstrlenA (lpString="*.htm") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.299] lstrlenA (lpString="*.html") returned 6 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.299] lstrlenA (lpString="*.mdb") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.299] lstrlenA (lpString="*.cer") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.299] lstrlenA (lpString="*.p12") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.299] lstrlenA (lpString="*.pfx") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.299] lstrlenA (lpString="*.kwm") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.299] lstrlenA (lpString="*.pwm") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.299] lstrlenA (lpString="*.1cd") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.299] lstrlenA (lpString="*.md") returned 4 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.299] lstrlenA (lpString="*.mdf") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.299] lstrlenA (lpString="*.dbf") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.299] lstrlenA (lpString="*.odt") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.299] lstrlenA (lpString="*.vob") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.299] lstrlenA (lpString="*.ifo") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.299] lstrlenA (lpString="*.lnk") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.299] lstrlenA (lpString="*.torrent") returned 9 [0062.299] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.299] lstrlenA (lpString="*.mov") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.300] lstrlenA (lpString="*.m2v") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.300] lstrlenA (lpString="*.3gp") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.300] lstrlenA (lpString="*.mpeg") returned 6 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.300] lstrlenA (lpString="*.mpg") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.300] lstrlenA (lpString="*.flv") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.300] lstrlenA (lpString="*.avi") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.300] lstrlenA (lpString="*.mp4") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.300] lstrlenA (lpString="*.wmv") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.300] lstrlenA (lpString="*.divx") returned 6 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.300] lstrlenA (lpString="*.mkv") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.300] lstrlenA (lpString="*.mp3") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.300] lstrlenA (lpString="*.wav") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.300] lstrlenA (lpString="*.flac") returned 6 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.300] lstrlenA (lpString="*.ape") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.300] lstrlenA (lpString="*.wma") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.300] lstrlenA (lpString="*.ac3") returned 5 [0062.300] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.300] lstrlenA (lpString="*.doc") returned 5 [0062.300] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.301] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0062.301] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1045", cAlternateFileName="")) returned 1 [0062.301] lstrcmpA (lpString1=".", lpString2="1045") returned -1 [0062.301] lstrcmpA (lpString1="..", lpString2="1045") returned -1 [0062.301] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.301] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1045" | out: lpString1="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0062.301] lstrlenA (lpString="C:\\588bce7c90097ed212\\1045") returned 26 [0062.301] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0062.305] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.305] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.305] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.305] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.305] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.305] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.305] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.305] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.305] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1045\\*.*") returned="*.*" [0062.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1045\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0062.305] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1045\\" | out: pszPath="C:\\588bce7c90097ed212\\1045\\") returned="" [0062.305] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1045\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1045\\HOW TO DECRYPT FILES.txt" [0062.305] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1045\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\how to decrypt files.txt")) returned 0xffffffff [0062.305] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1045\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.307] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.307] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.308] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.308] CloseHandle (hObject=0x208) returned 1 [0062.308] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf" [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.zip") returned 0 [0062.309] lstrlenA (lpString="*.zip") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.rar") returned 0 [0062.309] lstrlenA (lpString="*.rar") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.7z") returned 0 [0062.309] lstrlenA (lpString="*.7z") returned 4 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.tar") returned 0 [0062.309] lstrlenA (lpString="*.tar") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.309] lstrlenA (lpString="*.gzip") returned 6 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.309] lstrlenA (lpString="*.jpg") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.309] lstrlenA (lpString="*.jpeg") returned 6 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.psd") returned 0 [0062.309] lstrlenA (lpString="*.psd") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.309] lstrlenA (lpString="*.cdr") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.309] lstrlenA (lpString="*.dwg") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.max") returned 0 [0062.309] lstrlenA (lpString="*.max") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.309] lstrlenA (lpString="*.bmp") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.gif") returned 0 [0062.309] lstrlenA (lpString="*.gif") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.png") returned 0 [0062.309] lstrlenA (lpString="*.png") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.doc") returned 0 [0062.309] lstrlenA (lpString="*.doc") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.docx") returned 0 [0062.309] lstrlenA (lpString="*.docx") returned 6 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.xls") returned 0 [0062.309] lstrlenA (lpString="*.xls") returned 5 [0062.309] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.309] lstrlenA (lpString="*.xlsx") returned 6 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.310] lstrlenA (lpString="*.ppt") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.310] lstrlenA (lpString="*.pptx") returned 6 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.txt") returned 0 [0062.310] lstrlenA (lpString="*.txt") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.310] lstrlenA (lpString="*.pdf") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.310] lstrlenA (lpString="*.djvu") returned 6 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.htm") returned 0 [0062.310] lstrlenA (lpString="*.htm") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.html") returned 0 [0062.310] lstrlenA (lpString="*.html") returned 6 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.310] lstrlenA (lpString="*.mdb") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.cer") returned 0 [0062.310] lstrlenA (lpString="*.cer") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.p12") returned 0 [0062.310] lstrlenA (lpString="*.p12") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.310] lstrlenA (lpString="*.pfx") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.310] lstrlenA (lpString="*.kwm") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.310] lstrlenA (lpString="*.pwm") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.310] lstrlenA (lpString="*.1cd") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.md") returned 0 [0062.310] lstrlenA (lpString="*.md") returned 4 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.310] lstrlenA (lpString="*.mdf") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.310] lstrlenA (lpString="*.dbf") returned 5 [0062.310] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.odt") returned 0 [0062.310] lstrlenA (lpString="*.odt") returned 5 [0062.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.vob") returned 0 [0062.311] lstrlenA (lpString="*.vob") returned 5 [0062.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.311] lstrlenA (lpString="*.ifo") returned 5 [0062.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.311] lstrlenA (lpString="*.lnk") returned 5 [0062.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.311] lstrlenA (lpString="*.torrent") returned 9 [0062.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mov") returned 0 [0062.311] lstrlenA (lpString="*.mov") returned 5 [0062.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.311] lstrlenA (lpString="*.m2v") returned 5 [0062.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.311] lstrlenA (lpString="*.3gp") returned 5 [0062.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.311] lstrlenA (lpString="*.mpeg") returned 6 [0062.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.311] lstrlenA (lpString="*.mpg") returned 5 [0062.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.flv") returned 0 [0062.311] lstrlenA (lpString="*.flv") returned 5 [0062.311] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.avi") returned 0 [0062.311] lstrlenA (lpString="*.avi") returned 5 [0062.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.312] lstrlenA (lpString="*.mp4") returned 5 [0062.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.312] lstrlenA (lpString="*.wmv") returned 5 [0062.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.divx") returned 0 [0062.312] lstrlenA (lpString="*.divx") returned 6 [0062.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.312] lstrlenA (lpString="*.mkv") returned 5 [0062.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.312] lstrlenA (lpString="*.mp3") returned 5 [0062.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.wav") returned 0 [0062.312] lstrlenA (lpString="*.wav") returned 5 [0062.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.flac") returned 0 [0062.312] lstrlenA (lpString="*.flac") returned 6 [0062.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.ape") returned 0 [0062.312] lstrlenA (lpString="*.ape") returned 5 [0062.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.wma") returned 0 [0062.312] lstrlenA (lpString="*.wma") returned 5 [0062.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.312] lstrlenA (lpString="*.ac3") returned 5 [0062.312] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\eula.rtf", pszSpec="*.doc") returned 0 [0062.312] lstrlenA (lpString="*.doc") returned 5 [0062.312] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.312] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.312] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.312] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.312] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned="eula.rtf" [0062.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1045\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0062.312] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1045\\" | out: pszPath="C:\\588bce7c90097ed212\\1045\\") returned="" [0062.312] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1045\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1045\\HOW TO DECRYPT FILES.txt" [0062.313] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1045\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\how to decrypt files.txt")) returned 0x20 [0062.313] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.313] lstrlenA (lpString="*.zip") returned 5 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.313] lstrlenA (lpString="*.rar") returned 5 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.313] lstrlenA (lpString="*.7z") returned 4 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.313] lstrlenA (lpString="*.tar") returned 5 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.313] lstrlenA (lpString="*.gzip") returned 6 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.313] lstrlenA (lpString="*.jpg") returned 5 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.313] lstrlenA (lpString="*.jpeg") returned 6 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.313] lstrlenA (lpString="*.psd") returned 5 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.313] lstrlenA (lpString="*.cdr") returned 5 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.313] lstrlenA (lpString="*.dwg") returned 5 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.313] lstrlenA (lpString="*.max") returned 5 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.313] lstrlenA (lpString="*.bmp") returned 5 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.313] lstrlenA (lpString="*.gif") returned 5 [0062.313] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.313] lstrlenA (lpString="*.png") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.314] lstrlenA (lpString="*.doc") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.314] lstrlenA (lpString="*.docx") returned 6 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.314] lstrlenA (lpString="*.xls") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.314] lstrlenA (lpString="*.xlsx") returned 6 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.314] lstrlenA (lpString="*.ppt") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.314] lstrlenA (lpString="*.pptx") returned 6 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.314] lstrlenA (lpString="*.txt") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.314] lstrlenA (lpString="*.pdf") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.314] lstrlenA (lpString="*.djvu") returned 6 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.314] lstrlenA (lpString="*.htm") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.314] lstrlenA (lpString="*.html") returned 6 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.314] lstrlenA (lpString="*.mdb") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.314] lstrlenA (lpString="*.cer") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.314] lstrlenA (lpString="*.p12") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.314] lstrlenA (lpString="*.pfx") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.314] lstrlenA (lpString="*.kwm") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.314] lstrlenA (lpString="*.pwm") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.314] lstrlenA (lpString="*.1cd") returned 5 [0062.314] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.315] lstrlenA (lpString="*.md") returned 4 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.315] lstrlenA (lpString="*.mdf") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.315] lstrlenA (lpString="*.dbf") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.315] lstrlenA (lpString="*.odt") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.315] lstrlenA (lpString="*.vob") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.315] lstrlenA (lpString="*.ifo") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.315] lstrlenA (lpString="*.lnk") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.315] lstrlenA (lpString="*.torrent") returned 9 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.315] lstrlenA (lpString="*.mov") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.315] lstrlenA (lpString="*.m2v") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.315] lstrlenA (lpString="*.3gp") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.315] lstrlenA (lpString="*.mpeg") returned 6 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.315] lstrlenA (lpString="*.mpg") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.315] lstrlenA (lpString="*.flv") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.315] lstrlenA (lpString="*.avi") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.315] lstrlenA (lpString="*.mp4") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.315] lstrlenA (lpString="*.wmv") returned 5 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.315] lstrlenA (lpString="*.divx") returned 6 [0062.315] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.316] lstrlenA (lpString="*.mkv") returned 5 [0062.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.316] lstrlenA (lpString="*.mp3") returned 5 [0062.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.316] lstrlenA (lpString="*.wav") returned 5 [0062.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.316] lstrlenA (lpString="*.flac") returned 6 [0062.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.316] lstrlenA (lpString="*.ape") returned 5 [0062.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.316] lstrlenA (lpString="*.wma") returned 5 [0062.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.316] lstrlenA (lpString="*.ac3") returned 5 [0062.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.316] lstrlenA (lpString="*.doc") returned 5 [0062.316] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.316] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.316] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.316] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.316] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.316] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned="LocalizedData.xml" [0062.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1045\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0062.316] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1045\\" | out: pszPath="C:\\588bce7c90097ed212\\1045\\") returned="" [0062.316] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1045\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1045\\HOW TO DECRYPT FILES.txt" [0062.316] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1045\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\how to decrypt files.txt")) returned 0x20 [0062.316] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" [0062.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.316] lstrlenA (lpString="*.zip") returned 5 [0062.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.316] lstrlenA (lpString="*.rar") returned 5 [0062.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.316] lstrlenA (lpString="*.7z") returned 4 [0062.316] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.317] lstrlenA (lpString="*.tar") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.317] lstrlenA (lpString="*.gzip") returned 6 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.317] lstrlenA (lpString="*.jpg") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.317] lstrlenA (lpString="*.jpeg") returned 6 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.317] lstrlenA (lpString="*.psd") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.317] lstrlenA (lpString="*.cdr") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.317] lstrlenA (lpString="*.dwg") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.317] lstrlenA (lpString="*.max") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.317] lstrlenA (lpString="*.bmp") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.317] lstrlenA (lpString="*.gif") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.317] lstrlenA (lpString="*.png") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.317] lstrlenA (lpString="*.doc") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.317] lstrlenA (lpString="*.docx") returned 6 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.317] lstrlenA (lpString="*.xls") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.317] lstrlenA (lpString="*.xlsx") returned 6 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.317] lstrlenA (lpString="*.ppt") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.317] lstrlenA (lpString="*.pptx") returned 6 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.317] lstrlenA (lpString="*.txt") returned 5 [0062.317] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.318] lstrlenA (lpString="*.pdf") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.318] lstrlenA (lpString="*.djvu") returned 6 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.318] lstrlenA (lpString="*.htm") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.318] lstrlenA (lpString="*.html") returned 6 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.318] lstrlenA (lpString="*.mdb") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.318] lstrlenA (lpString="*.cer") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.318] lstrlenA (lpString="*.p12") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.318] lstrlenA (lpString="*.pfx") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.318] lstrlenA (lpString="*.kwm") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.318] lstrlenA (lpString="*.pwm") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.318] lstrlenA (lpString="*.1cd") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.318] lstrlenA (lpString="*.md") returned 4 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.318] lstrlenA (lpString="*.mdf") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.318] lstrlenA (lpString="*.dbf") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.318] lstrlenA (lpString="*.odt") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.318] lstrlenA (lpString="*.vob") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.318] lstrlenA (lpString="*.ifo") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.318] lstrlenA (lpString="*.lnk") returned 5 [0062.318] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.318] lstrlenA (lpString="*.torrent") returned 9 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.319] lstrlenA (lpString="*.mov") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.319] lstrlenA (lpString="*.m2v") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.319] lstrlenA (lpString="*.3gp") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.319] lstrlenA (lpString="*.mpeg") returned 6 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.319] lstrlenA (lpString="*.mpg") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.319] lstrlenA (lpString="*.flv") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.319] lstrlenA (lpString="*.avi") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.319] lstrlenA (lpString="*.mp4") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.319] lstrlenA (lpString="*.wmv") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.319] lstrlenA (lpString="*.divx") returned 6 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.319] lstrlenA (lpString="*.mkv") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.319] lstrlenA (lpString="*.mp3") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.319] lstrlenA (lpString="*.wav") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.319] lstrlenA (lpString="*.flac") returned 6 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.319] lstrlenA (lpString="*.ape") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.319] lstrlenA (lpString="*.wma") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.319] lstrlenA (lpString="*.ac3") returned 5 [0062.319] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.319] lstrlenA (lpString="*.doc") returned 5 [0062.319] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.320] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0062.320] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1046", cAlternateFileName="")) returned 1 [0062.320] lstrcmpA (lpString1=".", lpString2="1046") returned -1 [0062.320] lstrcmpA (lpString1="..", lpString2="1046") returned -1 [0062.320] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.320] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1046" | out: lpString1="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0062.320] lstrlenA (lpString="C:\\588bce7c90097ed212\\1046") returned 26 [0062.320] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e90 [0062.321] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.321] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.321] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.321] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.321] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.321] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.321] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.321] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.321] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1046\\*.*") returned="*.*" [0062.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1046\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0062.321] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1046\\" | out: pszPath="C:\\588bce7c90097ed212\\1046\\") returned="" [0062.321] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1046\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1046\\HOW TO DECRYPT FILES.txt" [0062.321] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1046\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\how to decrypt files.txt")) returned 0xffffffff [0062.321] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1046\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.325] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.325] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.326] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.326] CloseHandle (hObject=0x208) returned 1 [0062.326] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf" [0062.326] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.zip") returned 0 [0062.327] lstrlenA (lpString="*.zip") returned 5 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.rar") returned 0 [0062.327] lstrlenA (lpString="*.rar") returned 5 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.7z") returned 0 [0062.327] lstrlenA (lpString="*.7z") returned 4 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.tar") returned 0 [0062.327] lstrlenA (lpString="*.tar") returned 5 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.327] lstrlenA (lpString="*.gzip") returned 6 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.327] lstrlenA (lpString="*.jpg") returned 5 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.327] lstrlenA (lpString="*.jpeg") returned 6 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.psd") returned 0 [0062.327] lstrlenA (lpString="*.psd") returned 5 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.327] lstrlenA (lpString="*.cdr") returned 5 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.327] lstrlenA (lpString="*.dwg") returned 5 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.max") returned 0 [0062.327] lstrlenA (lpString="*.max") returned 5 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.327] lstrlenA (lpString="*.bmp") returned 5 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.gif") returned 0 [0062.327] lstrlenA (lpString="*.gif") returned 5 [0062.327] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.png") returned 0 [0062.327] lstrlenA (lpString="*.png") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.doc") returned 0 [0062.328] lstrlenA (lpString="*.doc") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.docx") returned 0 [0062.328] lstrlenA (lpString="*.docx") returned 6 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.xls") returned 0 [0062.328] lstrlenA (lpString="*.xls") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.328] lstrlenA (lpString="*.xlsx") returned 6 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.328] lstrlenA (lpString="*.ppt") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.328] lstrlenA (lpString="*.pptx") returned 6 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.txt") returned 0 [0062.328] lstrlenA (lpString="*.txt") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.328] lstrlenA (lpString="*.pdf") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.328] lstrlenA (lpString="*.djvu") returned 6 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.htm") returned 0 [0062.328] lstrlenA (lpString="*.htm") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.html") returned 0 [0062.328] lstrlenA (lpString="*.html") returned 6 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.328] lstrlenA (lpString="*.mdb") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.cer") returned 0 [0062.328] lstrlenA (lpString="*.cer") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.p12") returned 0 [0062.328] lstrlenA (lpString="*.p12") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.328] lstrlenA (lpString="*.pfx") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.328] lstrlenA (lpString="*.kwm") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.328] lstrlenA (lpString="*.pwm") returned 5 [0062.328] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.328] lstrlenA (lpString="*.1cd") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.md") returned 0 [0062.329] lstrlenA (lpString="*.md") returned 4 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.329] lstrlenA (lpString="*.mdf") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.329] lstrlenA (lpString="*.dbf") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.odt") returned 0 [0062.329] lstrlenA (lpString="*.odt") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.vob") returned 0 [0062.329] lstrlenA (lpString="*.vob") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.329] lstrlenA (lpString="*.ifo") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.329] lstrlenA (lpString="*.lnk") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.329] lstrlenA (lpString="*.torrent") returned 9 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mov") returned 0 [0062.329] lstrlenA (lpString="*.mov") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.329] lstrlenA (lpString="*.m2v") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.329] lstrlenA (lpString="*.3gp") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.329] lstrlenA (lpString="*.mpeg") returned 6 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.329] lstrlenA (lpString="*.mpg") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.flv") returned 0 [0062.329] lstrlenA (lpString="*.flv") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.avi") returned 0 [0062.329] lstrlenA (lpString="*.avi") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.329] lstrlenA (lpString="*.mp4") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.329] lstrlenA (lpString="*.wmv") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.divx") returned 0 [0062.329] lstrlenA (lpString="*.divx") returned 6 [0062.329] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.330] lstrlenA (lpString="*.mkv") returned 5 [0062.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.330] lstrlenA (lpString="*.mp3") returned 5 [0062.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.wav") returned 0 [0062.330] lstrlenA (lpString="*.wav") returned 5 [0062.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.flac") returned 0 [0062.330] lstrlenA (lpString="*.flac") returned 6 [0062.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.ape") returned 0 [0062.330] lstrlenA (lpString="*.ape") returned 5 [0062.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.wma") returned 0 [0062.330] lstrlenA (lpString="*.wma") returned 5 [0062.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.330] lstrlenA (lpString="*.ac3") returned 5 [0062.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\eula.rtf", pszSpec="*.doc") returned 0 [0062.330] lstrlenA (lpString="*.doc") returned 5 [0062.330] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.330] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.330] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.330] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.330] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned="eula.rtf" [0062.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1046\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0062.330] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1046\\" | out: pszPath="C:\\588bce7c90097ed212\\1046\\") returned="" [0062.330] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1046\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1046\\HOW TO DECRYPT FILES.txt" [0062.330] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1046\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\how to decrypt files.txt")) returned 0x20 [0062.330] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" [0062.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.330] lstrlenA (lpString="*.zip") returned 5 [0062.330] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.330] lstrlenA (lpString="*.rar") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.331] lstrlenA (lpString="*.7z") returned 4 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.331] lstrlenA (lpString="*.tar") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.331] lstrlenA (lpString="*.gzip") returned 6 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.331] lstrlenA (lpString="*.jpg") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.331] lstrlenA (lpString="*.jpeg") returned 6 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.331] lstrlenA (lpString="*.psd") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.331] lstrlenA (lpString="*.cdr") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.331] lstrlenA (lpString="*.dwg") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.331] lstrlenA (lpString="*.max") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.331] lstrlenA (lpString="*.bmp") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.331] lstrlenA (lpString="*.gif") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.331] lstrlenA (lpString="*.png") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.331] lstrlenA (lpString="*.doc") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.331] lstrlenA (lpString="*.docx") returned 6 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.331] lstrlenA (lpString="*.xls") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.331] lstrlenA (lpString="*.xlsx") returned 6 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.331] lstrlenA (lpString="*.ppt") returned 5 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.331] lstrlenA (lpString="*.pptx") returned 6 [0062.331] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.332] lstrlenA (lpString="*.txt") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.332] lstrlenA (lpString="*.pdf") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.332] lstrlenA (lpString="*.djvu") returned 6 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.332] lstrlenA (lpString="*.htm") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.332] lstrlenA (lpString="*.html") returned 6 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.332] lstrlenA (lpString="*.mdb") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.332] lstrlenA (lpString="*.cer") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.332] lstrlenA (lpString="*.p12") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.332] lstrlenA (lpString="*.pfx") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.332] lstrlenA (lpString="*.kwm") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.332] lstrlenA (lpString="*.pwm") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.332] lstrlenA (lpString="*.1cd") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.332] lstrlenA (lpString="*.md") returned 4 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.332] lstrlenA (lpString="*.mdf") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.332] lstrlenA (lpString="*.dbf") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.332] lstrlenA (lpString="*.odt") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.332] lstrlenA (lpString="*.vob") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.332] lstrlenA (lpString="*.ifo") returned 5 [0062.332] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.333] lstrlenA (lpString="*.lnk") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.333] lstrlenA (lpString="*.torrent") returned 9 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.333] lstrlenA (lpString="*.mov") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.333] lstrlenA (lpString="*.m2v") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.333] lstrlenA (lpString="*.3gp") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.333] lstrlenA (lpString="*.mpeg") returned 6 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.333] lstrlenA (lpString="*.mpg") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.333] lstrlenA (lpString="*.flv") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.333] lstrlenA (lpString="*.avi") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.333] lstrlenA (lpString="*.mp4") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.333] lstrlenA (lpString="*.wmv") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.333] lstrlenA (lpString="*.divx") returned 6 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.333] lstrlenA (lpString="*.mkv") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.333] lstrlenA (lpString="*.mp3") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.333] lstrlenA (lpString="*.wav") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.333] lstrlenA (lpString="*.flac") returned 6 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.333] lstrlenA (lpString="*.ape") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.333] lstrlenA (lpString="*.wma") returned 5 [0062.333] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.334] lstrlenA (lpString="*.ac3") returned 5 [0062.334] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.334] lstrlenA (lpString="*.doc") returned 5 [0062.334] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.334] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.334] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.334] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.334] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.334] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned="LocalizedData.xml" [0062.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1046\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0062.334] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1046\\" | out: pszPath="C:\\588bce7c90097ed212\\1046\\") returned="" [0062.334] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1046\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1046\\HOW TO DECRYPT FILES.txt" [0062.334] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1046\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\how to decrypt files.txt")) returned 0x20 [0062.334] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" [0062.334] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.334] lstrlenA (lpString="*.zip") returned 5 [0062.334] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.334] lstrlenA (lpString="*.rar") returned 5 [0062.334] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.334] lstrlenA (lpString="*.7z") returned 4 [0062.334] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.334] lstrlenA (lpString="*.tar") returned 5 [0062.334] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.334] lstrlenA (lpString="*.gzip") returned 6 [0062.334] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.334] lstrlenA (lpString="*.jpg") returned 5 [0062.334] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.334] lstrlenA (lpString="*.jpeg") returned 6 [0062.334] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.334] lstrlenA (lpString="*.psd") returned 5 [0062.334] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.334] lstrlenA (lpString="*.cdr") returned 5 [0062.334] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.335] lstrlenA (lpString="*.dwg") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.335] lstrlenA (lpString="*.max") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.335] lstrlenA (lpString="*.bmp") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.335] lstrlenA (lpString="*.gif") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.335] lstrlenA (lpString="*.png") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.335] lstrlenA (lpString="*.doc") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.335] lstrlenA (lpString="*.docx") returned 6 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.335] lstrlenA (lpString="*.xls") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.335] lstrlenA (lpString="*.xlsx") returned 6 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.335] lstrlenA (lpString="*.ppt") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.335] lstrlenA (lpString="*.pptx") returned 6 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.335] lstrlenA (lpString="*.txt") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.335] lstrlenA (lpString="*.pdf") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.335] lstrlenA (lpString="*.djvu") returned 6 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.335] lstrlenA (lpString="*.htm") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.335] lstrlenA (lpString="*.html") returned 6 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.335] lstrlenA (lpString="*.mdb") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.335] lstrlenA (lpString="*.cer") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.335] lstrlenA (lpString="*.p12") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.336] lstrlenA (lpString="*.pfx") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.336] lstrlenA (lpString="*.kwm") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.336] lstrlenA (lpString="*.pwm") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.336] lstrlenA (lpString="*.1cd") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.336] lstrlenA (lpString="*.md") returned 4 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.336] lstrlenA (lpString="*.mdf") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.336] lstrlenA (lpString="*.dbf") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.336] lstrlenA (lpString="*.odt") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.336] lstrlenA (lpString="*.vob") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.336] lstrlenA (lpString="*.ifo") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.336] lstrlenA (lpString="*.lnk") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.336] lstrlenA (lpString="*.torrent") returned 9 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.336] lstrlenA (lpString="*.mov") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.336] lstrlenA (lpString="*.m2v") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.336] lstrlenA (lpString="*.3gp") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.336] lstrlenA (lpString="*.mpeg") returned 6 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.336] lstrlenA (lpString="*.mpg") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.336] lstrlenA (lpString="*.flv") returned 5 [0062.337] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.337] lstrlenA (lpString="*.avi") returned 5 [0062.337] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.337] lstrlenA (lpString="*.mp4") returned 5 [0062.337] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.337] lstrlenA (lpString="*.wmv") returned 5 [0062.337] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.337] lstrlenA (lpString="*.divx") returned 6 [0062.337] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.337] lstrlenA (lpString="*.mkv") returned 5 [0062.337] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.337] lstrlenA (lpString="*.mp3") returned 5 [0062.337] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.337] lstrlenA (lpString="*.wav") returned 5 [0062.337] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.337] lstrlenA (lpString="*.flac") returned 6 [0062.337] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.337] lstrlenA (lpString="*.ape") returned 5 [0062.337] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.337] lstrlenA (lpString="*.wma") returned 5 [0062.337] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.337] lstrlenA (lpString="*.ac3") returned 5 [0062.337] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.337] lstrlenA (lpString="*.doc") returned 5 [0062.337] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.337] FindClose (in: hFindFile=0x759e90 | out: hFindFile=0x759e90) returned 1 [0062.337] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1049", cAlternateFileName="")) returned 1 [0062.337] lstrcmpA (lpString1=".", lpString2="1049") returned -1 [0062.337] lstrcmpA (lpString1="..", lpString2="1049") returned -1 [0062.337] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.338] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1049" | out: lpString1="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0062.338] lstrlenA (lpString="C:\\588bce7c90097ed212\\1049") returned 26 [0062.338] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0062.338] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.338] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.338] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.338] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.338] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.338] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.338] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.338] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1049\\*.*") returned="*.*" [0062.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1049\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0062.338] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1049\\" | out: pszPath="C:\\588bce7c90097ed212\\1049\\") returned="" [0062.338] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1049\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1049\\HOW TO DECRYPT FILES.txt" [0062.338] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1049\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\how to decrypt files.txt")) returned 0xffffffff [0062.338] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1049\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.356] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.356] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.357] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.357] CloseHandle (hObject=0x208) returned 1 [0062.358] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf" [0062.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.zip") returned 0 [0062.358] lstrlenA (lpString="*.zip") returned 5 [0062.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.rar") returned 0 [0062.358] lstrlenA (lpString="*.rar") returned 5 [0062.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.7z") returned 0 [0062.358] lstrlenA (lpString="*.7z") returned 4 [0062.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.tar") returned 0 [0062.358] lstrlenA (lpString="*.tar") returned 5 [0062.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.358] lstrlenA (lpString="*.gzip") returned 6 [0062.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.358] lstrlenA (lpString="*.jpg") returned 5 [0062.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.358] lstrlenA (lpString="*.jpeg") returned 6 [0062.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.psd") returned 0 [0062.358] lstrlenA (lpString="*.psd") returned 5 [0062.358] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.359] lstrlenA (lpString="*.cdr") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.359] lstrlenA (lpString="*.dwg") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.max") returned 0 [0062.359] lstrlenA (lpString="*.max") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.359] lstrlenA (lpString="*.bmp") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.gif") returned 0 [0062.359] lstrlenA (lpString="*.gif") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.png") returned 0 [0062.359] lstrlenA (lpString="*.png") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.doc") returned 0 [0062.359] lstrlenA (lpString="*.doc") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.docx") returned 0 [0062.359] lstrlenA (lpString="*.docx") returned 6 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.xls") returned 0 [0062.359] lstrlenA (lpString="*.xls") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.359] lstrlenA (lpString="*.xlsx") returned 6 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.359] lstrlenA (lpString="*.ppt") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.359] lstrlenA (lpString="*.pptx") returned 6 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.txt") returned 0 [0062.359] lstrlenA (lpString="*.txt") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.359] lstrlenA (lpString="*.pdf") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.359] lstrlenA (lpString="*.djvu") returned 6 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.htm") returned 0 [0062.359] lstrlenA (lpString="*.htm") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.html") returned 0 [0062.359] lstrlenA (lpString="*.html") returned 6 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.359] lstrlenA (lpString="*.mdb") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.cer") returned 0 [0062.359] lstrlenA (lpString="*.cer") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.p12") returned 0 [0062.360] lstrlenA (lpString="*.p12") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.360] lstrlenA (lpString="*.pfx") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.360] lstrlenA (lpString="*.kwm") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.360] lstrlenA (lpString="*.pwm") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.360] lstrlenA (lpString="*.1cd") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.md") returned 0 [0062.360] lstrlenA (lpString="*.md") returned 4 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.360] lstrlenA (lpString="*.mdf") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.360] lstrlenA (lpString="*.dbf") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.odt") returned 0 [0062.360] lstrlenA (lpString="*.odt") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.vob") returned 0 [0062.360] lstrlenA (lpString="*.vob") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.360] lstrlenA (lpString="*.ifo") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.360] lstrlenA (lpString="*.lnk") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.360] lstrlenA (lpString="*.torrent") returned 9 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mov") returned 0 [0062.360] lstrlenA (lpString="*.mov") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.360] lstrlenA (lpString="*.m2v") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.360] lstrlenA (lpString="*.3gp") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.360] lstrlenA (lpString="*.mpeg") returned 6 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.360] lstrlenA (lpString="*.mpg") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.flv") returned 0 [0062.361] lstrlenA (lpString="*.flv") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.avi") returned 0 [0062.361] lstrlenA (lpString="*.avi") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.361] lstrlenA (lpString="*.mp4") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.361] lstrlenA (lpString="*.wmv") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.divx") returned 0 [0062.361] lstrlenA (lpString="*.divx") returned 6 [0062.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.361] lstrlenA (lpString="*.mkv") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.361] lstrlenA (lpString="*.mp3") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.wav") returned 0 [0062.361] lstrlenA (lpString="*.wav") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.flac") returned 0 [0062.361] lstrlenA (lpString="*.flac") returned 6 [0062.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.ape") returned 0 [0062.361] lstrlenA (lpString="*.ape") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.wma") returned 0 [0062.361] lstrlenA (lpString="*.wma") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.361] lstrlenA (lpString="*.ac3") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\eula.rtf", pszSpec="*.doc") returned 0 [0062.361] lstrlenA (lpString="*.doc") returned 5 [0062.361] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.361] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.361] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.361] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.361] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned="eula.rtf" [0062.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1049\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0062.361] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1049\\" | out: pszPath="C:\\588bce7c90097ed212\\1049\\") returned="" [0062.361] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1049\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1049\\HOW TO DECRYPT FILES.txt" [0062.362] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1049\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\how to decrypt files.txt")) returned 0x20 [0062.362] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.362] lstrlenA (lpString="*.zip") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.362] lstrlenA (lpString="*.rar") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.362] lstrlenA (lpString="*.7z") returned 4 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.362] lstrlenA (lpString="*.tar") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.362] lstrlenA (lpString="*.gzip") returned 6 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.362] lstrlenA (lpString="*.jpg") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.362] lstrlenA (lpString="*.jpeg") returned 6 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.362] lstrlenA (lpString="*.psd") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.362] lstrlenA (lpString="*.cdr") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.362] lstrlenA (lpString="*.dwg") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.362] lstrlenA (lpString="*.max") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.362] lstrlenA (lpString="*.bmp") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.362] lstrlenA (lpString="*.gif") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.362] lstrlenA (lpString="*.png") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.362] lstrlenA (lpString="*.doc") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.363] lstrlenA (lpString="*.docx") returned 6 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.363] lstrlenA (lpString="*.xls") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.363] lstrlenA (lpString="*.xlsx") returned 6 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.363] lstrlenA (lpString="*.ppt") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.363] lstrlenA (lpString="*.pptx") returned 6 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.363] lstrlenA (lpString="*.txt") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.363] lstrlenA (lpString="*.pdf") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.363] lstrlenA (lpString="*.djvu") returned 6 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.363] lstrlenA (lpString="*.htm") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.363] lstrlenA (lpString="*.html") returned 6 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.363] lstrlenA (lpString="*.mdb") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.363] lstrlenA (lpString="*.cer") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.363] lstrlenA (lpString="*.p12") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.363] lstrlenA (lpString="*.pfx") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.363] lstrlenA (lpString="*.kwm") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.363] lstrlenA (lpString="*.pwm") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.363] lstrlenA (lpString="*.1cd") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.363] lstrlenA (lpString="*.md") returned 4 [0062.363] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.364] lstrlenA (lpString="*.mdf") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.364] lstrlenA (lpString="*.dbf") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.364] lstrlenA (lpString="*.odt") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.364] lstrlenA (lpString="*.vob") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.364] lstrlenA (lpString="*.ifo") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.364] lstrlenA (lpString="*.lnk") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.364] lstrlenA (lpString="*.torrent") returned 9 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.364] lstrlenA (lpString="*.mov") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.364] lstrlenA (lpString="*.m2v") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.364] lstrlenA (lpString="*.3gp") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.364] lstrlenA (lpString="*.mpeg") returned 6 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.364] lstrlenA (lpString="*.mpg") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.364] lstrlenA (lpString="*.flv") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.364] lstrlenA (lpString="*.avi") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.364] lstrlenA (lpString="*.mp4") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.364] lstrlenA (lpString="*.wmv") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.364] lstrlenA (lpString="*.divx") returned 6 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.364] lstrlenA (lpString="*.mkv") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.364] lstrlenA (lpString="*.mp3") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.365] lstrlenA (lpString="*.wav") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.365] lstrlenA (lpString="*.flac") returned 6 [0062.365] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.365] lstrlenA (lpString="*.ape") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.365] lstrlenA (lpString="*.wma") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.365] lstrlenA (lpString="*.ac3") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.365] lstrlenA (lpString="*.doc") returned 5 [0062.365] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.365] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.365] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.365] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.365] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.365] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned="LocalizedData.xml" [0062.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1049\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0062.365] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1049\\" | out: pszPath="C:\\588bce7c90097ed212\\1049\\") returned="" [0062.365] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1049\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1049\\HOW TO DECRYPT FILES.txt" [0062.365] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1049\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\how to decrypt files.txt")) returned 0x20 [0062.365] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" [0062.365] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.365] lstrlenA (lpString="*.zip") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.365] lstrlenA (lpString="*.rar") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.365] lstrlenA (lpString="*.7z") returned 4 [0062.365] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.365] lstrlenA (lpString="*.tar") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.365] lstrlenA (lpString="*.gzip") returned 6 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.366] lstrlenA (lpString="*.jpg") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.366] lstrlenA (lpString="*.jpeg") returned 6 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.366] lstrlenA (lpString="*.psd") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.366] lstrlenA (lpString="*.cdr") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.366] lstrlenA (lpString="*.dwg") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.366] lstrlenA (lpString="*.max") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.366] lstrlenA (lpString="*.bmp") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.366] lstrlenA (lpString="*.gif") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.366] lstrlenA (lpString="*.png") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.366] lstrlenA (lpString="*.doc") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.366] lstrlenA (lpString="*.docx") returned 6 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.366] lstrlenA (lpString="*.xls") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.366] lstrlenA (lpString="*.xlsx") returned 6 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.366] lstrlenA (lpString="*.ppt") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.366] lstrlenA (lpString="*.pptx") returned 6 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.366] lstrlenA (lpString="*.txt") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.366] lstrlenA (lpString="*.pdf") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.366] lstrlenA (lpString="*.djvu") returned 6 [0062.366] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.367] lstrlenA (lpString="*.htm") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.367] lstrlenA (lpString="*.html") returned 6 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.367] lstrlenA (lpString="*.mdb") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.367] lstrlenA (lpString="*.cer") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.367] lstrlenA (lpString="*.p12") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.367] lstrlenA (lpString="*.pfx") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.367] lstrlenA (lpString="*.kwm") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.367] lstrlenA (lpString="*.pwm") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.367] lstrlenA (lpString="*.1cd") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.367] lstrlenA (lpString="*.md") returned 4 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.367] lstrlenA (lpString="*.mdf") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.367] lstrlenA (lpString="*.dbf") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.367] lstrlenA (lpString="*.odt") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.367] lstrlenA (lpString="*.vob") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.367] lstrlenA (lpString="*.ifo") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.367] lstrlenA (lpString="*.lnk") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.367] lstrlenA (lpString="*.torrent") returned 9 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.367] lstrlenA (lpString="*.mov") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.367] lstrlenA (lpString="*.m2v") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.368] lstrlenA (lpString="*.3gp") returned 5 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.368] lstrlenA (lpString="*.mpeg") returned 6 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.368] lstrlenA (lpString="*.mpg") returned 5 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.368] lstrlenA (lpString="*.flv") returned 5 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.368] lstrlenA (lpString="*.avi") returned 5 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.368] lstrlenA (lpString="*.mp4") returned 5 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.368] lstrlenA (lpString="*.wmv") returned 5 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.368] lstrlenA (lpString="*.divx") returned 6 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.368] lstrlenA (lpString="*.mkv") returned 5 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.368] lstrlenA (lpString="*.mp3") returned 5 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.368] lstrlenA (lpString="*.wav") returned 5 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.368] lstrlenA (lpString="*.flac") returned 6 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.368] lstrlenA (lpString="*.ape") returned 5 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.368] lstrlenA (lpString="*.wma") returned 5 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.368] lstrlenA (lpString="*.ac3") returned 5 [0062.368] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.368] lstrlenA (lpString="*.doc") returned 5 [0062.368] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.368] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0062.369] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1053", cAlternateFileName="")) returned 1 [0062.369] lstrcmpA (lpString1=".", lpString2="1053") returned -1 [0062.369] lstrcmpA (lpString1="..", lpString2="1053") returned -1 [0062.369] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.369] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1053" | out: lpString1="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0062.369] lstrlenA (lpString="C:\\588bce7c90097ed212\\1053") returned 26 [0062.369] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759f10 [0062.369] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.370] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.370] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.370] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.370] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.370] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.370] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.370] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.370] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.370] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1053\\*.*") returned="*.*" [0062.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1053\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0062.370] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1053\\" | out: pszPath="C:\\588bce7c90097ed212\\1053\\") returned="" [0062.370] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1053\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1053\\HOW TO DECRYPT FILES.txt" [0062.370] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1053\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\how to decrypt files.txt")) returned 0xffffffff [0062.370] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1053\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.372] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.372] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.373] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.373] CloseHandle (hObject=0x208) returned 1 [0062.373] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf" [0062.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.zip") returned 0 [0062.373] lstrlenA (lpString="*.zip") returned 5 [0062.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.rar") returned 0 [0062.373] lstrlenA (lpString="*.rar") returned 5 [0062.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.7z") returned 0 [0062.373] lstrlenA (lpString="*.7z") returned 4 [0062.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.tar") returned 0 [0062.373] lstrlenA (lpString="*.tar") returned 5 [0062.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.373] lstrlenA (lpString="*.gzip") returned 6 [0062.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.373] lstrlenA (lpString="*.jpg") returned 5 [0062.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.373] lstrlenA (lpString="*.jpeg") returned 6 [0062.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.psd") returned 0 [0062.373] lstrlenA (lpString="*.psd") returned 5 [0062.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.373] lstrlenA (lpString="*.cdr") returned 5 [0062.373] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.374] lstrlenA (lpString="*.dwg") returned 5 [0062.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.max") returned 0 [0062.374] lstrlenA (lpString="*.max") returned 5 [0062.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.374] lstrlenA (lpString="*.bmp") returned 5 [0062.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.gif") returned 0 [0062.374] lstrlenA (lpString="*.gif") returned 5 [0062.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.png") returned 0 [0062.374] lstrlenA (lpString="*.png") returned 5 [0062.374] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.doc") returned 0 [0062.375] lstrlenA (lpString="*.doc") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.docx") returned 0 [0062.375] lstrlenA (lpString="*.docx") returned 6 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.xls") returned 0 [0062.375] lstrlenA (lpString="*.xls") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.375] lstrlenA (lpString="*.xlsx") returned 6 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.375] lstrlenA (lpString="*.ppt") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.375] lstrlenA (lpString="*.pptx") returned 6 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.txt") returned 0 [0062.375] lstrlenA (lpString="*.txt") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.375] lstrlenA (lpString="*.pdf") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.375] lstrlenA (lpString="*.djvu") returned 6 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.htm") returned 0 [0062.375] lstrlenA (lpString="*.htm") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.html") returned 0 [0062.375] lstrlenA (lpString="*.html") returned 6 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.375] lstrlenA (lpString="*.mdb") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.cer") returned 0 [0062.375] lstrlenA (lpString="*.cer") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.p12") returned 0 [0062.375] lstrlenA (lpString="*.p12") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.375] lstrlenA (lpString="*.pfx") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.375] lstrlenA (lpString="*.kwm") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.375] lstrlenA (lpString="*.pwm") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.375] lstrlenA (lpString="*.1cd") returned 5 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.md") returned 0 [0062.375] lstrlenA (lpString="*.md") returned 4 [0062.375] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.376] lstrlenA (lpString="*.mdf") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.376] lstrlenA (lpString="*.dbf") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.odt") returned 0 [0062.376] lstrlenA (lpString="*.odt") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.vob") returned 0 [0062.376] lstrlenA (lpString="*.vob") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.376] lstrlenA (lpString="*.ifo") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.376] lstrlenA (lpString="*.lnk") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.376] lstrlenA (lpString="*.torrent") returned 9 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mov") returned 0 [0062.376] lstrlenA (lpString="*.mov") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.376] lstrlenA (lpString="*.m2v") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.376] lstrlenA (lpString="*.3gp") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.376] lstrlenA (lpString="*.mpeg") returned 6 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.376] lstrlenA (lpString="*.mpg") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.flv") returned 0 [0062.376] lstrlenA (lpString="*.flv") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.avi") returned 0 [0062.376] lstrlenA (lpString="*.avi") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.376] lstrlenA (lpString="*.mp4") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.376] lstrlenA (lpString="*.wmv") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.divx") returned 0 [0062.376] lstrlenA (lpString="*.divx") returned 6 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.376] lstrlenA (lpString="*.mkv") returned 5 [0062.376] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.376] lstrlenA (lpString="*.mp3") returned 5 [0062.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.wav") returned 0 [0062.377] lstrlenA (lpString="*.wav") returned 5 [0062.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.flac") returned 0 [0062.377] lstrlenA (lpString="*.flac") returned 6 [0062.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.ape") returned 0 [0062.377] lstrlenA (lpString="*.ape") returned 5 [0062.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.wma") returned 0 [0062.377] lstrlenA (lpString="*.wma") returned 5 [0062.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.377] lstrlenA (lpString="*.ac3") returned 5 [0062.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\eula.rtf", pszSpec="*.doc") returned 0 [0062.377] lstrlenA (lpString="*.doc") returned 5 [0062.377] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.377] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.377] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.377] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned="eula.rtf" [0062.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1053\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0062.377] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1053\\" | out: pszPath="C:\\588bce7c90097ed212\\1053\\") returned="" [0062.377] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1053\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1053\\HOW TO DECRYPT FILES.txt" [0062.377] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1053\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\how to decrypt files.txt")) returned 0x20 [0062.377] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" [0062.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.377] lstrlenA (lpString="*.zip") returned 5 [0062.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.377] lstrlenA (lpString="*.rar") returned 5 [0062.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.377] lstrlenA (lpString="*.7z") returned 4 [0062.377] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.378] lstrlenA (lpString="*.tar") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.378] lstrlenA (lpString="*.gzip") returned 6 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.378] lstrlenA (lpString="*.jpg") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.378] lstrlenA (lpString="*.jpeg") returned 6 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.378] lstrlenA (lpString="*.psd") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.378] lstrlenA (lpString="*.cdr") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.378] lstrlenA (lpString="*.dwg") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.378] lstrlenA (lpString="*.max") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.378] lstrlenA (lpString="*.bmp") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.378] lstrlenA (lpString="*.gif") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.378] lstrlenA (lpString="*.png") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.378] lstrlenA (lpString="*.doc") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.378] lstrlenA (lpString="*.docx") returned 6 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.378] lstrlenA (lpString="*.xls") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.378] lstrlenA (lpString="*.xlsx") returned 6 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.378] lstrlenA (lpString="*.ppt") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.378] lstrlenA (lpString="*.pptx") returned 6 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.378] lstrlenA (lpString="*.txt") returned 5 [0062.378] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.379] lstrlenA (lpString="*.pdf") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.379] lstrlenA (lpString="*.djvu") returned 6 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.379] lstrlenA (lpString="*.htm") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.379] lstrlenA (lpString="*.html") returned 6 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.379] lstrlenA (lpString="*.mdb") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.379] lstrlenA (lpString="*.cer") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.379] lstrlenA (lpString="*.p12") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.379] lstrlenA (lpString="*.pfx") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.379] lstrlenA (lpString="*.kwm") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.379] lstrlenA (lpString="*.pwm") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.379] lstrlenA (lpString="*.1cd") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.379] lstrlenA (lpString="*.md") returned 4 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.379] lstrlenA (lpString="*.mdf") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.379] lstrlenA (lpString="*.dbf") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.379] lstrlenA (lpString="*.odt") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.379] lstrlenA (lpString="*.vob") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.379] lstrlenA (lpString="*.ifo") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.379] lstrlenA (lpString="*.lnk") returned 5 [0062.379] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.379] lstrlenA (lpString="*.torrent") returned 9 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.380] lstrlenA (lpString="*.mov") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.380] lstrlenA (lpString="*.m2v") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.380] lstrlenA (lpString="*.3gp") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.380] lstrlenA (lpString="*.mpeg") returned 6 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.380] lstrlenA (lpString="*.mpg") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.380] lstrlenA (lpString="*.flv") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.380] lstrlenA (lpString="*.avi") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.380] lstrlenA (lpString="*.mp4") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.380] lstrlenA (lpString="*.wmv") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.380] lstrlenA (lpString="*.divx") returned 6 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.380] lstrlenA (lpString="*.mkv") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.380] lstrlenA (lpString="*.mp3") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.380] lstrlenA (lpString="*.wav") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.380] lstrlenA (lpString="*.flac") returned 6 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.380] lstrlenA (lpString="*.ape") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.380] lstrlenA (lpString="*.wma") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.380] lstrlenA (lpString="*.ac3") returned 5 [0062.380] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.380] lstrlenA (lpString="*.doc") returned 5 [0062.380] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.381] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.381] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.381] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned="LocalizedData.xml" [0062.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1053\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0062.381] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1053\\" | out: pszPath="C:\\588bce7c90097ed212\\1053\\") returned="" [0062.381] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1053\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1053\\HOW TO DECRYPT FILES.txt" [0062.381] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1053\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\how to decrypt files.txt")) returned 0x20 [0062.381] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" [0062.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.381] lstrlenA (lpString="*.zip") returned 5 [0062.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.381] lstrlenA (lpString="*.rar") returned 5 [0062.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.381] lstrlenA (lpString="*.7z") returned 4 [0062.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.381] lstrlenA (lpString="*.tar") returned 5 [0062.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.381] lstrlenA (lpString="*.gzip") returned 6 [0062.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.381] lstrlenA (lpString="*.jpg") returned 5 [0062.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.381] lstrlenA (lpString="*.jpeg") returned 6 [0062.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.381] lstrlenA (lpString="*.psd") returned 5 [0062.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.381] lstrlenA (lpString="*.cdr") returned 5 [0062.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.381] lstrlenA (lpString="*.dwg") returned 5 [0062.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.381] lstrlenA (lpString="*.max") returned 5 [0062.381] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.382] lstrlenA (lpString="*.bmp") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.382] lstrlenA (lpString="*.gif") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.382] lstrlenA (lpString="*.png") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.382] lstrlenA (lpString="*.doc") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.382] lstrlenA (lpString="*.docx") returned 6 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.382] lstrlenA (lpString="*.xls") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.382] lstrlenA (lpString="*.xlsx") returned 6 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.382] lstrlenA (lpString="*.ppt") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.382] lstrlenA (lpString="*.pptx") returned 6 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.382] lstrlenA (lpString="*.txt") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.382] lstrlenA (lpString="*.pdf") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.382] lstrlenA (lpString="*.djvu") returned 6 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.382] lstrlenA (lpString="*.htm") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.382] lstrlenA (lpString="*.html") returned 6 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.382] lstrlenA (lpString="*.mdb") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.382] lstrlenA (lpString="*.cer") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.382] lstrlenA (lpString="*.p12") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.382] lstrlenA (lpString="*.pfx") returned 5 [0062.382] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.382] lstrlenA (lpString="*.kwm") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.383] lstrlenA (lpString="*.pwm") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.383] lstrlenA (lpString="*.1cd") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.383] lstrlenA (lpString="*.md") returned 4 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.383] lstrlenA (lpString="*.mdf") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.383] lstrlenA (lpString="*.dbf") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.383] lstrlenA (lpString="*.odt") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.383] lstrlenA (lpString="*.vob") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.383] lstrlenA (lpString="*.ifo") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.383] lstrlenA (lpString="*.lnk") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.383] lstrlenA (lpString="*.torrent") returned 9 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.383] lstrlenA (lpString="*.mov") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.383] lstrlenA (lpString="*.m2v") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.383] lstrlenA (lpString="*.3gp") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.383] lstrlenA (lpString="*.mpeg") returned 6 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.383] lstrlenA (lpString="*.mpg") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.383] lstrlenA (lpString="*.flv") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.383] lstrlenA (lpString="*.avi") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.383] lstrlenA (lpString="*.mp4") returned 5 [0062.383] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.384] lstrlenA (lpString="*.wmv") returned 5 [0062.384] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.384] lstrlenA (lpString="*.divx") returned 6 [0062.384] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.384] lstrlenA (lpString="*.mkv") returned 5 [0062.384] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.384] lstrlenA (lpString="*.mp3") returned 5 [0062.384] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.384] lstrlenA (lpString="*.wav") returned 5 [0062.384] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.384] lstrlenA (lpString="*.flac") returned 6 [0062.384] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.384] lstrlenA (lpString="*.ape") returned 5 [0062.384] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.384] lstrlenA (lpString="*.wma") returned 5 [0062.384] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.384] lstrlenA (lpString="*.ac3") returned 5 [0062.384] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.384] lstrlenA (lpString="*.doc") returned 5 [0062.384] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.384] FindClose (in: hFindFile=0x759f10 | out: hFindFile=0x759f10) returned 1 [0062.384] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="1055", cAlternateFileName="")) returned 1 [0062.384] lstrcmpA (lpString1=".", lpString2="1055") returned -1 [0062.384] lstrcmpA (lpString1="..", lpString2="1055") returned -1 [0062.384] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.384] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1055" | out: lpString1="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0062.384] lstrlenA (lpString="C:\\588bce7c90097ed212\\1055") returned 26 [0062.384] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759f50 [0062.385] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.385] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.385] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.385] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.385] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.385] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.385] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.385] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.385] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1055\\*.*") returned="*.*" [0062.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1055\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0062.386] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1055\\" | out: pszPath="C:\\588bce7c90097ed212\\1055\\") returned="" [0062.386] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1055\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1055\\HOW TO DECRYPT FILES.txt" [0062.386] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1055\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\how to decrypt files.txt")) returned 0xffffffff [0062.386] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\1055\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.390] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.390] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.394] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.394] CloseHandle (hObject=0x208) returned 1 [0062.394] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf" [0062.394] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.zip") returned 0 [0062.394] lstrlenA (lpString="*.zip") returned 5 [0062.394] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.rar") returned 0 [0062.394] lstrlenA (lpString="*.rar") returned 5 [0062.394] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.7z") returned 0 [0062.394] lstrlenA (lpString="*.7z") returned 4 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.tar") returned 0 [0062.395] lstrlenA (lpString="*.tar") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.395] lstrlenA (lpString="*.gzip") returned 6 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.395] lstrlenA (lpString="*.jpg") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.395] lstrlenA (lpString="*.jpeg") returned 6 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.psd") returned 0 [0062.395] lstrlenA (lpString="*.psd") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.395] lstrlenA (lpString="*.cdr") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.395] lstrlenA (lpString="*.dwg") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.max") returned 0 [0062.395] lstrlenA (lpString="*.max") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.395] lstrlenA (lpString="*.bmp") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.gif") returned 0 [0062.395] lstrlenA (lpString="*.gif") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.png") returned 0 [0062.395] lstrlenA (lpString="*.png") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.doc") returned 0 [0062.395] lstrlenA (lpString="*.doc") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.docx") returned 0 [0062.395] lstrlenA (lpString="*.docx") returned 6 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.xls") returned 0 [0062.395] lstrlenA (lpString="*.xls") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.395] lstrlenA (lpString="*.xlsx") returned 6 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.395] lstrlenA (lpString="*.ppt") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.395] lstrlenA (lpString="*.pptx") returned 6 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.txt") returned 0 [0062.395] lstrlenA (lpString="*.txt") returned 5 [0062.395] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.396] lstrlenA (lpString="*.pdf") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.396] lstrlenA (lpString="*.djvu") returned 6 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.htm") returned 0 [0062.396] lstrlenA (lpString="*.htm") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.html") returned 0 [0062.396] lstrlenA (lpString="*.html") returned 6 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.396] lstrlenA (lpString="*.mdb") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.cer") returned 0 [0062.396] lstrlenA (lpString="*.cer") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.p12") returned 0 [0062.396] lstrlenA (lpString="*.p12") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.396] lstrlenA (lpString="*.pfx") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.396] lstrlenA (lpString="*.kwm") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.396] lstrlenA (lpString="*.pwm") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.396] lstrlenA (lpString="*.1cd") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.md") returned 0 [0062.396] lstrlenA (lpString="*.md") returned 4 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.396] lstrlenA (lpString="*.mdf") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.396] lstrlenA (lpString="*.dbf") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.odt") returned 0 [0062.396] lstrlenA (lpString="*.odt") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.vob") returned 0 [0062.396] lstrlenA (lpString="*.vob") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.396] lstrlenA (lpString="*.ifo") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.396] lstrlenA (lpString="*.lnk") returned 5 [0062.396] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.396] lstrlenA (lpString="*.torrent") returned 9 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mov") returned 0 [0062.397] lstrlenA (lpString="*.mov") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.397] lstrlenA (lpString="*.m2v") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.397] lstrlenA (lpString="*.3gp") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.397] lstrlenA (lpString="*.mpeg") returned 6 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.397] lstrlenA (lpString="*.mpg") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.flv") returned 0 [0062.397] lstrlenA (lpString="*.flv") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.avi") returned 0 [0062.397] lstrlenA (lpString="*.avi") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.397] lstrlenA (lpString="*.mp4") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.397] lstrlenA (lpString="*.wmv") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.divx") returned 0 [0062.397] lstrlenA (lpString="*.divx") returned 6 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.397] lstrlenA (lpString="*.mkv") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.397] lstrlenA (lpString="*.mp3") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.wav") returned 0 [0062.397] lstrlenA (lpString="*.wav") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.flac") returned 0 [0062.397] lstrlenA (lpString="*.flac") returned 6 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.ape") returned 0 [0062.397] lstrlenA (lpString="*.ape") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.wma") returned 0 [0062.397] lstrlenA (lpString="*.wma") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.397] lstrlenA (lpString="*.ac3") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\eula.rtf", pszSpec="*.doc") returned 0 [0062.397] lstrlenA (lpString="*.doc") returned 5 [0062.398] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.398] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.398] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.398] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.398] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned="eula.rtf" [0062.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1055\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0062.398] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1055\\" | out: pszPath="C:\\588bce7c90097ed212\\1055\\") returned="" [0062.398] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1055\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1055\\HOW TO DECRYPT FILES.txt" [0062.398] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1055\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\how to decrypt files.txt")) returned 0x20 [0062.398] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" [0062.398] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.398] lstrlenA (lpString="*.zip") returned 5 [0062.398] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.398] lstrlenA (lpString="*.rar") returned 5 [0062.398] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.398] lstrlenA (lpString="*.7z") returned 4 [0062.398] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.398] lstrlenA (lpString="*.tar") returned 5 [0062.398] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.398] lstrlenA (lpString="*.gzip") returned 6 [0062.398] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.398] lstrlenA (lpString="*.jpg") returned 5 [0062.398] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.398] lstrlenA (lpString="*.jpeg") returned 6 [0062.398] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.398] lstrlenA (lpString="*.psd") returned 5 [0062.398] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.398] lstrlenA (lpString="*.cdr") returned 5 [0062.398] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.398] lstrlenA (lpString="*.dwg") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.399] lstrlenA (lpString="*.max") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.399] lstrlenA (lpString="*.bmp") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.399] lstrlenA (lpString="*.gif") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.399] lstrlenA (lpString="*.png") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.399] lstrlenA (lpString="*.doc") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.399] lstrlenA (lpString="*.docx") returned 6 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.399] lstrlenA (lpString="*.xls") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.399] lstrlenA (lpString="*.xlsx") returned 6 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.399] lstrlenA (lpString="*.ppt") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.399] lstrlenA (lpString="*.pptx") returned 6 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.399] lstrlenA (lpString="*.txt") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.399] lstrlenA (lpString="*.pdf") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.399] lstrlenA (lpString="*.djvu") returned 6 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.399] lstrlenA (lpString="*.htm") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.399] lstrlenA (lpString="*.html") returned 6 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.399] lstrlenA (lpString="*.mdb") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.399] lstrlenA (lpString="*.cer") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.399] lstrlenA (lpString="*.p12") returned 5 [0062.399] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.400] lstrlenA (lpString="*.pfx") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.400] lstrlenA (lpString="*.kwm") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.400] lstrlenA (lpString="*.pwm") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.400] lstrlenA (lpString="*.1cd") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.400] lstrlenA (lpString="*.md") returned 4 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.400] lstrlenA (lpString="*.mdf") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.400] lstrlenA (lpString="*.dbf") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.400] lstrlenA (lpString="*.odt") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.400] lstrlenA (lpString="*.vob") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.400] lstrlenA (lpString="*.ifo") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.400] lstrlenA (lpString="*.lnk") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.400] lstrlenA (lpString="*.torrent") returned 9 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.400] lstrlenA (lpString="*.mov") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.400] lstrlenA (lpString="*.m2v") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.400] lstrlenA (lpString="*.3gp") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.400] lstrlenA (lpString="*.mpeg") returned 6 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.400] lstrlenA (lpString="*.mpg") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.400] lstrlenA (lpString="*.flv") returned 5 [0062.400] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.401] lstrlenA (lpString="*.avi") returned 5 [0062.401] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.401] lstrlenA (lpString="*.mp4") returned 5 [0062.401] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.401] lstrlenA (lpString="*.wmv") returned 5 [0062.401] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.401] lstrlenA (lpString="*.divx") returned 6 [0062.401] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.401] lstrlenA (lpString="*.mkv") returned 5 [0062.401] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.401] lstrlenA (lpString="*.mp3") returned 5 [0062.401] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.401] lstrlenA (lpString="*.wav") returned 5 [0062.401] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.401] lstrlenA (lpString="*.flac") returned 6 [0062.401] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.401] lstrlenA (lpString="*.ape") returned 5 [0062.401] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.401] lstrlenA (lpString="*.wma") returned 5 [0062.401] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.401] lstrlenA (lpString="*.ac3") returned 5 [0062.401] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.401] lstrlenA (lpString="*.doc") returned 5 [0062.401] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.401] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.401] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.401] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.401] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned="LocalizedData.xml" [0062.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\1055\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0062.401] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\1055\\" | out: pszPath="C:\\588bce7c90097ed212\\1055\\") returned="" [0062.401] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\1055\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\1055\\HOW TO DECRYPT FILES.txt" [0062.401] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\1055\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\how to decrypt files.txt")) returned 0x20 [0062.401] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.402] lstrlenA (lpString="*.zip") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.402] lstrlenA (lpString="*.rar") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.402] lstrlenA (lpString="*.7z") returned 4 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.402] lstrlenA (lpString="*.tar") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.402] lstrlenA (lpString="*.gzip") returned 6 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.402] lstrlenA (lpString="*.jpg") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.402] lstrlenA (lpString="*.jpeg") returned 6 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.402] lstrlenA (lpString="*.psd") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.402] lstrlenA (lpString="*.cdr") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.402] lstrlenA (lpString="*.dwg") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.402] lstrlenA (lpString="*.max") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.402] lstrlenA (lpString="*.bmp") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.402] lstrlenA (lpString="*.gif") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.402] lstrlenA (lpString="*.png") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.402] lstrlenA (lpString="*.doc") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.402] lstrlenA (lpString="*.docx") returned 6 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.402] lstrlenA (lpString="*.xls") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.403] lstrlenA (lpString="*.xlsx") returned 6 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.403] lstrlenA (lpString="*.ppt") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.403] lstrlenA (lpString="*.pptx") returned 6 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.403] lstrlenA (lpString="*.txt") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.403] lstrlenA (lpString="*.pdf") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.403] lstrlenA (lpString="*.djvu") returned 6 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.403] lstrlenA (lpString="*.htm") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.403] lstrlenA (lpString="*.html") returned 6 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.403] lstrlenA (lpString="*.mdb") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.403] lstrlenA (lpString="*.cer") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.403] lstrlenA (lpString="*.p12") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.403] lstrlenA (lpString="*.pfx") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.403] lstrlenA (lpString="*.kwm") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.403] lstrlenA (lpString="*.pwm") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.403] lstrlenA (lpString="*.1cd") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.403] lstrlenA (lpString="*.md") returned 4 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.403] lstrlenA (lpString="*.mdf") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.403] lstrlenA (lpString="*.dbf") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.403] lstrlenA (lpString="*.odt") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.404] lstrlenA (lpString="*.vob") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.404] lstrlenA (lpString="*.ifo") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.404] lstrlenA (lpString="*.lnk") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.404] lstrlenA (lpString="*.torrent") returned 9 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.404] lstrlenA (lpString="*.mov") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.404] lstrlenA (lpString="*.m2v") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.404] lstrlenA (lpString="*.3gp") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.404] lstrlenA (lpString="*.mpeg") returned 6 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.404] lstrlenA (lpString="*.mpg") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.404] lstrlenA (lpString="*.flv") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.404] lstrlenA (lpString="*.avi") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.404] lstrlenA (lpString="*.mp4") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.404] lstrlenA (lpString="*.wmv") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.404] lstrlenA (lpString="*.divx") returned 6 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.404] lstrlenA (lpString="*.mkv") returned 5 [0062.404] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.405] lstrlenA (lpString="*.mp3") returned 5 [0062.405] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.405] lstrlenA (lpString="*.wav") returned 5 [0062.405] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.405] lstrlenA (lpString="*.flac") returned 6 [0062.405] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.405] lstrlenA (lpString="*.ape") returned 5 [0062.405] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.405] lstrlenA (lpString="*.wma") returned 5 [0062.408] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.408] lstrlenA (lpString="*.ac3") returned 5 [0062.408] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.409] lstrlenA (lpString="*.doc") returned 5 [0062.409] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.409] FindClose (in: hFindFile=0x759f50 | out: hFindFile=0x759f50) returned 1 [0062.409] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="2052", cAlternateFileName="")) returned 1 [0062.409] lstrcmpA (lpString1=".", lpString2="2052") returned -1 [0062.409] lstrcmpA (lpString1="..", lpString2="2052") returned -1 [0062.409] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.409] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="2052" | out: lpString1="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0062.409] lstrlenA (lpString="C:\\588bce7c90097ed212\\2052") returned 26 [0062.409] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0062.409] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.409] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.409] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.409] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.409] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.410] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.410] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.410] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.410] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\2052\\*.*") returned="*.*" [0062.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\2052\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0062.410] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\2052\\" | out: pszPath="C:\\588bce7c90097ed212\\2052\\") returned="" [0062.410] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\2052\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\2052\\HOW TO DECRYPT FILES.txt" [0062.410] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\2052\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\how to decrypt files.txt")) returned 0xffffffff [0062.410] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\2052\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.412] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.412] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.413] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.413] CloseHandle (hObject=0x208) returned 1 [0062.413] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf" [0062.413] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.zip") returned 0 [0062.414] lstrlenA (lpString="*.zip") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.rar") returned 0 [0062.414] lstrlenA (lpString="*.rar") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.7z") returned 0 [0062.414] lstrlenA (lpString="*.7z") returned 4 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.tar") returned 0 [0062.414] lstrlenA (lpString="*.tar") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.414] lstrlenA (lpString="*.gzip") returned 6 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.414] lstrlenA (lpString="*.jpg") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.414] lstrlenA (lpString="*.jpeg") returned 6 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.psd") returned 0 [0062.414] lstrlenA (lpString="*.psd") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.414] lstrlenA (lpString="*.cdr") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.414] lstrlenA (lpString="*.dwg") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.max") returned 0 [0062.414] lstrlenA (lpString="*.max") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.414] lstrlenA (lpString="*.bmp") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.gif") returned 0 [0062.414] lstrlenA (lpString="*.gif") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.png") returned 0 [0062.414] lstrlenA (lpString="*.png") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.doc") returned 0 [0062.414] lstrlenA (lpString="*.doc") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.docx") returned 0 [0062.414] lstrlenA (lpString="*.docx") returned 6 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.xls") returned 0 [0062.414] lstrlenA (lpString="*.xls") returned 5 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.414] lstrlenA (lpString="*.xlsx") returned 6 [0062.414] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.414] lstrlenA (lpString="*.ppt") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.415] lstrlenA (lpString="*.pptx") returned 6 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.txt") returned 0 [0062.415] lstrlenA (lpString="*.txt") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.415] lstrlenA (lpString="*.pdf") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.415] lstrlenA (lpString="*.djvu") returned 6 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.htm") returned 0 [0062.415] lstrlenA (lpString="*.htm") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.html") returned 0 [0062.415] lstrlenA (lpString="*.html") returned 6 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.415] lstrlenA (lpString="*.mdb") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.cer") returned 0 [0062.415] lstrlenA (lpString="*.cer") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.p12") returned 0 [0062.415] lstrlenA (lpString="*.p12") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.415] lstrlenA (lpString="*.pfx") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.415] lstrlenA (lpString="*.kwm") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.415] lstrlenA (lpString="*.pwm") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.415] lstrlenA (lpString="*.1cd") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.md") returned 0 [0062.415] lstrlenA (lpString="*.md") returned 4 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.415] lstrlenA (lpString="*.mdf") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.415] lstrlenA (lpString="*.dbf") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.odt") returned 0 [0062.415] lstrlenA (lpString="*.odt") returned 5 [0062.415] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.vob") returned 0 [0062.415] lstrlenA (lpString="*.vob") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.416] lstrlenA (lpString="*.ifo") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.416] lstrlenA (lpString="*.lnk") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.416] lstrlenA (lpString="*.torrent") returned 9 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mov") returned 0 [0062.416] lstrlenA (lpString="*.mov") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.416] lstrlenA (lpString="*.m2v") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.416] lstrlenA (lpString="*.3gp") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.416] lstrlenA (lpString="*.mpeg") returned 6 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.416] lstrlenA (lpString="*.mpg") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.flv") returned 0 [0062.416] lstrlenA (lpString="*.flv") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.avi") returned 0 [0062.416] lstrlenA (lpString="*.avi") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.416] lstrlenA (lpString="*.mp4") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.416] lstrlenA (lpString="*.wmv") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.divx") returned 0 [0062.416] lstrlenA (lpString="*.divx") returned 6 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.416] lstrlenA (lpString="*.mkv") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.416] lstrlenA (lpString="*.mp3") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.wav") returned 0 [0062.416] lstrlenA (lpString="*.wav") returned 5 [0062.417] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.flac") returned 0 [0062.417] lstrlenA (lpString="*.flac") returned 6 [0062.417] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.ape") returned 0 [0062.417] lstrlenA (lpString="*.ape") returned 5 [0062.417] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.wma") returned 0 [0062.417] lstrlenA (lpString="*.wma") returned 5 [0062.417] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.417] lstrlenA (lpString="*.ac3") returned 5 [0062.417] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\eula.rtf", pszSpec="*.doc") returned 0 [0062.417] lstrlenA (lpString="*.doc") returned 5 [0062.417] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.417] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.417] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.417] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned="eula.rtf" [0062.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\2052\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0062.417] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\2052\\" | out: pszPath="C:\\588bce7c90097ed212\\2052\\") returned="" [0062.417] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\2052\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\2052\\HOW TO DECRYPT FILES.txt" [0062.417] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\2052\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\how to decrypt files.txt")) returned 0x20 [0062.417] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" [0062.417] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.417] lstrlenA (lpString="*.zip") returned 5 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.418] lstrlenA (lpString="*.rar") returned 5 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.418] lstrlenA (lpString="*.7z") returned 4 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.418] lstrlenA (lpString="*.tar") returned 5 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.418] lstrlenA (lpString="*.gzip") returned 6 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.418] lstrlenA (lpString="*.jpg") returned 5 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.418] lstrlenA (lpString="*.jpeg") returned 6 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.418] lstrlenA (lpString="*.psd") returned 5 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.418] lstrlenA (lpString="*.cdr") returned 5 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.418] lstrlenA (lpString="*.dwg") returned 5 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.418] lstrlenA (lpString="*.max") returned 5 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.418] lstrlenA (lpString="*.bmp") returned 5 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.418] lstrlenA (lpString="*.gif") returned 5 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.418] lstrlenA (lpString="*.png") returned 5 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.418] lstrlenA (lpString="*.doc") returned 5 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.418] lstrlenA (lpString="*.docx") returned 6 [0062.418] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.419] lstrlenA (lpString="*.xls") returned 5 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.419] lstrlenA (lpString="*.xlsx") returned 6 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.419] lstrlenA (lpString="*.ppt") returned 5 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.419] lstrlenA (lpString="*.pptx") returned 6 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.419] lstrlenA (lpString="*.txt") returned 5 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.419] lstrlenA (lpString="*.pdf") returned 5 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.419] lstrlenA (lpString="*.djvu") returned 6 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.419] lstrlenA (lpString="*.htm") returned 5 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.419] lstrlenA (lpString="*.html") returned 6 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.419] lstrlenA (lpString="*.mdb") returned 5 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.419] lstrlenA (lpString="*.cer") returned 5 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.419] lstrlenA (lpString="*.p12") returned 5 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.419] lstrlenA (lpString="*.pfx") returned 5 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.419] lstrlenA (lpString="*.kwm") returned 5 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.419] lstrlenA (lpString="*.pwm") returned 5 [0062.419] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.420] lstrlenA (lpString="*.1cd") returned 5 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.420] lstrlenA (lpString="*.md") returned 4 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.420] lstrlenA (lpString="*.mdf") returned 5 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.420] lstrlenA (lpString="*.dbf") returned 5 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.420] lstrlenA (lpString="*.odt") returned 5 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.420] lstrlenA (lpString="*.vob") returned 5 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.420] lstrlenA (lpString="*.ifo") returned 5 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.420] lstrlenA (lpString="*.lnk") returned 5 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.420] lstrlenA (lpString="*.torrent") returned 9 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.420] lstrlenA (lpString="*.mov") returned 5 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.420] lstrlenA (lpString="*.m2v") returned 5 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.420] lstrlenA (lpString="*.3gp") returned 5 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.420] lstrlenA (lpString="*.mpeg") returned 6 [0062.420] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.420] lstrlenA (lpString="*.mpg") returned 5 [0062.421] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.421] lstrlenA (lpString="*.flv") returned 5 [0062.421] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.421] lstrlenA (lpString="*.avi") returned 5 [0062.421] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.421] lstrlenA (lpString="*.mp4") returned 5 [0062.421] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.421] lstrlenA (lpString="*.wmv") returned 5 [0062.421] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.421] lstrlenA (lpString="*.divx") returned 6 [0062.421] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.421] lstrlenA (lpString="*.mkv") returned 5 [0062.421] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.421] lstrlenA (lpString="*.mp3") returned 5 [0062.421] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.421] lstrlenA (lpString="*.wav") returned 5 [0062.421] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.422] lstrlenA (lpString="*.flac") returned 6 [0062.422] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.422] lstrlenA (lpString="*.ape") returned 5 [0062.422] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.422] lstrlenA (lpString="*.wma") returned 5 [0062.422] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.422] lstrlenA (lpString="*.ac3") returned 5 [0062.422] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.422] lstrlenA (lpString="*.doc") returned 5 [0062.422] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.422] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.422] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.422] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.422] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.422] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned="LocalizedData.xml" [0062.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\2052\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0062.422] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\2052\\" | out: pszPath="C:\\588bce7c90097ed212\\2052\\") returned="" [0062.422] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\2052\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\2052\\HOW TO DECRYPT FILES.txt" [0062.422] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\2052\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\how to decrypt files.txt")) returned 0x20 [0062.422] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.423] lstrlenA (lpString="*.zip") returned 5 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.423] lstrlenA (lpString="*.rar") returned 5 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.423] lstrlenA (lpString="*.7z") returned 4 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.423] lstrlenA (lpString="*.tar") returned 5 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.423] lstrlenA (lpString="*.gzip") returned 6 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.423] lstrlenA (lpString="*.jpg") returned 5 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.423] lstrlenA (lpString="*.jpeg") returned 6 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.423] lstrlenA (lpString="*.psd") returned 5 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.423] lstrlenA (lpString="*.cdr") returned 5 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.423] lstrlenA (lpString="*.dwg") returned 5 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.423] lstrlenA (lpString="*.max") returned 5 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.423] lstrlenA (lpString="*.bmp") returned 5 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.423] lstrlenA (lpString="*.gif") returned 5 [0062.423] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.424] lstrlenA (lpString="*.png") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.424] lstrlenA (lpString="*.doc") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.424] lstrlenA (lpString="*.docx") returned 6 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.424] lstrlenA (lpString="*.xls") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.424] lstrlenA (lpString="*.xlsx") returned 6 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.424] lstrlenA (lpString="*.ppt") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.424] lstrlenA (lpString="*.pptx") returned 6 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.424] lstrlenA (lpString="*.txt") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.424] lstrlenA (lpString="*.pdf") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.424] lstrlenA (lpString="*.djvu") returned 6 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.424] lstrlenA (lpString="*.htm") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.424] lstrlenA (lpString="*.html") returned 6 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.424] lstrlenA (lpString="*.mdb") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.424] lstrlenA (lpString="*.cer") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.424] lstrlenA (lpString="*.p12") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.424] lstrlenA (lpString="*.pfx") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.424] lstrlenA (lpString="*.kwm") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.424] lstrlenA (lpString="*.pwm") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.425] lstrlenA (lpString="*.1cd") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.425] lstrlenA (lpString="*.md") returned 4 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.425] lstrlenA (lpString="*.mdf") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.425] lstrlenA (lpString="*.dbf") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.425] lstrlenA (lpString="*.odt") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.425] lstrlenA (lpString="*.vob") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.425] lstrlenA (lpString="*.ifo") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.425] lstrlenA (lpString="*.lnk") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.425] lstrlenA (lpString="*.torrent") returned 9 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.425] lstrlenA (lpString="*.mov") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.425] lstrlenA (lpString="*.m2v") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.425] lstrlenA (lpString="*.3gp") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.425] lstrlenA (lpString="*.mpeg") returned 6 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.425] lstrlenA (lpString="*.mpg") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.425] lstrlenA (lpString="*.flv") returned 5 [0062.425] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.425] lstrlenA (lpString="*.avi") returned 5 [0062.426] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.426] lstrlenA (lpString="*.mp4") returned 5 [0062.426] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.426] lstrlenA (lpString="*.wmv") returned 5 [0062.426] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.426] lstrlenA (lpString="*.divx") returned 6 [0062.426] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.426] lstrlenA (lpString="*.mkv") returned 5 [0062.426] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.426] lstrlenA (lpString="*.mp3") returned 5 [0062.426] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.426] lstrlenA (lpString="*.wav") returned 5 [0062.426] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.426] lstrlenA (lpString="*.flac") returned 6 [0062.426] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.426] lstrlenA (lpString="*.ape") returned 5 [0062.426] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.426] lstrlenA (lpString="*.wma") returned 5 [0062.426] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.426] lstrlenA (lpString="*.ac3") returned 5 [0062.426] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.426] lstrlenA (lpString="*.doc") returned 5 [0062.426] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.426] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0062.426] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="2070", cAlternateFileName="")) returned 1 [0062.426] lstrcmpA (lpString1=".", lpString2="2070") returned -1 [0062.426] lstrcmpA (lpString1="..", lpString2="2070") returned -1 [0062.426] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.426] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="2070" | out: lpString1="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0062.427] lstrlenA (lpString="C:\\588bce7c90097ed212\\2070") returned 26 [0062.427] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0062.427] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.427] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.427] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.427] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.427] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.427] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.427] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.427] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\2070\\*.*") returned="*.*" [0062.427] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\2070\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0062.427] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\2070\\" | out: pszPath="C:\\588bce7c90097ed212\\2070\\") returned="" [0062.427] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\2070\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\2070\\HOW TO DECRYPT FILES.txt" [0062.427] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\2070\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\how to decrypt files.txt")) returned 0xffffffff [0062.427] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\2070\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.430] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.430] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.471] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.471] CloseHandle (hObject=0x208) returned 1 [0062.472] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned="C:\\588bce7c90097ed212\\2070\\eula.rtf" [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.zip") returned 0 [0062.472] lstrlenA (lpString="*.zip") returned 5 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.rar") returned 0 [0062.472] lstrlenA (lpString="*.rar") returned 5 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.7z") returned 0 [0062.472] lstrlenA (lpString="*.7z") returned 4 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.tar") returned 0 [0062.472] lstrlenA (lpString="*.tar") returned 5 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.472] lstrlenA (lpString="*.gzip") returned 6 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.472] lstrlenA (lpString="*.jpg") returned 5 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.472] lstrlenA (lpString="*.jpeg") returned 6 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.psd") returned 0 [0062.472] lstrlenA (lpString="*.psd") returned 5 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.472] lstrlenA (lpString="*.cdr") returned 5 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.472] lstrlenA (lpString="*.dwg") returned 5 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.max") returned 0 [0062.472] lstrlenA (lpString="*.max") returned 5 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.472] lstrlenA (lpString="*.bmp") returned 5 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.gif") returned 0 [0062.472] lstrlenA (lpString="*.gif") returned 5 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.png") returned 0 [0062.472] lstrlenA (lpString="*.png") returned 5 [0062.472] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.doc") returned 0 [0062.472] lstrlenA (lpString="*.doc") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.docx") returned 0 [0062.473] lstrlenA (lpString="*.docx") returned 6 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.xls") returned 0 [0062.473] lstrlenA (lpString="*.xls") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.473] lstrlenA (lpString="*.xlsx") returned 6 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.473] lstrlenA (lpString="*.ppt") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.473] lstrlenA (lpString="*.pptx") returned 6 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.txt") returned 0 [0062.473] lstrlenA (lpString="*.txt") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.473] lstrlenA (lpString="*.pdf") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.473] lstrlenA (lpString="*.djvu") returned 6 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.htm") returned 0 [0062.473] lstrlenA (lpString="*.htm") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.html") returned 0 [0062.473] lstrlenA (lpString="*.html") returned 6 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.473] lstrlenA (lpString="*.mdb") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.cer") returned 0 [0062.473] lstrlenA (lpString="*.cer") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.p12") returned 0 [0062.473] lstrlenA (lpString="*.p12") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.473] lstrlenA (lpString="*.pfx") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.473] lstrlenA (lpString="*.kwm") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.473] lstrlenA (lpString="*.pwm") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.473] lstrlenA (lpString="*.1cd") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.md") returned 0 [0062.473] lstrlenA (lpString="*.md") returned 4 [0062.473] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.473] lstrlenA (lpString="*.mdf") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.474] lstrlenA (lpString="*.dbf") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.odt") returned 0 [0062.474] lstrlenA (lpString="*.odt") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.vob") returned 0 [0062.474] lstrlenA (lpString="*.vob") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.474] lstrlenA (lpString="*.ifo") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.474] lstrlenA (lpString="*.lnk") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.474] lstrlenA (lpString="*.torrent") returned 9 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mov") returned 0 [0062.474] lstrlenA (lpString="*.mov") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.474] lstrlenA (lpString="*.m2v") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.474] lstrlenA (lpString="*.3gp") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.474] lstrlenA (lpString="*.mpeg") returned 6 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.474] lstrlenA (lpString="*.mpg") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.flv") returned 0 [0062.474] lstrlenA (lpString="*.flv") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.avi") returned 0 [0062.474] lstrlenA (lpString="*.avi") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.474] lstrlenA (lpString="*.mp4") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.474] lstrlenA (lpString="*.wmv") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.divx") returned 0 [0062.474] lstrlenA (lpString="*.divx") returned 6 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.474] lstrlenA (lpString="*.mkv") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.474] lstrlenA (lpString="*.mp3") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.wav") returned 0 [0062.474] lstrlenA (lpString="*.wav") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.flac") returned 0 [0062.475] lstrlenA (lpString="*.flac") returned 6 [0062.475] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.ape") returned 0 [0062.475] lstrlenA (lpString="*.ape") returned 5 [0062.475] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.wma") returned 0 [0062.475] lstrlenA (lpString="*.wma") returned 5 [0062.475] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.475] lstrlenA (lpString="*.ac3") returned 5 [0062.475] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\eula.rtf", pszSpec="*.doc") returned 0 [0062.475] lstrlenA (lpString="*.doc") returned 5 [0062.475] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.475] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.476] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.476] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.476] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned="eula.rtf" [0062.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\2070\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0062.476] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\2070\\" | out: pszPath="C:\\588bce7c90097ed212\\2070\\") returned="" [0062.476] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\2070\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\2070\\HOW TO DECRYPT FILES.txt" [0062.476] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\2070\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\how to decrypt files.txt")) returned 0x20 [0062.476] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" [0062.476] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.476] lstrlenA (lpString="*.zip") returned 5 [0062.476] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.476] lstrlenA (lpString="*.rar") returned 5 [0062.476] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.476] lstrlenA (lpString="*.7z") returned 4 [0062.476] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.476] lstrlenA (lpString="*.tar") returned 5 [0062.476] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.476] lstrlenA (lpString="*.gzip") returned 6 [0062.476] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.476] lstrlenA (lpString="*.jpg") returned 5 [0062.476] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.476] lstrlenA (lpString="*.jpeg") returned 6 [0062.476] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.476] lstrlenA (lpString="*.psd") returned 5 [0062.476] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.476] lstrlenA (lpString="*.cdr") returned 5 [0062.476] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.476] lstrlenA (lpString="*.dwg") returned 5 [0062.476] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.476] lstrlenA (lpString="*.max") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.477] lstrlenA (lpString="*.bmp") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.477] lstrlenA (lpString="*.gif") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.477] lstrlenA (lpString="*.png") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.477] lstrlenA (lpString="*.doc") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.477] lstrlenA (lpString="*.docx") returned 6 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.477] lstrlenA (lpString="*.xls") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.477] lstrlenA (lpString="*.xlsx") returned 6 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.477] lstrlenA (lpString="*.ppt") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.477] lstrlenA (lpString="*.pptx") returned 6 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.477] lstrlenA (lpString="*.txt") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.477] lstrlenA (lpString="*.pdf") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.477] lstrlenA (lpString="*.djvu") returned 6 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.477] lstrlenA (lpString="*.htm") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.477] lstrlenA (lpString="*.html") returned 6 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.477] lstrlenA (lpString="*.mdb") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.477] lstrlenA (lpString="*.cer") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.477] lstrlenA (lpString="*.p12") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.477] lstrlenA (lpString="*.pfx") returned 5 [0062.477] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.478] lstrlenA (lpString="*.kwm") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.478] lstrlenA (lpString="*.pwm") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.478] lstrlenA (lpString="*.1cd") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.478] lstrlenA (lpString="*.md") returned 4 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.478] lstrlenA (lpString="*.mdf") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.478] lstrlenA (lpString="*.dbf") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.478] lstrlenA (lpString="*.odt") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.478] lstrlenA (lpString="*.vob") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.478] lstrlenA (lpString="*.ifo") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.478] lstrlenA (lpString="*.lnk") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.478] lstrlenA (lpString="*.torrent") returned 9 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.478] lstrlenA (lpString="*.mov") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.478] lstrlenA (lpString="*.m2v") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.478] lstrlenA (lpString="*.3gp") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.478] lstrlenA (lpString="*.mpeg") returned 6 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.478] lstrlenA (lpString="*.mpg") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.478] lstrlenA (lpString="*.flv") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.478] lstrlenA (lpString="*.avi") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.478] lstrlenA (lpString="*.mp4") returned 5 [0062.478] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.478] lstrlenA (lpString="*.wmv") returned 5 [0062.479] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.479] lstrlenA (lpString="*.divx") returned 6 [0062.479] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.479] lstrlenA (lpString="*.mkv") returned 5 [0062.479] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.479] lstrlenA (lpString="*.mp3") returned 5 [0062.479] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.479] lstrlenA (lpString="*.wav") returned 5 [0062.479] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.479] lstrlenA (lpString="*.flac") returned 6 [0062.479] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.479] lstrlenA (lpString="*.ape") returned 5 [0062.479] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.479] lstrlenA (lpString="*.wma") returned 5 [0062.479] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.479] lstrlenA (lpString="*.ac3") returned 5 [0062.479] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.479] lstrlenA (lpString="*.doc") returned 5 [0062.479] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.479] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.479] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.479] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.479] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned="LocalizedData.xml" [0062.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\2070\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0062.479] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\2070\\" | out: pszPath="C:\\588bce7c90097ed212\\2070\\") returned="" [0062.479] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\2070\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\2070\\HOW TO DECRYPT FILES.txt" [0062.479] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\2070\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\how to decrypt files.txt")) returned 0x20 [0062.479] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" [0062.479] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.479] lstrlenA (lpString="*.zip") returned 5 [0062.479] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.480] lstrlenA (lpString="*.rar") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.480] lstrlenA (lpString="*.7z") returned 4 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.480] lstrlenA (lpString="*.tar") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.480] lstrlenA (lpString="*.gzip") returned 6 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.480] lstrlenA (lpString="*.jpg") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.480] lstrlenA (lpString="*.jpeg") returned 6 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.480] lstrlenA (lpString="*.psd") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.480] lstrlenA (lpString="*.cdr") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.480] lstrlenA (lpString="*.dwg") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.480] lstrlenA (lpString="*.max") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.480] lstrlenA (lpString="*.bmp") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.480] lstrlenA (lpString="*.gif") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.480] lstrlenA (lpString="*.png") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.480] lstrlenA (lpString="*.doc") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.480] lstrlenA (lpString="*.docx") returned 6 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.480] lstrlenA (lpString="*.xls") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.480] lstrlenA (lpString="*.xlsx") returned 6 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.480] lstrlenA (lpString="*.ppt") returned 5 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.480] lstrlenA (lpString="*.pptx") returned 6 [0062.480] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.481] lstrlenA (lpString="*.txt") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.481] lstrlenA (lpString="*.pdf") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.481] lstrlenA (lpString="*.djvu") returned 6 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.481] lstrlenA (lpString="*.htm") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.481] lstrlenA (lpString="*.html") returned 6 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.481] lstrlenA (lpString="*.mdb") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.481] lstrlenA (lpString="*.cer") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.481] lstrlenA (lpString="*.p12") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.481] lstrlenA (lpString="*.pfx") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.481] lstrlenA (lpString="*.kwm") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.481] lstrlenA (lpString="*.pwm") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.481] lstrlenA (lpString="*.1cd") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.481] lstrlenA (lpString="*.md") returned 4 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.481] lstrlenA (lpString="*.mdf") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.481] lstrlenA (lpString="*.dbf") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.481] lstrlenA (lpString="*.odt") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.481] lstrlenA (lpString="*.vob") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.481] lstrlenA (lpString="*.ifo") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.481] lstrlenA (lpString="*.lnk") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.482] lstrlenA (lpString="*.torrent") returned 9 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.482] lstrlenA (lpString="*.mov") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.482] lstrlenA (lpString="*.m2v") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.482] lstrlenA (lpString="*.3gp") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.482] lstrlenA (lpString="*.mpeg") returned 6 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.482] lstrlenA (lpString="*.mpg") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.482] lstrlenA (lpString="*.flv") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.482] lstrlenA (lpString="*.avi") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.482] lstrlenA (lpString="*.mp4") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.482] lstrlenA (lpString="*.wmv") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.482] lstrlenA (lpString="*.divx") returned 6 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.482] lstrlenA (lpString="*.mkv") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.482] lstrlenA (lpString="*.mp3") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.482] lstrlenA (lpString="*.wav") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.482] lstrlenA (lpString="*.flac") returned 6 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.482] lstrlenA (lpString="*.ape") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.482] lstrlenA (lpString="*.wma") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.482] lstrlenA (lpString="*.ac3") returned 5 [0062.482] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.482] lstrlenA (lpString="*.doc") returned 5 [0062.482] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.483] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0062.483] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="3076", cAlternateFileName="")) returned 1 [0062.483] lstrcmpA (lpString1=".", lpString2="3076") returned -1 [0062.483] lstrcmpA (lpString1="..", lpString2="3076") returned -1 [0062.483] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.483] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="3076" | out: lpString1="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0062.483] lstrlenA (lpString="C:\\588bce7c90097ed212\\3076") returned 26 [0062.483] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0062.492] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.492] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.492] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.492] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.492] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.492] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.492] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.492] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.492] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\3076\\*.*") returned="*.*" [0062.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\3076\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0062.492] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\3076\\" | out: pszPath="C:\\588bce7c90097ed212\\3076\\") returned="" [0062.492] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\3076\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\3076\\HOW TO DECRYPT FILES.txt" [0062.492] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\3076\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\how to decrypt files.txt")) returned 0xffffffff [0062.492] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\3076\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.494] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.494] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.495] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.495] CloseHandle (hObject=0x208) returned 1 [0062.495] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned="C:\\588bce7c90097ed212\\3076\\eula.rtf" [0062.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.zip") returned 0 [0062.495] lstrlenA (lpString="*.zip") returned 5 [0062.495] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.rar") returned 0 [0062.495] lstrlenA (lpString="*.rar") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.7z") returned 0 [0062.496] lstrlenA (lpString="*.7z") returned 4 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.tar") returned 0 [0062.496] lstrlenA (lpString="*.tar") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.496] lstrlenA (lpString="*.gzip") returned 6 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.496] lstrlenA (lpString="*.jpg") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.496] lstrlenA (lpString="*.jpeg") returned 6 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.psd") returned 0 [0062.496] lstrlenA (lpString="*.psd") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.496] lstrlenA (lpString="*.cdr") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.496] lstrlenA (lpString="*.dwg") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.max") returned 0 [0062.496] lstrlenA (lpString="*.max") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.496] lstrlenA (lpString="*.bmp") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.gif") returned 0 [0062.496] lstrlenA (lpString="*.gif") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.png") returned 0 [0062.496] lstrlenA (lpString="*.png") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.doc") returned 0 [0062.496] lstrlenA (lpString="*.doc") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.docx") returned 0 [0062.496] lstrlenA (lpString="*.docx") returned 6 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.xls") returned 0 [0062.496] lstrlenA (lpString="*.xls") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.496] lstrlenA (lpString="*.xlsx") returned 6 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.496] lstrlenA (lpString="*.ppt") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.496] lstrlenA (lpString="*.pptx") returned 6 [0062.496] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.txt") returned 0 [0062.497] lstrlenA (lpString="*.txt") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.497] lstrlenA (lpString="*.pdf") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.497] lstrlenA (lpString="*.djvu") returned 6 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.htm") returned 0 [0062.497] lstrlenA (lpString="*.htm") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.html") returned 0 [0062.497] lstrlenA (lpString="*.html") returned 6 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.497] lstrlenA (lpString="*.mdb") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.cer") returned 0 [0062.497] lstrlenA (lpString="*.cer") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.p12") returned 0 [0062.497] lstrlenA (lpString="*.p12") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.497] lstrlenA (lpString="*.pfx") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.497] lstrlenA (lpString="*.kwm") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.497] lstrlenA (lpString="*.pwm") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.497] lstrlenA (lpString="*.1cd") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.md") returned 0 [0062.497] lstrlenA (lpString="*.md") returned 4 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.497] lstrlenA (lpString="*.mdf") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.497] lstrlenA (lpString="*.dbf") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.odt") returned 0 [0062.497] lstrlenA (lpString="*.odt") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.vob") returned 0 [0062.497] lstrlenA (lpString="*.vob") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.497] lstrlenA (lpString="*.ifo") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.497] lstrlenA (lpString="*.lnk") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.498] lstrlenA (lpString="*.torrent") returned 9 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mov") returned 0 [0062.498] lstrlenA (lpString="*.mov") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.498] lstrlenA (lpString="*.m2v") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.498] lstrlenA (lpString="*.3gp") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.498] lstrlenA (lpString="*.mpeg") returned 6 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.498] lstrlenA (lpString="*.mpg") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.flv") returned 0 [0062.498] lstrlenA (lpString="*.flv") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.avi") returned 0 [0062.498] lstrlenA (lpString="*.avi") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.498] lstrlenA (lpString="*.mp4") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.498] lstrlenA (lpString="*.wmv") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.divx") returned 0 [0062.498] lstrlenA (lpString="*.divx") returned 6 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.498] lstrlenA (lpString="*.mkv") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.498] lstrlenA (lpString="*.mp3") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.wav") returned 0 [0062.498] lstrlenA (lpString="*.wav") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.flac") returned 0 [0062.498] lstrlenA (lpString="*.flac") returned 6 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.ape") returned 0 [0062.498] lstrlenA (lpString="*.ape") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.wma") returned 0 [0062.498] lstrlenA (lpString="*.wma") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.498] lstrlenA (lpString="*.ac3") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\eula.rtf", pszSpec="*.doc") returned 0 [0062.498] lstrlenA (lpString="*.doc") returned 5 [0062.499] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.499] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.499] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.500] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.500] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned="eula.rtf" [0062.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\3076\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0062.500] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\3076\\" | out: pszPath="C:\\588bce7c90097ed212\\3076\\") returned="" [0062.501] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\3076\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\3076\\HOW TO DECRYPT FILES.txt" [0062.501] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\3076\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\how to decrypt files.txt")) returned 0x20 [0062.501] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.501] lstrlenA (lpString="*.zip") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.501] lstrlenA (lpString="*.rar") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.501] lstrlenA (lpString="*.7z") returned 4 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.501] lstrlenA (lpString="*.tar") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.501] lstrlenA (lpString="*.gzip") returned 6 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.501] lstrlenA (lpString="*.jpg") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.501] lstrlenA (lpString="*.jpeg") returned 6 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.501] lstrlenA (lpString="*.psd") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.501] lstrlenA (lpString="*.cdr") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.501] lstrlenA (lpString="*.dwg") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.501] lstrlenA (lpString="*.max") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.501] lstrlenA (lpString="*.bmp") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.501] lstrlenA (lpString="*.gif") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.501] lstrlenA (lpString="*.png") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.502] lstrlenA (lpString="*.doc") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.502] lstrlenA (lpString="*.docx") returned 6 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.502] lstrlenA (lpString="*.xls") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.502] lstrlenA (lpString="*.xlsx") returned 6 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.502] lstrlenA (lpString="*.ppt") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.502] lstrlenA (lpString="*.pptx") returned 6 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.502] lstrlenA (lpString="*.txt") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.502] lstrlenA (lpString="*.pdf") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.502] lstrlenA (lpString="*.djvu") returned 6 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.502] lstrlenA (lpString="*.htm") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.502] lstrlenA (lpString="*.html") returned 6 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.502] lstrlenA (lpString="*.mdb") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.502] lstrlenA (lpString="*.cer") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.502] lstrlenA (lpString="*.p12") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.502] lstrlenA (lpString="*.pfx") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.502] lstrlenA (lpString="*.kwm") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.502] lstrlenA (lpString="*.pwm") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.502] lstrlenA (lpString="*.1cd") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.502] lstrlenA (lpString="*.md") returned 4 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.503] lstrlenA (lpString="*.mdf") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.503] lstrlenA (lpString="*.dbf") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.503] lstrlenA (lpString="*.odt") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.503] lstrlenA (lpString="*.vob") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.503] lstrlenA (lpString="*.ifo") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.503] lstrlenA (lpString="*.lnk") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.503] lstrlenA (lpString="*.torrent") returned 9 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.503] lstrlenA (lpString="*.mov") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.503] lstrlenA (lpString="*.m2v") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.503] lstrlenA (lpString="*.3gp") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.503] lstrlenA (lpString="*.mpeg") returned 6 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.503] lstrlenA (lpString="*.mpg") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.503] lstrlenA (lpString="*.flv") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.503] lstrlenA (lpString="*.avi") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.503] lstrlenA (lpString="*.mp4") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.503] lstrlenA (lpString="*.wmv") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.503] lstrlenA (lpString="*.divx") returned 6 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.503] lstrlenA (lpString="*.mkv") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.503] lstrlenA (lpString="*.mp3") returned 5 [0062.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.504] lstrlenA (lpString="*.wav") returned 5 [0062.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.504] lstrlenA (lpString="*.flac") returned 6 [0062.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.504] lstrlenA (lpString="*.ape") returned 5 [0062.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.504] lstrlenA (lpString="*.wma") returned 5 [0062.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.504] lstrlenA (lpString="*.ac3") returned 5 [0062.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.504] lstrlenA (lpString="*.doc") returned 5 [0062.504] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.504] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.504] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.504] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.504] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.504] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned="LocalizedData.xml" [0062.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\3076\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0062.504] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\3076\\" | out: pszPath="C:\\588bce7c90097ed212\\3076\\") returned="" [0062.504] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\3076\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\3076\\HOW TO DECRYPT FILES.txt" [0062.504] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\3076\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\how to decrypt files.txt")) returned 0x20 [0062.504] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" [0062.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.504] lstrlenA (lpString="*.zip") returned 5 [0062.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.504] lstrlenA (lpString="*.rar") returned 5 [0062.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.504] lstrlenA (lpString="*.7z") returned 4 [0062.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.504] lstrlenA (lpString="*.tar") returned 5 [0062.504] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.505] lstrlenA (lpString="*.gzip") returned 6 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.505] lstrlenA (lpString="*.jpg") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.505] lstrlenA (lpString="*.jpeg") returned 6 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.505] lstrlenA (lpString="*.psd") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.505] lstrlenA (lpString="*.cdr") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.505] lstrlenA (lpString="*.dwg") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.505] lstrlenA (lpString="*.max") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.505] lstrlenA (lpString="*.bmp") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.505] lstrlenA (lpString="*.gif") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.505] lstrlenA (lpString="*.png") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.505] lstrlenA (lpString="*.doc") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.505] lstrlenA (lpString="*.docx") returned 6 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.505] lstrlenA (lpString="*.xls") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.505] lstrlenA (lpString="*.xlsx") returned 6 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.505] lstrlenA (lpString="*.ppt") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.505] lstrlenA (lpString="*.pptx") returned 6 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.505] lstrlenA (lpString="*.txt") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.505] lstrlenA (lpString="*.pdf") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.505] lstrlenA (lpString="*.djvu") returned 6 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.506] lstrlenA (lpString="*.htm") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.506] lstrlenA (lpString="*.html") returned 6 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.506] lstrlenA (lpString="*.mdb") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.506] lstrlenA (lpString="*.cer") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.506] lstrlenA (lpString="*.p12") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.506] lstrlenA (lpString="*.pfx") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.506] lstrlenA (lpString="*.kwm") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.506] lstrlenA (lpString="*.pwm") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.506] lstrlenA (lpString="*.1cd") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.506] lstrlenA (lpString="*.md") returned 4 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.506] lstrlenA (lpString="*.mdf") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.506] lstrlenA (lpString="*.dbf") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.506] lstrlenA (lpString="*.odt") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.506] lstrlenA (lpString="*.vob") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.506] lstrlenA (lpString="*.ifo") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.506] lstrlenA (lpString="*.lnk") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.506] lstrlenA (lpString="*.torrent") returned 9 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.506] lstrlenA (lpString="*.mov") returned 5 [0062.506] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.506] lstrlenA (lpString="*.m2v") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.507] lstrlenA (lpString="*.3gp") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.507] lstrlenA (lpString="*.mpeg") returned 6 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.507] lstrlenA (lpString="*.mpg") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.507] lstrlenA (lpString="*.flv") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.507] lstrlenA (lpString="*.avi") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.507] lstrlenA (lpString="*.mp4") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.507] lstrlenA (lpString="*.wmv") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.507] lstrlenA (lpString="*.divx") returned 6 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.507] lstrlenA (lpString="*.mkv") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.507] lstrlenA (lpString="*.mp3") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.507] lstrlenA (lpString="*.wav") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.507] lstrlenA (lpString="*.flac") returned 6 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.507] lstrlenA (lpString="*.ape") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.507] lstrlenA (lpString="*.wma") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.507] lstrlenA (lpString="*.ac3") returned 5 [0062.507] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.507] lstrlenA (lpString="*.doc") returned 5 [0062.507] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.507] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0062.508] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="3082", cAlternateFileName="")) returned 1 [0062.508] lstrcmpA (lpString1=".", lpString2="3082") returned -1 [0062.508] lstrcmpA (lpString1="..", lpString2="3082") returned -1 [0062.508] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.508] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="3082" | out: lpString1="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0062.508] lstrlenA (lpString="C:\\588bce7c90097ed212\\3082") returned 26 [0062.508] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0062.509] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.509] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.509] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.509] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.509] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.509] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.509] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.rtf") returned -1 [0062.509] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.rtf") returned 1 [0062.510] lstrcmpiA (lpString1="", lpString2="eula.rtf") returned -1 [0062.510] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\3082\\*.*") returned="*.*" [0062.510] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\3082\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0062.510] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\3082\\" | out: pszPath="C:\\588bce7c90097ed212\\3082\\") returned="" [0062.510] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\3082\\HOW TO DECRYPT FILES.txt" [0062.510] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\how to decrypt files.txt")) returned 0xffffffff [0062.510] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.512] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.512] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.513] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.513] CloseHandle (hObject=0x208) returned 1 [0062.513] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned="C:\\588bce7c90097ed212\\3082\\eula.rtf" [0062.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.zip") returned 0 [0062.513] lstrlenA (lpString="*.zip") returned 5 [0062.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.rar") returned 0 [0062.513] lstrlenA (lpString="*.rar") returned 5 [0062.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.7z") returned 0 [0062.513] lstrlenA (lpString="*.7z") returned 4 [0062.513] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.tar") returned 0 [0062.514] lstrlenA (lpString="*.tar") returned 5 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.gzip") returned 0 [0062.514] lstrlenA (lpString="*.gzip") returned 6 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.jpg") returned 0 [0062.514] lstrlenA (lpString="*.jpg") returned 5 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.jpeg") returned 0 [0062.514] lstrlenA (lpString="*.jpeg") returned 6 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.psd") returned 0 [0062.514] lstrlenA (lpString="*.psd") returned 5 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.cdr") returned 0 [0062.514] lstrlenA (lpString="*.cdr") returned 5 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.dwg") returned 0 [0062.514] lstrlenA (lpString="*.dwg") returned 5 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.max") returned 0 [0062.514] lstrlenA (lpString="*.max") returned 5 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.bmp") returned 0 [0062.514] lstrlenA (lpString="*.bmp") returned 5 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.gif") returned 0 [0062.514] lstrlenA (lpString="*.gif") returned 5 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.png") returned 0 [0062.514] lstrlenA (lpString="*.png") returned 5 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.doc") returned 0 [0062.514] lstrlenA (lpString="*.doc") returned 5 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.docx") returned 0 [0062.514] lstrlenA (lpString="*.docx") returned 6 [0062.514] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.xls") returned 0 [0062.514] lstrlenA (lpString="*.xls") returned 5 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.xlsx") returned 0 [0062.515] lstrlenA (lpString="*.xlsx") returned 6 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.ppt") returned 0 [0062.515] lstrlenA (lpString="*.ppt") returned 5 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.pptx") returned 0 [0062.515] lstrlenA (lpString="*.pptx") returned 6 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.txt") returned 0 [0062.515] lstrlenA (lpString="*.txt") returned 5 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.pdf") returned 0 [0062.515] lstrlenA (lpString="*.pdf") returned 5 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.djvu") returned 0 [0062.515] lstrlenA (lpString="*.djvu") returned 6 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.htm") returned 0 [0062.515] lstrlenA (lpString="*.htm") returned 5 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.html") returned 0 [0062.515] lstrlenA (lpString="*.html") returned 6 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mdb") returned 0 [0062.515] lstrlenA (lpString="*.mdb") returned 5 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.cer") returned 0 [0062.515] lstrlenA (lpString="*.cer") returned 5 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.p12") returned 0 [0062.515] lstrlenA (lpString="*.p12") returned 5 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.pfx") returned 0 [0062.515] lstrlenA (lpString="*.pfx") returned 5 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.kwm") returned 0 [0062.515] lstrlenA (lpString="*.kwm") returned 5 [0062.515] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.pwm") returned 0 [0062.515] lstrlenA (lpString="*.pwm") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.1cd") returned 0 [0062.516] lstrlenA (lpString="*.1cd") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.md") returned 0 [0062.516] lstrlenA (lpString="*.md") returned 4 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mdf") returned 0 [0062.516] lstrlenA (lpString="*.mdf") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.dbf") returned 0 [0062.516] lstrlenA (lpString="*.dbf") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.odt") returned 0 [0062.516] lstrlenA (lpString="*.odt") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.vob") returned 0 [0062.516] lstrlenA (lpString="*.vob") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.ifo") returned 0 [0062.516] lstrlenA (lpString="*.ifo") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.lnk") returned 0 [0062.516] lstrlenA (lpString="*.lnk") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.torrent") returned 0 [0062.516] lstrlenA (lpString="*.torrent") returned 9 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mov") returned 0 [0062.516] lstrlenA (lpString="*.mov") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.m2v") returned 0 [0062.516] lstrlenA (lpString="*.m2v") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.3gp") returned 0 [0062.516] lstrlenA (lpString="*.3gp") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mpeg") returned 0 [0062.516] lstrlenA (lpString="*.mpeg") returned 6 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mpg") returned 0 [0062.516] lstrlenA (lpString="*.mpg") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.flv") returned 0 [0062.516] lstrlenA (lpString="*.flv") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.avi") returned 0 [0062.516] lstrlenA (lpString="*.avi") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mp4") returned 0 [0062.516] lstrlenA (lpString="*.mp4") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.wmv") returned 0 [0062.516] lstrlenA (lpString="*.wmv") returned 5 [0062.516] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.divx") returned 0 [0062.517] lstrlenA (lpString="*.divx") returned 6 [0062.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mkv") returned 0 [0062.517] lstrlenA (lpString="*.mkv") returned 5 [0062.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.mp3") returned 0 [0062.517] lstrlenA (lpString="*.mp3") returned 5 [0062.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.wav") returned 0 [0062.517] lstrlenA (lpString="*.wav") returned 5 [0062.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.flac") returned 0 [0062.517] lstrlenA (lpString="*.flac") returned 6 [0062.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.ape") returned 0 [0062.517] lstrlenA (lpString="*.ape") returned 5 [0062.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.wma") returned 0 [0062.517] lstrlenA (lpString="*.wma") returned 5 [0062.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.ac3") returned 0 [0062.517] lstrlenA (lpString="*.ac3") returned 5 [0062.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\eula.rtf", pszSpec="*.doc") returned 0 [0062.517] lstrlenA (lpString="*.doc") returned 5 [0062.517] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x1, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.517] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.517] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LocalizedData.xml") returned -1 [0062.517] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LocalizedData.xml") returned -1 [0062.517] lstrcmpiA (lpString1="", lpString2="LocalizedData.xml") returned -1 [0062.517] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned="eula.rtf" [0062.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\3082\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0062.517] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\3082\\" | out: pszPath="C:\\588bce7c90097ed212\\3082\\") returned="" [0062.517] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\3082\\HOW TO DECRYPT FILES.txt" [0062.517] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\how to decrypt files.txt")) returned 0x20 [0062.517] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" [0062.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.zip") returned 0 [0062.517] lstrlenA (lpString="*.zip") returned 5 [0062.517] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.rar") returned 0 [0062.517] lstrlenA (lpString="*.rar") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.7z") returned 0 [0062.518] lstrlenA (lpString="*.7z") returned 4 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.tar") returned 0 [0062.518] lstrlenA (lpString="*.tar") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.gzip") returned 0 [0062.518] lstrlenA (lpString="*.gzip") returned 6 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.jpg") returned 0 [0062.518] lstrlenA (lpString="*.jpg") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.jpeg") returned 0 [0062.518] lstrlenA (lpString="*.jpeg") returned 6 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.psd") returned 0 [0062.518] lstrlenA (lpString="*.psd") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.cdr") returned 0 [0062.518] lstrlenA (lpString="*.cdr") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.dwg") returned 0 [0062.518] lstrlenA (lpString="*.dwg") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.max") returned 0 [0062.518] lstrlenA (lpString="*.max") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.bmp") returned 0 [0062.518] lstrlenA (lpString="*.bmp") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.gif") returned 0 [0062.518] lstrlenA (lpString="*.gif") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.png") returned 0 [0062.518] lstrlenA (lpString="*.png") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.518] lstrlenA (lpString="*.doc") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.docx") returned 0 [0062.518] lstrlenA (lpString="*.docx") returned 6 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.xls") returned 0 [0062.518] lstrlenA (lpString="*.xls") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.xlsx") returned 0 [0062.518] lstrlenA (lpString="*.xlsx") returned 6 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.ppt") returned 0 [0062.518] lstrlenA (lpString="*.ppt") returned 5 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.pptx") returned 0 [0062.518] lstrlenA (lpString="*.pptx") returned 6 [0062.518] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.txt") returned 0 [0062.519] lstrlenA (lpString="*.txt") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.pdf") returned 0 [0062.519] lstrlenA (lpString="*.pdf") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.djvu") returned 0 [0062.519] lstrlenA (lpString="*.djvu") returned 6 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.htm") returned 0 [0062.519] lstrlenA (lpString="*.htm") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.html") returned 0 [0062.519] lstrlenA (lpString="*.html") returned 6 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mdb") returned 0 [0062.519] lstrlenA (lpString="*.mdb") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.cer") returned 0 [0062.519] lstrlenA (lpString="*.cer") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.p12") returned 0 [0062.519] lstrlenA (lpString="*.p12") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.pfx") returned 0 [0062.519] lstrlenA (lpString="*.pfx") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.kwm") returned 0 [0062.519] lstrlenA (lpString="*.kwm") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.pwm") returned 0 [0062.519] lstrlenA (lpString="*.pwm") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.1cd") returned 0 [0062.519] lstrlenA (lpString="*.1cd") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.md") returned 0 [0062.519] lstrlenA (lpString="*.md") returned 4 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mdf") returned 0 [0062.519] lstrlenA (lpString="*.mdf") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.dbf") returned 0 [0062.519] lstrlenA (lpString="*.dbf") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.odt") returned 0 [0062.519] lstrlenA (lpString="*.odt") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.vob") returned 0 [0062.519] lstrlenA (lpString="*.vob") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.ifo") returned 0 [0062.519] lstrlenA (lpString="*.ifo") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.lnk") returned 0 [0062.520] lstrlenA (lpString="*.lnk") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.torrent") returned 0 [0062.520] lstrlenA (lpString="*.torrent") returned 9 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mov") returned 0 [0062.520] lstrlenA (lpString="*.mov") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.m2v") returned 0 [0062.520] lstrlenA (lpString="*.m2v") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.3gp") returned 0 [0062.520] lstrlenA (lpString="*.3gp") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mpeg") returned 0 [0062.520] lstrlenA (lpString="*.mpeg") returned 6 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mpg") returned 0 [0062.520] lstrlenA (lpString="*.mpg") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.flv") returned 0 [0062.520] lstrlenA (lpString="*.flv") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.avi") returned 0 [0062.520] lstrlenA (lpString="*.avi") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mp4") returned 0 [0062.520] lstrlenA (lpString="*.mp4") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.wmv") returned 0 [0062.520] lstrlenA (lpString="*.wmv") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.divx") returned 0 [0062.520] lstrlenA (lpString="*.divx") returned 6 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mkv") returned 0 [0062.520] lstrlenA (lpString="*.mkv") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.mp3") returned 0 [0062.520] lstrlenA (lpString="*.mp3") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.wav") returned 0 [0062.520] lstrlenA (lpString="*.wav") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.flac") returned 0 [0062.520] lstrlenA (lpString="*.flac") returned 6 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.ape") returned 0 [0062.520] lstrlenA (lpString="*.ape") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.wma") returned 0 [0062.520] lstrlenA (lpString="*.wma") returned 5 [0062.520] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.ac3") returned 0 [0062.520] lstrlenA (lpString="*.ac3") returned 5 [0062.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", pszSpec="*.doc") returned 0 [0062.521] lstrlenA (lpString="*.doc") returned 5 [0062.521] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.521] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.521] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupResources.dll") returned -1 [0062.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupResources.dll") returned -1 [0062.521] lstrcmpiA (lpString1="", lpString2="SetupResources.dll") returned -1 [0062.521] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned="LocalizedData.xml" [0062.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\3082\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0062.521] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\3082\\" | out: pszPath="C:\\588bce7c90097ed212\\3082\\") returned="" [0062.521] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\3082\\HOW TO DECRYPT FILES.txt" [0062.521] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\how to decrypt files.txt")) returned 0x20 [0062.521] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" [0062.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.zip") returned 0 [0062.521] lstrlenA (lpString="*.zip") returned 5 [0062.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.rar") returned 0 [0062.521] lstrlenA (lpString="*.rar") returned 5 [0062.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.7z") returned 0 [0062.521] lstrlenA (lpString="*.7z") returned 4 [0062.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.tar") returned 0 [0062.521] lstrlenA (lpString="*.tar") returned 5 [0062.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.gzip") returned 0 [0062.521] lstrlenA (lpString="*.gzip") returned 6 [0062.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.jpg") returned 0 [0062.521] lstrlenA (lpString="*.jpg") returned 5 [0062.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.jpeg") returned 0 [0062.521] lstrlenA (lpString="*.jpeg") returned 6 [0062.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.psd") returned 0 [0062.521] lstrlenA (lpString="*.psd") returned 5 [0062.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.cdr") returned 0 [0062.521] lstrlenA (lpString="*.cdr") returned 5 [0062.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.dwg") returned 0 [0062.521] lstrlenA (lpString="*.dwg") returned 5 [0062.521] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.max") returned 0 [0062.522] lstrlenA (lpString="*.max") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.bmp") returned 0 [0062.522] lstrlenA (lpString="*.bmp") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.gif") returned 0 [0062.522] lstrlenA (lpString="*.gif") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.png") returned 0 [0062.522] lstrlenA (lpString="*.png") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.522] lstrlenA (lpString="*.doc") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.docx") returned 0 [0062.522] lstrlenA (lpString="*.docx") returned 6 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.xls") returned 0 [0062.522] lstrlenA (lpString="*.xls") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.xlsx") returned 0 [0062.522] lstrlenA (lpString="*.xlsx") returned 6 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.ppt") returned 0 [0062.522] lstrlenA (lpString="*.ppt") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.pptx") returned 0 [0062.522] lstrlenA (lpString="*.pptx") returned 6 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.txt") returned 0 [0062.522] lstrlenA (lpString="*.txt") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.pdf") returned 0 [0062.522] lstrlenA (lpString="*.pdf") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.djvu") returned 0 [0062.522] lstrlenA (lpString="*.djvu") returned 6 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.htm") returned 0 [0062.522] lstrlenA (lpString="*.htm") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.html") returned 0 [0062.522] lstrlenA (lpString="*.html") returned 6 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mdb") returned 0 [0062.522] lstrlenA (lpString="*.mdb") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.cer") returned 0 [0062.522] lstrlenA (lpString="*.cer") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.p12") returned 0 [0062.522] lstrlenA (lpString="*.p12") returned 5 [0062.522] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.pfx") returned 0 [0062.523] lstrlenA (lpString="*.pfx") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.kwm") returned 0 [0062.523] lstrlenA (lpString="*.kwm") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.pwm") returned 0 [0062.523] lstrlenA (lpString="*.pwm") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.1cd") returned 0 [0062.523] lstrlenA (lpString="*.1cd") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.md") returned 0 [0062.523] lstrlenA (lpString="*.md") returned 4 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mdf") returned 0 [0062.523] lstrlenA (lpString="*.mdf") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.dbf") returned 0 [0062.523] lstrlenA (lpString="*.dbf") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.odt") returned 0 [0062.523] lstrlenA (lpString="*.odt") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.vob") returned 0 [0062.523] lstrlenA (lpString="*.vob") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.ifo") returned 0 [0062.523] lstrlenA (lpString="*.ifo") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.lnk") returned 0 [0062.523] lstrlenA (lpString="*.lnk") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.torrent") returned 0 [0062.523] lstrlenA (lpString="*.torrent") returned 9 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mov") returned 0 [0062.523] lstrlenA (lpString="*.mov") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.m2v") returned 0 [0062.523] lstrlenA (lpString="*.m2v") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.3gp") returned 0 [0062.523] lstrlenA (lpString="*.3gp") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mpeg") returned 0 [0062.523] lstrlenA (lpString="*.mpeg") returned 6 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mpg") returned 0 [0062.523] lstrlenA (lpString="*.mpg") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.flv") returned 0 [0062.523] lstrlenA (lpString="*.flv") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.avi") returned 0 [0062.523] lstrlenA (lpString="*.avi") returned 5 [0062.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mp4") returned 0 [0062.524] lstrlenA (lpString="*.mp4") returned 5 [0062.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.wmv") returned 0 [0062.524] lstrlenA (lpString="*.wmv") returned 5 [0062.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.divx") returned 0 [0062.524] lstrlenA (lpString="*.divx") returned 6 [0062.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mkv") returned 0 [0062.524] lstrlenA (lpString="*.mkv") returned 5 [0062.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.mp3") returned 0 [0062.524] lstrlenA (lpString="*.mp3") returned 5 [0062.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.wav") returned 0 [0062.524] lstrlenA (lpString="*.wav") returned 5 [0062.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.flac") returned 0 [0062.524] lstrlenA (lpString="*.flac") returned 6 [0062.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.ape") returned 0 [0062.524] lstrlenA (lpString="*.ape") returned 5 [0062.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.wma") returned 0 [0062.524] lstrlenA (lpString="*.wma") returned 5 [0062.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.ac3") returned 0 [0062.524] lstrlenA (lpString="*.ac3") returned 5 [0062.524] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", pszSpec="*.doc") returned 0 [0062.524] lstrlenA (lpString="*.doc") returned 5 [0062.524] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.524] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0062.524] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="Client", cAlternateFileName="")) returned 1 [0062.524] lstrcmpA (lpString1=".", lpString2="Client") returned -1 [0062.524] lstrcmpA (lpString1="..", lpString2="Client") returned -1 [0062.524] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.524] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Client" | out: lpString1="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0062.524] lstrlenA (lpString="C:\\588bce7c90097ed212\\Client") returned 28 [0062.524] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75a010 [0062.599] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.599] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.599] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.599] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.600] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0062.600] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Parameterinfo.xml") returned -1 [0062.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Parameterinfo.xml") returned -1 [0062.600] lstrcmpiA (lpString1="", lpString2="Parameterinfo.xml") returned -1 [0062.600] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Client\\*.*") returned="*.*" [0062.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Client\\" | out: lpString1="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0062.600] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Client\\" | out: pszPath="C:\\588bce7c90097ed212\\Client\\") returned="" [0062.600] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Client\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Client\\HOW TO DECRYPT FILES.txt" [0062.600] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Client\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\client\\how to decrypt files.txt")) returned 0xffffffff [0062.600] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\Client\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\client\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.601] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.601] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.602] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.602] CloseHandle (hObject=0x208) returned 1 [0062.602] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="Parameterinfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" [0062.602] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.zip") returned 0 [0062.602] lstrlenA (lpString="*.zip") returned 5 [0062.602] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.rar") returned 0 [0062.602] lstrlenA (lpString="*.rar") returned 5 [0062.602] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.7z") returned 0 [0062.602] lstrlenA (lpString="*.7z") returned 4 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.tar") returned 0 [0062.603] lstrlenA (lpString="*.tar") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.gzip") returned 0 [0062.603] lstrlenA (lpString="*.gzip") returned 6 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.jpg") returned 0 [0062.603] lstrlenA (lpString="*.jpg") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.jpeg") returned 0 [0062.603] lstrlenA (lpString="*.jpeg") returned 6 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.psd") returned 0 [0062.603] lstrlenA (lpString="*.psd") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.cdr") returned 0 [0062.603] lstrlenA (lpString="*.cdr") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.dwg") returned 0 [0062.603] lstrlenA (lpString="*.dwg") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.max") returned 0 [0062.603] lstrlenA (lpString="*.max") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.bmp") returned 0 [0062.603] lstrlenA (lpString="*.bmp") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.gif") returned 0 [0062.603] lstrlenA (lpString="*.gif") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.png") returned 0 [0062.603] lstrlenA (lpString="*.png") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.doc") returned 0 [0062.603] lstrlenA (lpString="*.doc") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.docx") returned 0 [0062.603] lstrlenA (lpString="*.docx") returned 6 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.xls") returned 0 [0062.603] lstrlenA (lpString="*.xls") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.xlsx") returned 0 [0062.603] lstrlenA (lpString="*.xlsx") returned 6 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.ppt") returned 0 [0062.603] lstrlenA (lpString="*.ppt") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.pptx") returned 0 [0062.603] lstrlenA (lpString="*.pptx") returned 6 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.txt") returned 0 [0062.603] lstrlenA (lpString="*.txt") returned 5 [0062.603] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.pdf") returned 0 [0062.604] lstrlenA (lpString="*.pdf") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.djvu") returned 0 [0062.604] lstrlenA (lpString="*.djvu") returned 6 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.htm") returned 0 [0062.604] lstrlenA (lpString="*.htm") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.html") returned 0 [0062.604] lstrlenA (lpString="*.html") returned 6 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mdb") returned 0 [0062.604] lstrlenA (lpString="*.mdb") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.cer") returned 0 [0062.604] lstrlenA (lpString="*.cer") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.p12") returned 0 [0062.604] lstrlenA (lpString="*.p12") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.pfx") returned 0 [0062.604] lstrlenA (lpString="*.pfx") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.kwm") returned 0 [0062.604] lstrlenA (lpString="*.kwm") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.pwm") returned 0 [0062.604] lstrlenA (lpString="*.pwm") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.1cd") returned 0 [0062.604] lstrlenA (lpString="*.1cd") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.md") returned 0 [0062.604] lstrlenA (lpString="*.md") returned 4 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mdf") returned 0 [0062.604] lstrlenA (lpString="*.mdf") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.dbf") returned 0 [0062.604] lstrlenA (lpString="*.dbf") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.odt") returned 0 [0062.604] lstrlenA (lpString="*.odt") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.vob") returned 0 [0062.604] lstrlenA (lpString="*.vob") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.ifo") returned 0 [0062.604] lstrlenA (lpString="*.ifo") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.lnk") returned 0 [0062.604] lstrlenA (lpString="*.lnk") returned 5 [0062.604] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.torrent") returned 0 [0062.604] lstrlenA (lpString="*.torrent") returned 9 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mov") returned 0 [0062.605] lstrlenA (lpString="*.mov") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.m2v") returned 0 [0062.605] lstrlenA (lpString="*.m2v") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.3gp") returned 0 [0062.605] lstrlenA (lpString="*.3gp") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mpeg") returned 0 [0062.605] lstrlenA (lpString="*.mpeg") returned 6 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mpg") returned 0 [0062.605] lstrlenA (lpString="*.mpg") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.flv") returned 0 [0062.605] lstrlenA (lpString="*.flv") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.avi") returned 0 [0062.605] lstrlenA (lpString="*.avi") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mp4") returned 0 [0062.605] lstrlenA (lpString="*.mp4") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.wmv") returned 0 [0062.605] lstrlenA (lpString="*.wmv") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.divx") returned 0 [0062.605] lstrlenA (lpString="*.divx") returned 6 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mkv") returned 0 [0062.605] lstrlenA (lpString="*.mkv") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.mp3") returned 0 [0062.605] lstrlenA (lpString="*.mp3") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.wav") returned 0 [0062.605] lstrlenA (lpString="*.wav") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.flac") returned 0 [0062.605] lstrlenA (lpString="*.flac") returned 6 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.ape") returned 0 [0062.605] lstrlenA (lpString="*.ape") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.wma") returned 0 [0062.605] lstrlenA (lpString="*.wma") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.ac3") returned 0 [0062.605] lstrlenA (lpString="*.ac3") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", pszSpec="*.doc") returned 0 [0062.606] lstrlenA (lpString="*.doc") returned 5 [0062.606] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0062.606] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.606] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UiInfo.xml") returned -1 [0062.606] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UiInfo.xml") returned -1 [0062.606] lstrcmpiA (lpString1="", lpString2="UiInfo.xml") returned -1 [0062.606] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned="Parameterinfo.xml" [0062.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Client\\" | out: lpString1="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0062.606] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Client\\" | out: pszPath="C:\\588bce7c90097ed212\\Client\\") returned="" [0062.606] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Client\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Client\\HOW TO DECRYPT FILES.txt" [0062.606] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Client\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\client\\how to decrypt files.txt")) returned 0x20 [0062.606] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" [0062.606] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.zip") returned 0 [0062.606] lstrlenA (lpString="*.zip") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.rar") returned 0 [0062.606] lstrlenA (lpString="*.rar") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.7z") returned 0 [0062.606] lstrlenA (lpString="*.7z") returned 4 [0062.606] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.tar") returned 0 [0062.606] lstrlenA (lpString="*.tar") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.gzip") returned 0 [0062.606] lstrlenA (lpString="*.gzip") returned 6 [0062.606] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.jpg") returned 0 [0062.606] lstrlenA (lpString="*.jpg") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.jpeg") returned 0 [0062.606] lstrlenA (lpString="*.jpeg") returned 6 [0062.606] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.psd") returned 0 [0062.606] lstrlenA (lpString="*.psd") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.cdr") returned 0 [0062.607] lstrlenA (lpString="*.cdr") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.dwg") returned 0 [0062.607] lstrlenA (lpString="*.dwg") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.max") returned 0 [0062.607] lstrlenA (lpString="*.max") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.bmp") returned 0 [0062.607] lstrlenA (lpString="*.bmp") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.gif") returned 0 [0062.607] lstrlenA (lpString="*.gif") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.png") returned 0 [0062.607] lstrlenA (lpString="*.png") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.doc") returned 0 [0062.607] lstrlenA (lpString="*.doc") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.docx") returned 0 [0062.607] lstrlenA (lpString="*.docx") returned 6 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.xls") returned 0 [0062.607] lstrlenA (lpString="*.xls") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.xlsx") returned 0 [0062.607] lstrlenA (lpString="*.xlsx") returned 6 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.ppt") returned 0 [0062.607] lstrlenA (lpString="*.ppt") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.pptx") returned 0 [0062.607] lstrlenA (lpString="*.pptx") returned 6 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.txt") returned 0 [0062.607] lstrlenA (lpString="*.txt") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.pdf") returned 0 [0062.607] lstrlenA (lpString="*.pdf") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.djvu") returned 0 [0062.607] lstrlenA (lpString="*.djvu") returned 6 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.htm") returned 0 [0062.607] lstrlenA (lpString="*.htm") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.html") returned 0 [0062.607] lstrlenA (lpString="*.html") returned 6 [0062.607] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mdb") returned 0 [0062.608] lstrlenA (lpString="*.mdb") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.cer") returned 0 [0062.608] lstrlenA (lpString="*.cer") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.p12") returned 0 [0062.608] lstrlenA (lpString="*.p12") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.pfx") returned 0 [0062.608] lstrlenA (lpString="*.pfx") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.kwm") returned 0 [0062.608] lstrlenA (lpString="*.kwm") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.pwm") returned 0 [0062.608] lstrlenA (lpString="*.pwm") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.1cd") returned 0 [0062.608] lstrlenA (lpString="*.1cd") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.md") returned 0 [0062.608] lstrlenA (lpString="*.md") returned 4 [0062.608] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mdf") returned 0 [0062.608] lstrlenA (lpString="*.mdf") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.dbf") returned 0 [0062.609] lstrlenA (lpString="*.dbf") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.odt") returned 0 [0062.609] lstrlenA (lpString="*.odt") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.vob") returned 0 [0062.609] lstrlenA (lpString="*.vob") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.ifo") returned 0 [0062.609] lstrlenA (lpString="*.ifo") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.lnk") returned 0 [0062.609] lstrlenA (lpString="*.lnk") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.torrent") returned 0 [0062.609] lstrlenA (lpString="*.torrent") returned 9 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mov") returned 0 [0062.609] lstrlenA (lpString="*.mov") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.m2v") returned 0 [0062.609] lstrlenA (lpString="*.m2v") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.3gp") returned 0 [0062.609] lstrlenA (lpString="*.3gp") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mpeg") returned 0 [0062.609] lstrlenA (lpString="*.mpeg") returned 6 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mpg") returned 0 [0062.609] lstrlenA (lpString="*.mpg") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.flv") returned 0 [0062.609] lstrlenA (lpString="*.flv") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.avi") returned 0 [0062.609] lstrlenA (lpString="*.avi") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mp4") returned 0 [0062.609] lstrlenA (lpString="*.mp4") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.wmv") returned 0 [0062.609] lstrlenA (lpString="*.wmv") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.divx") returned 0 [0062.609] lstrlenA (lpString="*.divx") returned 6 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mkv") returned 0 [0062.609] lstrlenA (lpString="*.mkv") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.mp3") returned 0 [0062.610] lstrlenA (lpString="*.mp3") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.wav") returned 0 [0062.610] lstrlenA (lpString="*.wav") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.flac") returned 0 [0062.610] lstrlenA (lpString="*.flac") returned 6 [0062.610] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.ape") returned 0 [0062.610] lstrlenA (lpString="*.ape") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.wma") returned 0 [0062.610] lstrlenA (lpString="*.wma") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.ac3") returned 0 [0062.610] lstrlenA (lpString="*.ac3") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", pszSpec="*.doc") returned 0 [0062.610] lstrlenA (lpString="*.doc") returned 5 [0062.610] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0062.610] FindClose (in: hFindFile=0x75a010 | out: hFindFile=0x75a010) returned 1 [0062.610] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0062.610] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.610] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DHtmlHeader.html") returned 1 [0062.610] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DHtmlHeader.html") returned 1 [0062.610] lstrcmpiA (lpString1="", lpString2="DHtmlHeader.html") returned -1 [0062.610] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.610] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.610] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.610] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0xffffffff [0062.610] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.611] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.611] WriteFile (in: hFile=0x204, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.612] SetFileTime (hFile=0x204, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.612] CloseHandle (hObject=0x204) returned 1 [0062.612] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="DHtmlHeader.html" | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html" [0062.612] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.zip") returned 0 [0062.612] lstrlenA (lpString="*.zip") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.rar") returned 0 [0062.612] lstrlenA (lpString="*.rar") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.7z") returned 0 [0062.612] lstrlenA (lpString="*.7z") returned 4 [0062.612] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.tar") returned 0 [0062.612] lstrlenA (lpString="*.tar") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.gzip") returned 0 [0062.612] lstrlenA (lpString="*.gzip") returned 6 [0062.612] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.jpg") returned 0 [0062.612] lstrlenA (lpString="*.jpg") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.jpeg") returned 0 [0062.613] lstrlenA (lpString="*.jpeg") returned 6 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.psd") returned 0 [0062.613] lstrlenA (lpString="*.psd") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.cdr") returned 0 [0062.613] lstrlenA (lpString="*.cdr") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.dwg") returned 0 [0062.613] lstrlenA (lpString="*.dwg") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.max") returned 0 [0062.613] lstrlenA (lpString="*.max") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.bmp") returned 0 [0062.613] lstrlenA (lpString="*.bmp") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.gif") returned 0 [0062.613] lstrlenA (lpString="*.gif") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.png") returned 0 [0062.613] lstrlenA (lpString="*.png") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.doc") returned 0 [0062.613] lstrlenA (lpString="*.doc") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.docx") returned 0 [0062.613] lstrlenA (lpString="*.docx") returned 6 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.xls") returned 0 [0062.613] lstrlenA (lpString="*.xls") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.xlsx") returned 0 [0062.613] lstrlenA (lpString="*.xlsx") returned 6 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.ppt") returned 0 [0062.613] lstrlenA (lpString="*.ppt") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.pptx") returned 0 [0062.613] lstrlenA (lpString="*.pptx") returned 6 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.txt") returned 0 [0062.613] lstrlenA (lpString="*.txt") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.pdf") returned 0 [0062.613] lstrlenA (lpString="*.pdf") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.djvu") returned 0 [0062.613] lstrlenA (lpString="*.djvu") returned 6 [0062.613] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.htm") returned 0 [0062.614] lstrlenA (lpString="*.htm") returned 5 [0062.614] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DHtmlHeader.html", pszSpec="*.html") returned 1 [0062.614] lstrlenA (lpString="*.html") returned 6 [0062.614] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\588bce7c90097ed212\\DHtmlHeader.html" | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html" [0062.614] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\588bce7c90097ed212\\DHtmlHeader.html" | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html" [0062.614] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html", lpString2="." | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html.") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html." [0062.614] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html.", lpString2="EnCiPhErEd" | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html.EnCiPhErEd") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html.EnCiPhErEd" [0062.614] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.614] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ef6 [0062.615] GetFileTime (in: hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbc518d00, dwHighDateTime=0x1ca2a28), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc518d00, dwHighDateTime=0x1ca2a28), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbc518d00, dwHighDateTime=0x1ca2a28)) returned 1 [0062.615] SetFilePointer (in: hFile=0x204, lDistanceToMove=124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c [0062.615] ReadFile (in: hFile=0x204, lpBuffer=0x2143020, nNumberOfBytesToRead=0x1a8bf8, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2143020*, lpNumberOfBytesRead=0x40655d*=0x3e7a, lpOverlapped=0x0) returned 1 [0062.666] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="DHtmlHeader.html" [0062.666] SetFilePointer (in: hFile=0x204, lDistanceToMove=124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c [0062.666] WriteFile (in: hFile=0x204, lpBuffer=0x2143020*, nNumberOfBytesToWrite=0x3e7a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2143020*, lpNumberOfBytesWritten=0x406561*=0x3e7a, lpOverlapped=0x0) returned 1 [0062.666] SetFileTime (hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.667] CloseHandle (hObject=0x204) returned 1 [0062.668] MoveFileA (lpExistingFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.EnCiPhErEd" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.enciphered")) returned 1 [0062.668] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x13, dwReserved1=0x1, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0062.668] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.668] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayIcon.ico") returned 1 [0062.668] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayIcon.ico") returned 1 [0062.668] lstrcmpiA (lpString1="", lpString2="DisplayIcon.ico") returned -1 [0062.668] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="DHtmlHeader.html" [0062.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.669] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.669] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.669] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.669] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="DisplayIcon.ico" | out: lpString1="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned="C:\\588bce7c90097ed212\\DisplayIcon.ico" [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.zip") returned 0 [0062.669] lstrlenA (lpString="*.zip") returned 5 [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.rar") returned 0 [0062.669] lstrlenA (lpString="*.rar") returned 5 [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.7z") returned 0 [0062.669] lstrlenA (lpString="*.7z") returned 4 [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.tar") returned 0 [0062.669] lstrlenA (lpString="*.tar") returned 5 [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.gzip") returned 0 [0062.669] lstrlenA (lpString="*.gzip") returned 6 [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.jpg") returned 0 [0062.669] lstrlenA (lpString="*.jpg") returned 5 [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.jpeg") returned 0 [0062.669] lstrlenA (lpString="*.jpeg") returned 6 [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.psd") returned 0 [0062.669] lstrlenA (lpString="*.psd") returned 5 [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.cdr") returned 0 [0062.669] lstrlenA (lpString="*.cdr") returned 5 [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.dwg") returned 0 [0062.669] lstrlenA (lpString="*.dwg") returned 5 [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.max") returned 0 [0062.669] lstrlenA (lpString="*.max") returned 5 [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.bmp") returned 0 [0062.669] lstrlenA (lpString="*.bmp") returned 5 [0062.669] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.gif") returned 0 [0062.670] lstrlenA (lpString="*.gif") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.png") returned 0 [0062.670] lstrlenA (lpString="*.png") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.doc") returned 0 [0062.670] lstrlenA (lpString="*.doc") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.docx") returned 0 [0062.670] lstrlenA (lpString="*.docx") returned 6 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.xls") returned 0 [0062.670] lstrlenA (lpString="*.xls") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.xlsx") returned 0 [0062.670] lstrlenA (lpString="*.xlsx") returned 6 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.ppt") returned 0 [0062.670] lstrlenA (lpString="*.ppt") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.pptx") returned 0 [0062.670] lstrlenA (lpString="*.pptx") returned 6 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.txt") returned 0 [0062.670] lstrlenA (lpString="*.txt") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.pdf") returned 0 [0062.670] lstrlenA (lpString="*.pdf") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.djvu") returned 0 [0062.670] lstrlenA (lpString="*.djvu") returned 6 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.htm") returned 0 [0062.670] lstrlenA (lpString="*.htm") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.html") returned 0 [0062.670] lstrlenA (lpString="*.html") returned 6 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mdb") returned 0 [0062.670] lstrlenA (lpString="*.mdb") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.cer") returned 0 [0062.670] lstrlenA (lpString="*.cer") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.p12") returned 0 [0062.670] lstrlenA (lpString="*.p12") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.pfx") returned 0 [0062.670] lstrlenA (lpString="*.pfx") returned 5 [0062.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.kwm") returned 0 [0062.671] lstrlenA (lpString="*.kwm") returned 5 [0062.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.pwm") returned 0 [0062.671] lstrlenA (lpString="*.pwm") returned 5 [0062.671] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.1cd") returned 0 [0062.671] lstrlenA (lpString="*.1cd") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.md") returned 0 [0062.672] lstrlenA (lpString="*.md") returned 4 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mdf") returned 0 [0062.672] lstrlenA (lpString="*.mdf") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.dbf") returned 0 [0062.672] lstrlenA (lpString="*.dbf") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.odt") returned 0 [0062.672] lstrlenA (lpString="*.odt") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.vob") returned 0 [0062.672] lstrlenA (lpString="*.vob") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.ifo") returned 0 [0062.672] lstrlenA (lpString="*.ifo") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.lnk") returned 0 [0062.672] lstrlenA (lpString="*.lnk") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.torrent") returned 0 [0062.672] lstrlenA (lpString="*.torrent") returned 9 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mov") returned 0 [0062.672] lstrlenA (lpString="*.mov") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.m2v") returned 0 [0062.672] lstrlenA (lpString="*.m2v") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.3gp") returned 0 [0062.672] lstrlenA (lpString="*.3gp") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mpeg") returned 0 [0062.672] lstrlenA (lpString="*.mpeg") returned 6 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mpg") returned 0 [0062.672] lstrlenA (lpString="*.mpg") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.flv") returned 0 [0062.672] lstrlenA (lpString="*.flv") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.avi") returned 0 [0062.672] lstrlenA (lpString="*.avi") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mp4") returned 0 [0062.672] lstrlenA (lpString="*.mp4") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.wmv") returned 0 [0062.672] lstrlenA (lpString="*.wmv") returned 5 [0062.672] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.divx") returned 0 [0062.673] lstrlenA (lpString="*.divx") returned 6 [0062.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mkv") returned 0 [0062.673] lstrlenA (lpString="*.mkv") returned 5 [0062.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.mp3") returned 0 [0062.673] lstrlenA (lpString="*.mp3") returned 5 [0062.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.wav") returned 0 [0062.673] lstrlenA (lpString="*.wav") returned 5 [0062.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.flac") returned 0 [0062.673] lstrlenA (lpString="*.flac") returned 6 [0062.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.ape") returned 0 [0062.673] lstrlenA (lpString="*.ape") returned 5 [0062.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.wma") returned 0 [0062.673] lstrlenA (lpString="*.wma") returned 5 [0062.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.ac3") returned 0 [0062.673] lstrlenA (lpString="*.ac3") returned 5 [0062.673] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\DisplayIcon.ico", pszSpec="*.doc") returned 0 [0062.673] lstrlenA (lpString="*.doc") returned 5 [0062.673] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1 [0062.673] lstrcmpA (lpString1=".", lpString2="Extended") returned -1 [0062.673] lstrcmpA (lpString1="..", lpString2="Extended") returned -1 [0062.673] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned="DisplayIcon.ico" [0062.673] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Extended" | out: lpString1="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0062.673] lstrlenA (lpString="C:\\588bce7c90097ed212\\Extended") returned 30 [0062.673] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x70, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0062.674] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.674] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x70, cFileName="..", cAlternateFileName="")) returned 1 [0062.674] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.674] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.674] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x740000, dwReserved1=0x70, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0062.674] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.674] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Parameterinfo.xml") returned -1 [0062.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Parameterinfo.xml") returned -1 [0062.674] lstrcmpiA (lpString1="", lpString2="Parameterinfo.xml") returned -1 [0062.674] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Extended\\*.*") returned="*.*" [0062.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Extended\\" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0062.674] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Extended\\" | out: pszPath="C:\\588bce7c90097ed212\\Extended\\") returned="" [0062.674] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Extended\\HOW TO DECRYPT FILES.txt" [0062.674] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Extended\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\how to decrypt files.txt")) returned 0xffffffff [0062.674] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\Extended\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.674] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.674] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.675] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.676] CloseHandle (hObject=0x208) returned 1 [0062.676] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="Parameterinfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" [0062.676] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.zip") returned 0 [0062.676] lstrlenA (lpString="*.zip") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.rar") returned 0 [0062.676] lstrlenA (lpString="*.rar") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.7z") returned 0 [0062.676] lstrlenA (lpString="*.7z") returned 4 [0062.676] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.tar") returned 0 [0062.676] lstrlenA (lpString="*.tar") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.gzip") returned 0 [0062.676] lstrlenA (lpString="*.gzip") returned 6 [0062.676] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.jpg") returned 0 [0062.676] lstrlenA (lpString="*.jpg") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.jpeg") returned 0 [0062.676] lstrlenA (lpString="*.jpeg") returned 6 [0062.676] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.psd") returned 0 [0062.676] lstrlenA (lpString="*.psd") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.cdr") returned 0 [0062.676] lstrlenA (lpString="*.cdr") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.dwg") returned 0 [0062.676] lstrlenA (lpString="*.dwg") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.max") returned 0 [0062.676] lstrlenA (lpString="*.max") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.bmp") returned 0 [0062.677] lstrlenA (lpString="*.bmp") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.gif") returned 0 [0062.677] lstrlenA (lpString="*.gif") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.png") returned 0 [0062.677] lstrlenA (lpString="*.png") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.doc") returned 0 [0062.677] lstrlenA (lpString="*.doc") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.docx") returned 0 [0062.677] lstrlenA (lpString="*.docx") returned 6 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.xls") returned 0 [0062.677] lstrlenA (lpString="*.xls") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.xlsx") returned 0 [0062.677] lstrlenA (lpString="*.xlsx") returned 6 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.ppt") returned 0 [0062.677] lstrlenA (lpString="*.ppt") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.pptx") returned 0 [0062.677] lstrlenA (lpString="*.pptx") returned 6 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.txt") returned 0 [0062.677] lstrlenA (lpString="*.txt") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.pdf") returned 0 [0062.677] lstrlenA (lpString="*.pdf") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.djvu") returned 0 [0062.677] lstrlenA (lpString="*.djvu") returned 6 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.htm") returned 0 [0062.677] lstrlenA (lpString="*.htm") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.html") returned 0 [0062.677] lstrlenA (lpString="*.html") returned 6 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mdb") returned 0 [0062.677] lstrlenA (lpString="*.mdb") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.cer") returned 0 [0062.677] lstrlenA (lpString="*.cer") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.p12") returned 0 [0062.677] lstrlenA (lpString="*.p12") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.pfx") returned 0 [0062.677] lstrlenA (lpString="*.pfx") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.kwm") returned 0 [0062.677] lstrlenA (lpString="*.kwm") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.pwm") returned 0 [0062.678] lstrlenA (lpString="*.pwm") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.1cd") returned 0 [0062.678] lstrlenA (lpString="*.1cd") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.md") returned 0 [0062.678] lstrlenA (lpString="*.md") returned 4 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mdf") returned 0 [0062.678] lstrlenA (lpString="*.mdf") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.dbf") returned 0 [0062.678] lstrlenA (lpString="*.dbf") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.odt") returned 0 [0062.678] lstrlenA (lpString="*.odt") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.vob") returned 0 [0062.678] lstrlenA (lpString="*.vob") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.ifo") returned 0 [0062.678] lstrlenA (lpString="*.ifo") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.lnk") returned 0 [0062.678] lstrlenA (lpString="*.lnk") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.torrent") returned 0 [0062.678] lstrlenA (lpString="*.torrent") returned 9 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mov") returned 0 [0062.678] lstrlenA (lpString="*.mov") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.m2v") returned 0 [0062.678] lstrlenA (lpString="*.m2v") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.3gp") returned 0 [0062.678] lstrlenA (lpString="*.3gp") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mpeg") returned 0 [0062.678] lstrlenA (lpString="*.mpeg") returned 6 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mpg") returned 0 [0062.678] lstrlenA (lpString="*.mpg") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.flv") returned 0 [0062.678] lstrlenA (lpString="*.flv") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.avi") returned 0 [0062.678] lstrlenA (lpString="*.avi") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mp4") returned 0 [0062.678] lstrlenA (lpString="*.mp4") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.wmv") returned 0 [0062.679] lstrlenA (lpString="*.wmv") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.divx") returned 0 [0062.679] lstrlenA (lpString="*.divx") returned 6 [0062.679] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mkv") returned 0 [0062.679] lstrlenA (lpString="*.mkv") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.mp3") returned 0 [0062.679] lstrlenA (lpString="*.mp3") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.wav") returned 0 [0062.679] lstrlenA (lpString="*.wav") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.flac") returned 0 [0062.679] lstrlenA (lpString="*.flac") returned 6 [0062.679] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.ape") returned 0 [0062.679] lstrlenA (lpString="*.ape") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.wma") returned 0 [0062.679] lstrlenA (lpString="*.wma") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.ac3") returned 0 [0062.679] lstrlenA (lpString="*.ac3") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", pszSpec="*.doc") returned 0 [0062.679] lstrlenA (lpString="*.doc") returned 5 [0062.679] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0062.679] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UiInfo.xml") returned -1 [0062.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UiInfo.xml") returned -1 [0062.679] lstrcmpiA (lpString1="", lpString2="UiInfo.xml") returned -1 [0062.679] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned="Parameterinfo.xml" [0062.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Extended\\" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0062.679] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Extended\\" | out: pszPath="C:\\588bce7c90097ed212\\Extended\\") returned="" [0062.679] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Extended\\HOW TO DECRYPT FILES.txt" [0062.679] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Extended\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\how to decrypt files.txt")) returned 0x20 [0062.680] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.zip") returned 0 [0062.680] lstrlenA (lpString="*.zip") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.rar") returned 0 [0062.680] lstrlenA (lpString="*.rar") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.7z") returned 0 [0062.680] lstrlenA (lpString="*.7z") returned 4 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.tar") returned 0 [0062.680] lstrlenA (lpString="*.tar") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.gzip") returned 0 [0062.680] lstrlenA (lpString="*.gzip") returned 6 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.jpg") returned 0 [0062.680] lstrlenA (lpString="*.jpg") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.jpeg") returned 0 [0062.680] lstrlenA (lpString="*.jpeg") returned 6 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.psd") returned 0 [0062.680] lstrlenA (lpString="*.psd") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.cdr") returned 0 [0062.680] lstrlenA (lpString="*.cdr") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.dwg") returned 0 [0062.680] lstrlenA (lpString="*.dwg") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.max") returned 0 [0062.680] lstrlenA (lpString="*.max") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.bmp") returned 0 [0062.680] lstrlenA (lpString="*.bmp") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.gif") returned 0 [0062.680] lstrlenA (lpString="*.gif") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.png") returned 0 [0062.680] lstrlenA (lpString="*.png") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.doc") returned 0 [0062.680] lstrlenA (lpString="*.doc") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.docx") returned 0 [0062.680] lstrlenA (lpString="*.docx") returned 6 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.xls") returned 0 [0062.680] lstrlenA (lpString="*.xls") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.xlsx") returned 0 [0062.680] lstrlenA (lpString="*.xlsx") returned 6 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.ppt") returned 0 [0062.681] lstrlenA (lpString="*.ppt") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.pptx") returned 0 [0062.681] lstrlenA (lpString="*.pptx") returned 6 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.txt") returned 0 [0062.681] lstrlenA (lpString="*.txt") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.pdf") returned 0 [0062.681] lstrlenA (lpString="*.pdf") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.djvu") returned 0 [0062.681] lstrlenA (lpString="*.djvu") returned 6 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.htm") returned 0 [0062.681] lstrlenA (lpString="*.htm") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.html") returned 0 [0062.681] lstrlenA (lpString="*.html") returned 6 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mdb") returned 0 [0062.681] lstrlenA (lpString="*.mdb") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.cer") returned 0 [0062.681] lstrlenA (lpString="*.cer") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.p12") returned 0 [0062.681] lstrlenA (lpString="*.p12") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.pfx") returned 0 [0062.681] lstrlenA (lpString="*.pfx") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.kwm") returned 0 [0062.681] lstrlenA (lpString="*.kwm") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.pwm") returned 0 [0062.681] lstrlenA (lpString="*.pwm") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.1cd") returned 0 [0062.681] lstrlenA (lpString="*.1cd") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.md") returned 0 [0062.681] lstrlenA (lpString="*.md") returned 4 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mdf") returned 0 [0062.681] lstrlenA (lpString="*.mdf") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.dbf") returned 0 [0062.681] lstrlenA (lpString="*.dbf") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.odt") returned 0 [0062.681] lstrlenA (lpString="*.odt") returned 5 [0062.681] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.vob") returned 0 [0062.681] lstrlenA (lpString="*.vob") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.ifo") returned 0 [0062.682] lstrlenA (lpString="*.ifo") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.lnk") returned 0 [0062.682] lstrlenA (lpString="*.lnk") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.torrent") returned 0 [0062.682] lstrlenA (lpString="*.torrent") returned 9 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mov") returned 0 [0062.682] lstrlenA (lpString="*.mov") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.m2v") returned 0 [0062.682] lstrlenA (lpString="*.m2v") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.3gp") returned 0 [0062.682] lstrlenA (lpString="*.3gp") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mpeg") returned 0 [0062.682] lstrlenA (lpString="*.mpeg") returned 6 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mpg") returned 0 [0062.682] lstrlenA (lpString="*.mpg") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.flv") returned 0 [0062.682] lstrlenA (lpString="*.flv") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.avi") returned 0 [0062.682] lstrlenA (lpString="*.avi") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mp4") returned 0 [0062.682] lstrlenA (lpString="*.mp4") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.wmv") returned 0 [0062.682] lstrlenA (lpString="*.wmv") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.divx") returned 0 [0062.682] lstrlenA (lpString="*.divx") returned 6 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mkv") returned 0 [0062.682] lstrlenA (lpString="*.mkv") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.mp3") returned 0 [0062.682] lstrlenA (lpString="*.mp3") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.wav") returned 0 [0062.682] lstrlenA (lpString="*.wav") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.flac") returned 0 [0062.682] lstrlenA (lpString="*.flac") returned 6 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.ape") returned 0 [0062.682] lstrlenA (lpString="*.ape") returned 5 [0062.682] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.wma") returned 0 [0062.682] lstrlenA (lpString="*.wma") returned 5 [0062.683] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.ac3") returned 0 [0062.683] lstrlenA (lpString="*.ac3") returned 5 [0062.683] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", pszSpec="*.doc") returned 0 [0062.683] lstrlenA (lpString="*.doc") returned 5 [0062.683] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0062.683] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0062.683] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="Graphics", cAlternateFileName="")) returned 1 [0062.683] lstrcmpA (lpString1=".", lpString2="Graphics") returned -1 [0062.683] lstrcmpA (lpString1="..", lpString2="Graphics") returned -1 [0062.683] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.683] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics" [0062.683] lstrlenA (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30 [0062.683] FindFirstFileA (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0062.695] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.695] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.695] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.695] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.695] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0062.695] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Print.ico") returned -1 [0062.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Print.ico") returned -1 [0062.696] lstrcmpiA (lpString1="", lpString2="Print.ico") returned -1 [0062.696] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\*.*") returned="*.*" [0062.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.696] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.696] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.696] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0xffffffff [0062.696] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.696] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.696] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.697] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.697] CloseHandle (hObject=0x208) returned 1 [0062.698] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Print.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Print.ico" [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.zip") returned 0 [0062.698] lstrlenA (lpString="*.zip") returned 5 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.rar") returned 0 [0062.698] lstrlenA (lpString="*.rar") returned 5 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.7z") returned 0 [0062.698] lstrlenA (lpString="*.7z") returned 4 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.tar") returned 0 [0062.698] lstrlenA (lpString="*.tar") returned 5 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.gzip") returned 0 [0062.698] lstrlenA (lpString="*.gzip") returned 6 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.jpg") returned 0 [0062.698] lstrlenA (lpString="*.jpg") returned 5 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.jpeg") returned 0 [0062.698] lstrlenA (lpString="*.jpeg") returned 6 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.psd") returned 0 [0062.698] lstrlenA (lpString="*.psd") returned 5 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.cdr") returned 0 [0062.698] lstrlenA (lpString="*.cdr") returned 5 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.dwg") returned 0 [0062.698] lstrlenA (lpString="*.dwg") returned 5 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.max") returned 0 [0062.698] lstrlenA (lpString="*.max") returned 5 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.bmp") returned 0 [0062.698] lstrlenA (lpString="*.bmp") returned 5 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.gif") returned 0 [0062.698] lstrlenA (lpString="*.gif") returned 5 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.png") returned 0 [0062.698] lstrlenA (lpString="*.png") returned 5 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.doc") returned 0 [0062.698] lstrlenA (lpString="*.doc") returned 5 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.docx") returned 0 [0062.698] lstrlenA (lpString="*.docx") returned 6 [0062.698] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.xls") returned 0 [0062.699] lstrlenA (lpString="*.xls") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.xlsx") returned 0 [0062.699] lstrlenA (lpString="*.xlsx") returned 6 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.ppt") returned 0 [0062.699] lstrlenA (lpString="*.ppt") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.pptx") returned 0 [0062.699] lstrlenA (lpString="*.pptx") returned 6 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.txt") returned 0 [0062.699] lstrlenA (lpString="*.txt") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.pdf") returned 0 [0062.699] lstrlenA (lpString="*.pdf") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.djvu") returned 0 [0062.699] lstrlenA (lpString="*.djvu") returned 6 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.htm") returned 0 [0062.699] lstrlenA (lpString="*.htm") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.html") returned 0 [0062.699] lstrlenA (lpString="*.html") returned 6 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mdb") returned 0 [0062.699] lstrlenA (lpString="*.mdb") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.cer") returned 0 [0062.699] lstrlenA (lpString="*.cer") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.p12") returned 0 [0062.699] lstrlenA (lpString="*.p12") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.pfx") returned 0 [0062.699] lstrlenA (lpString="*.pfx") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.kwm") returned 0 [0062.699] lstrlenA (lpString="*.kwm") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.pwm") returned 0 [0062.699] lstrlenA (lpString="*.pwm") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.1cd") returned 0 [0062.699] lstrlenA (lpString="*.1cd") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.md") returned 0 [0062.699] lstrlenA (lpString="*.md") returned 4 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mdf") returned 0 [0062.699] lstrlenA (lpString="*.mdf") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.dbf") returned 0 [0062.699] lstrlenA (lpString="*.dbf") returned 5 [0062.699] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.odt") returned 0 [0062.700] lstrlenA (lpString="*.odt") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.vob") returned 0 [0062.700] lstrlenA (lpString="*.vob") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.ifo") returned 0 [0062.700] lstrlenA (lpString="*.ifo") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.lnk") returned 0 [0062.700] lstrlenA (lpString="*.lnk") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.torrent") returned 0 [0062.700] lstrlenA (lpString="*.torrent") returned 9 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mov") returned 0 [0062.700] lstrlenA (lpString="*.mov") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.m2v") returned 0 [0062.700] lstrlenA (lpString="*.m2v") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.3gp") returned 0 [0062.700] lstrlenA (lpString="*.3gp") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mpeg") returned 0 [0062.700] lstrlenA (lpString="*.mpeg") returned 6 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mpg") returned 0 [0062.700] lstrlenA (lpString="*.mpg") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.flv") returned 0 [0062.700] lstrlenA (lpString="*.flv") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.avi") returned 0 [0062.700] lstrlenA (lpString="*.avi") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mp4") returned 0 [0062.700] lstrlenA (lpString="*.mp4") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.wmv") returned 0 [0062.700] lstrlenA (lpString="*.wmv") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.divx") returned 0 [0062.700] lstrlenA (lpString="*.divx") returned 6 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mkv") returned 0 [0062.700] lstrlenA (lpString="*.mkv") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.mp3") returned 0 [0062.700] lstrlenA (lpString="*.mp3") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.wav") returned 0 [0062.700] lstrlenA (lpString="*.wav") returned 5 [0062.700] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.flac") returned 0 [0062.700] lstrlenA (lpString="*.flac") returned 6 [0062.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.ape") returned 0 [0062.701] lstrlenA (lpString="*.ape") returned 5 [0062.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.wma") returned 0 [0062.701] lstrlenA (lpString="*.wma") returned 5 [0062.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.ac3") returned 0 [0062.701] lstrlenA (lpString="*.ac3") returned 5 [0062.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Print.ico", pszSpec="*.doc") returned 0 [0062.701] lstrlenA (lpString="*.doc") returned 5 [0062.701] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0062.701] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Rotate1.ico") returned -1 [0062.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Rotate1.ico") returned -1 [0062.701] lstrcmpiA (lpString1="", lpString2="Rotate1.ico") returned -1 [0062.701] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned="Print.ico" [0062.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.701] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.701] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.701] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.701] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate1.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" [0062.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.zip") returned 0 [0062.701] lstrlenA (lpString="*.zip") returned 5 [0062.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.rar") returned 0 [0062.701] lstrlenA (lpString="*.rar") returned 5 [0062.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.7z") returned 0 [0062.701] lstrlenA (lpString="*.7z") returned 4 [0062.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.tar") returned 0 [0062.701] lstrlenA (lpString="*.tar") returned 5 [0062.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.gzip") returned 0 [0062.701] lstrlenA (lpString="*.gzip") returned 6 [0062.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.jpg") returned 0 [0062.701] lstrlenA (lpString="*.jpg") returned 5 [0062.701] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.jpeg") returned 0 [0062.702] lstrlenA (lpString="*.jpeg") returned 6 [0062.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.psd") returned 0 [0062.702] lstrlenA (lpString="*.psd") returned 5 [0062.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.cdr") returned 0 [0062.702] lstrlenA (lpString="*.cdr") returned 5 [0062.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.dwg") returned 0 [0062.702] lstrlenA (lpString="*.dwg") returned 5 [0062.702] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.max") returned 0 [0062.771] lstrlenA (lpString="*.max") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.bmp") returned 0 [0062.771] lstrlenA (lpString="*.bmp") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.gif") returned 0 [0062.771] lstrlenA (lpString="*.gif") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.png") returned 0 [0062.771] lstrlenA (lpString="*.png") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.doc") returned 0 [0062.771] lstrlenA (lpString="*.doc") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.docx") returned 0 [0062.771] lstrlenA (lpString="*.docx") returned 6 [0062.771] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.xls") returned 0 [0062.772] lstrlenA (lpString="*.xls") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.xlsx") returned 0 [0062.772] lstrlenA (lpString="*.xlsx") returned 6 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.ppt") returned 0 [0062.772] lstrlenA (lpString="*.ppt") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.pptx") returned 0 [0062.772] lstrlenA (lpString="*.pptx") returned 6 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.txt") returned 0 [0062.772] lstrlenA (lpString="*.txt") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.pdf") returned 0 [0062.772] lstrlenA (lpString="*.pdf") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.djvu") returned 0 [0062.772] lstrlenA (lpString="*.djvu") returned 6 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.htm") returned 0 [0062.772] lstrlenA (lpString="*.htm") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.html") returned 0 [0062.772] lstrlenA (lpString="*.html") returned 6 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mdb") returned 0 [0062.772] lstrlenA (lpString="*.mdb") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.cer") returned 0 [0062.772] lstrlenA (lpString="*.cer") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.p12") returned 0 [0062.772] lstrlenA (lpString="*.p12") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.pfx") returned 0 [0062.772] lstrlenA (lpString="*.pfx") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.kwm") returned 0 [0062.772] lstrlenA (lpString="*.kwm") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.pwm") returned 0 [0062.772] lstrlenA (lpString="*.pwm") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.1cd") returned 0 [0062.772] lstrlenA (lpString="*.1cd") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.md") returned 0 [0062.772] lstrlenA (lpString="*.md") returned 4 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mdf") returned 0 [0062.772] lstrlenA (lpString="*.mdf") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.dbf") returned 0 [0062.772] lstrlenA (lpString="*.dbf") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.odt") returned 0 [0062.773] lstrlenA (lpString="*.odt") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.vob") returned 0 [0062.773] lstrlenA (lpString="*.vob") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.ifo") returned 0 [0062.773] lstrlenA (lpString="*.ifo") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.lnk") returned 0 [0062.773] lstrlenA (lpString="*.lnk") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.torrent") returned 0 [0062.773] lstrlenA (lpString="*.torrent") returned 9 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mov") returned 0 [0062.773] lstrlenA (lpString="*.mov") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.m2v") returned 0 [0062.773] lstrlenA (lpString="*.m2v") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.3gp") returned 0 [0062.773] lstrlenA (lpString="*.3gp") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mpeg") returned 0 [0062.773] lstrlenA (lpString="*.mpeg") returned 6 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mpg") returned 0 [0062.773] lstrlenA (lpString="*.mpg") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.flv") returned 0 [0062.773] lstrlenA (lpString="*.flv") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.avi") returned 0 [0062.773] lstrlenA (lpString="*.avi") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mp4") returned 0 [0062.773] lstrlenA (lpString="*.mp4") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.wmv") returned 0 [0062.773] lstrlenA (lpString="*.wmv") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.divx") returned 0 [0062.773] lstrlenA (lpString="*.divx") returned 6 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mkv") returned 0 [0062.773] lstrlenA (lpString="*.mkv") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.mp3") returned 0 [0062.773] lstrlenA (lpString="*.mp3") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.wav") returned 0 [0062.773] lstrlenA (lpString="*.wav") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.flac") returned 0 [0062.773] lstrlenA (lpString="*.flac") returned 6 [0062.773] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.ape") returned 0 [0062.774] lstrlenA (lpString="*.ape") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.wma") returned 0 [0062.774] lstrlenA (lpString="*.wma") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.ac3") returned 0 [0062.774] lstrlenA (lpString="*.ac3") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", pszSpec="*.doc") returned 0 [0062.774] lstrlenA (lpString="*.doc") returned 5 [0062.774] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0062.774] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Rotate2.ico") returned -1 [0062.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Rotate2.ico") returned -1 [0062.774] lstrcmpiA (lpString1="", lpString2="Rotate2.ico") returned -1 [0062.774] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned="Rotate1.ico" [0062.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.774] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.774] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.774] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.774] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate2.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" [0062.774] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.zip") returned 0 [0062.774] lstrlenA (lpString="*.zip") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.rar") returned 0 [0062.774] lstrlenA (lpString="*.rar") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.7z") returned 0 [0062.774] lstrlenA (lpString="*.7z") returned 4 [0062.774] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.tar") returned 0 [0062.774] lstrlenA (lpString="*.tar") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.gzip") returned 0 [0062.774] lstrlenA (lpString="*.gzip") returned 6 [0062.774] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.jpg") returned 0 [0062.775] lstrlenA (lpString="*.jpg") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.jpeg") returned 0 [0062.775] lstrlenA (lpString="*.jpeg") returned 6 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.psd") returned 0 [0062.775] lstrlenA (lpString="*.psd") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.cdr") returned 0 [0062.775] lstrlenA (lpString="*.cdr") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.dwg") returned 0 [0062.775] lstrlenA (lpString="*.dwg") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.max") returned 0 [0062.775] lstrlenA (lpString="*.max") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.bmp") returned 0 [0062.775] lstrlenA (lpString="*.bmp") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.gif") returned 0 [0062.775] lstrlenA (lpString="*.gif") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.png") returned 0 [0062.775] lstrlenA (lpString="*.png") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.doc") returned 0 [0062.775] lstrlenA (lpString="*.doc") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.docx") returned 0 [0062.775] lstrlenA (lpString="*.docx") returned 6 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.xls") returned 0 [0062.775] lstrlenA (lpString="*.xls") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.xlsx") returned 0 [0062.775] lstrlenA (lpString="*.xlsx") returned 6 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.ppt") returned 0 [0062.775] lstrlenA (lpString="*.ppt") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.pptx") returned 0 [0062.775] lstrlenA (lpString="*.pptx") returned 6 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.txt") returned 0 [0062.775] lstrlenA (lpString="*.txt") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.pdf") returned 0 [0062.775] lstrlenA (lpString="*.pdf") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.djvu") returned 0 [0062.775] lstrlenA (lpString="*.djvu") returned 6 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.htm") returned 0 [0062.775] lstrlenA (lpString="*.htm") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.html") returned 0 [0062.776] lstrlenA (lpString="*.html") returned 6 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mdb") returned 0 [0062.776] lstrlenA (lpString="*.mdb") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.cer") returned 0 [0062.776] lstrlenA (lpString="*.cer") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.p12") returned 0 [0062.776] lstrlenA (lpString="*.p12") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.pfx") returned 0 [0062.776] lstrlenA (lpString="*.pfx") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.kwm") returned 0 [0062.776] lstrlenA (lpString="*.kwm") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.pwm") returned 0 [0062.776] lstrlenA (lpString="*.pwm") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.1cd") returned 0 [0062.776] lstrlenA (lpString="*.1cd") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.md") returned 0 [0062.776] lstrlenA (lpString="*.md") returned 4 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mdf") returned 0 [0062.776] lstrlenA (lpString="*.mdf") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.dbf") returned 0 [0062.776] lstrlenA (lpString="*.dbf") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.odt") returned 0 [0062.776] lstrlenA (lpString="*.odt") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.vob") returned 0 [0062.776] lstrlenA (lpString="*.vob") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.ifo") returned 0 [0062.776] lstrlenA (lpString="*.ifo") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.lnk") returned 0 [0062.776] lstrlenA (lpString="*.lnk") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.torrent") returned 0 [0062.776] lstrlenA (lpString="*.torrent") returned 9 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mov") returned 0 [0062.776] lstrlenA (lpString="*.mov") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.m2v") returned 0 [0062.776] lstrlenA (lpString="*.m2v") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.3gp") returned 0 [0062.776] lstrlenA (lpString="*.3gp") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mpeg") returned 0 [0062.777] lstrlenA (lpString="*.mpeg") returned 6 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mpg") returned 0 [0062.777] lstrlenA (lpString="*.mpg") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.flv") returned 0 [0062.777] lstrlenA (lpString="*.flv") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.avi") returned 0 [0062.777] lstrlenA (lpString="*.avi") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mp4") returned 0 [0062.777] lstrlenA (lpString="*.mp4") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.wmv") returned 0 [0062.777] lstrlenA (lpString="*.wmv") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.divx") returned 0 [0062.777] lstrlenA (lpString="*.divx") returned 6 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mkv") returned 0 [0062.777] lstrlenA (lpString="*.mkv") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.mp3") returned 0 [0062.777] lstrlenA (lpString="*.mp3") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.wav") returned 0 [0062.777] lstrlenA (lpString="*.wav") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.flac") returned 0 [0062.777] lstrlenA (lpString="*.flac") returned 6 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.ape") returned 0 [0062.777] lstrlenA (lpString="*.ape") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.wma") returned 0 [0062.777] lstrlenA (lpString="*.wma") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.ac3") returned 0 [0062.777] lstrlenA (lpString="*.ac3") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", pszSpec="*.doc") returned 0 [0062.777] lstrlenA (lpString="*.doc") returned 5 [0062.777] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0062.777] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Rotate3.ico") returned -1 [0062.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Rotate3.ico") returned -1 [0062.777] lstrcmpiA (lpString1="", lpString2="Rotate3.ico") returned -1 [0062.777] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned="Rotate2.ico" [0062.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.778] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.778] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.778] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.778] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate3.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.zip") returned 0 [0062.778] lstrlenA (lpString="*.zip") returned 5 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.rar") returned 0 [0062.778] lstrlenA (lpString="*.rar") returned 5 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.7z") returned 0 [0062.778] lstrlenA (lpString="*.7z") returned 4 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.tar") returned 0 [0062.778] lstrlenA (lpString="*.tar") returned 5 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.gzip") returned 0 [0062.778] lstrlenA (lpString="*.gzip") returned 6 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.jpg") returned 0 [0062.778] lstrlenA (lpString="*.jpg") returned 5 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.jpeg") returned 0 [0062.778] lstrlenA (lpString="*.jpeg") returned 6 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.psd") returned 0 [0062.778] lstrlenA (lpString="*.psd") returned 5 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.cdr") returned 0 [0062.778] lstrlenA (lpString="*.cdr") returned 5 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.dwg") returned 0 [0062.778] lstrlenA (lpString="*.dwg") returned 5 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.max") returned 0 [0062.778] lstrlenA (lpString="*.max") returned 5 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.bmp") returned 0 [0062.778] lstrlenA (lpString="*.bmp") returned 5 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.gif") returned 0 [0062.778] lstrlenA (lpString="*.gif") returned 5 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.png") returned 0 [0062.778] lstrlenA (lpString="*.png") returned 5 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.doc") returned 0 [0062.778] lstrlenA (lpString="*.doc") returned 5 [0062.778] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.docx") returned 0 [0062.779] lstrlenA (lpString="*.docx") returned 6 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.xls") returned 0 [0062.779] lstrlenA (lpString="*.xls") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.xlsx") returned 0 [0062.779] lstrlenA (lpString="*.xlsx") returned 6 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.ppt") returned 0 [0062.779] lstrlenA (lpString="*.ppt") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.pptx") returned 0 [0062.779] lstrlenA (lpString="*.pptx") returned 6 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.txt") returned 0 [0062.779] lstrlenA (lpString="*.txt") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.pdf") returned 0 [0062.779] lstrlenA (lpString="*.pdf") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.djvu") returned 0 [0062.779] lstrlenA (lpString="*.djvu") returned 6 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.htm") returned 0 [0062.779] lstrlenA (lpString="*.htm") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.html") returned 0 [0062.779] lstrlenA (lpString="*.html") returned 6 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mdb") returned 0 [0062.779] lstrlenA (lpString="*.mdb") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.cer") returned 0 [0062.779] lstrlenA (lpString="*.cer") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.p12") returned 0 [0062.779] lstrlenA (lpString="*.p12") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.pfx") returned 0 [0062.779] lstrlenA (lpString="*.pfx") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.kwm") returned 0 [0062.779] lstrlenA (lpString="*.kwm") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.pwm") returned 0 [0062.779] lstrlenA (lpString="*.pwm") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.1cd") returned 0 [0062.779] lstrlenA (lpString="*.1cd") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.md") returned 0 [0062.779] lstrlenA (lpString="*.md") returned 4 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mdf") returned 0 [0062.779] lstrlenA (lpString="*.mdf") returned 5 [0062.779] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.dbf") returned 0 [0062.780] lstrlenA (lpString="*.dbf") returned 5 [0062.780] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.odt") returned 0 [0062.780] lstrlenA (lpString="*.odt") returned 5 [0062.780] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.vob") returned 0 [0062.780] lstrlenA (lpString="*.vob") returned 5 [0062.780] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.ifo") returned 0 [0062.780] lstrlenA (lpString="*.ifo") returned 5 [0062.780] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.lnk") returned 0 [0062.780] lstrlenA (lpString="*.lnk") returned 5 [0062.780] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.torrent") returned 0 [0062.780] lstrlenA (lpString="*.torrent") returned 9 [0062.780] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mov") returned 0 [0062.786] lstrlenA (lpString="*.mov") returned 5 [0062.786] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.m2v") returned 0 [0062.786] lstrlenA (lpString="*.m2v") returned 5 [0062.786] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.3gp") returned 0 [0062.786] lstrlenA (lpString="*.3gp") returned 5 [0062.786] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mpeg") returned 0 [0062.786] lstrlenA (lpString="*.mpeg") returned 6 [0062.786] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mpg") returned 0 [0062.786] lstrlenA (lpString="*.mpg") returned 5 [0062.786] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.flv") returned 0 [0062.786] lstrlenA (lpString="*.flv") returned 5 [0062.786] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.avi") returned 0 [0062.786] lstrlenA (lpString="*.avi") returned 5 [0062.786] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mp4") returned 0 [0062.786] lstrlenA (lpString="*.mp4") returned 5 [0062.786] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.wmv") returned 0 [0062.786] lstrlenA (lpString="*.wmv") returned 5 [0062.786] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.divx") returned 0 [0062.786] lstrlenA (lpString="*.divx") returned 6 [0062.786] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mkv") returned 0 [0062.786] lstrlenA (lpString="*.mkv") returned 5 [0062.786] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.mp3") returned 0 [0062.786] lstrlenA (lpString="*.mp3") returned 5 [0062.786] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.wav") returned 0 [0062.787] lstrlenA (lpString="*.wav") returned 5 [0062.787] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.flac") returned 0 [0062.787] lstrlenA (lpString="*.flac") returned 6 [0062.787] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.ape") returned 0 [0062.787] lstrlenA (lpString="*.ape") returned 5 [0062.787] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.wma") returned 0 [0062.787] lstrlenA (lpString="*.wma") returned 5 [0062.787] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.ac3") returned 0 [0062.787] lstrlenA (lpString="*.ac3") returned 5 [0062.787] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", pszSpec="*.doc") returned 0 [0062.787] lstrlenA (lpString="*.doc") returned 5 [0062.787] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0062.787] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Rotate4.ico") returned -1 [0062.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Rotate4.ico") returned -1 [0062.787] lstrcmpiA (lpString1="", lpString2="Rotate4.ico") returned -1 [0062.787] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned="Rotate3.ico" [0062.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.787] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.787] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.787] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.787] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate4.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" [0062.787] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.zip") returned 0 [0062.787] lstrlenA (lpString="*.zip") returned 5 [0062.787] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.rar") returned 0 [0062.787] lstrlenA (lpString="*.rar") returned 5 [0062.787] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.7z") returned 0 [0062.787] lstrlenA (lpString="*.7z") returned 4 [0062.787] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.tar") returned 0 [0062.788] lstrlenA (lpString="*.tar") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.gzip") returned 0 [0062.788] lstrlenA (lpString="*.gzip") returned 6 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.jpg") returned 0 [0062.788] lstrlenA (lpString="*.jpg") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.jpeg") returned 0 [0062.788] lstrlenA (lpString="*.jpeg") returned 6 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.psd") returned 0 [0062.788] lstrlenA (lpString="*.psd") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.cdr") returned 0 [0062.788] lstrlenA (lpString="*.cdr") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.dwg") returned 0 [0062.788] lstrlenA (lpString="*.dwg") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.max") returned 0 [0062.788] lstrlenA (lpString="*.max") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.bmp") returned 0 [0062.788] lstrlenA (lpString="*.bmp") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.gif") returned 0 [0062.788] lstrlenA (lpString="*.gif") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.png") returned 0 [0062.788] lstrlenA (lpString="*.png") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.doc") returned 0 [0062.788] lstrlenA (lpString="*.doc") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.docx") returned 0 [0062.788] lstrlenA (lpString="*.docx") returned 6 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.xls") returned 0 [0062.788] lstrlenA (lpString="*.xls") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.xlsx") returned 0 [0062.788] lstrlenA (lpString="*.xlsx") returned 6 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.ppt") returned 0 [0062.788] lstrlenA (lpString="*.ppt") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.pptx") returned 0 [0062.788] lstrlenA (lpString="*.pptx") returned 6 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.txt") returned 0 [0062.788] lstrlenA (lpString="*.txt") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.pdf") returned 0 [0062.788] lstrlenA (lpString="*.pdf") returned 5 [0062.788] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.djvu") returned 0 [0062.789] lstrlenA (lpString="*.djvu") returned 6 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.htm") returned 0 [0062.789] lstrlenA (lpString="*.htm") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.html") returned 0 [0062.789] lstrlenA (lpString="*.html") returned 6 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mdb") returned 0 [0062.789] lstrlenA (lpString="*.mdb") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.cer") returned 0 [0062.789] lstrlenA (lpString="*.cer") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.p12") returned 0 [0062.789] lstrlenA (lpString="*.p12") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.pfx") returned 0 [0062.789] lstrlenA (lpString="*.pfx") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.kwm") returned 0 [0062.789] lstrlenA (lpString="*.kwm") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.pwm") returned 0 [0062.789] lstrlenA (lpString="*.pwm") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.1cd") returned 0 [0062.789] lstrlenA (lpString="*.1cd") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.md") returned 0 [0062.789] lstrlenA (lpString="*.md") returned 4 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mdf") returned 0 [0062.789] lstrlenA (lpString="*.mdf") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.dbf") returned 0 [0062.789] lstrlenA (lpString="*.dbf") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.odt") returned 0 [0062.789] lstrlenA (lpString="*.odt") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.vob") returned 0 [0062.789] lstrlenA (lpString="*.vob") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.ifo") returned 0 [0062.789] lstrlenA (lpString="*.ifo") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.lnk") returned 0 [0062.789] lstrlenA (lpString="*.lnk") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.torrent") returned 0 [0062.789] lstrlenA (lpString="*.torrent") returned 9 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mov") returned 0 [0062.789] lstrlenA (lpString="*.mov") returned 5 [0062.789] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.m2v") returned 0 [0062.790] lstrlenA (lpString="*.m2v") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.3gp") returned 0 [0062.790] lstrlenA (lpString="*.3gp") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mpeg") returned 0 [0062.790] lstrlenA (lpString="*.mpeg") returned 6 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mpg") returned 0 [0062.790] lstrlenA (lpString="*.mpg") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.flv") returned 0 [0062.790] lstrlenA (lpString="*.flv") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.avi") returned 0 [0062.790] lstrlenA (lpString="*.avi") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mp4") returned 0 [0062.790] lstrlenA (lpString="*.mp4") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.wmv") returned 0 [0062.790] lstrlenA (lpString="*.wmv") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.divx") returned 0 [0062.790] lstrlenA (lpString="*.divx") returned 6 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mkv") returned 0 [0062.790] lstrlenA (lpString="*.mkv") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.mp3") returned 0 [0062.790] lstrlenA (lpString="*.mp3") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.wav") returned 0 [0062.790] lstrlenA (lpString="*.wav") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.flac") returned 0 [0062.790] lstrlenA (lpString="*.flac") returned 6 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.ape") returned 0 [0062.790] lstrlenA (lpString="*.ape") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.wma") returned 0 [0062.790] lstrlenA (lpString="*.wma") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.ac3") returned 0 [0062.790] lstrlenA (lpString="*.ac3") returned 5 [0062.790] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", pszSpec="*.doc") returned 0 [0062.790] lstrlenA (lpString="*.doc") returned 5 [0062.790] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0062.790] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Rotate5.ico") returned -1 [0062.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Rotate5.ico") returned -1 [0062.790] lstrcmpiA (lpString1="", lpString2="Rotate5.ico") returned -1 [0062.791] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned="Rotate4.ico" [0062.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.791] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.791] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.791] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.791] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate5.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.zip") returned 0 [0062.791] lstrlenA (lpString="*.zip") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.rar") returned 0 [0062.791] lstrlenA (lpString="*.rar") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.7z") returned 0 [0062.791] lstrlenA (lpString="*.7z") returned 4 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.tar") returned 0 [0062.791] lstrlenA (lpString="*.tar") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.gzip") returned 0 [0062.791] lstrlenA (lpString="*.gzip") returned 6 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.jpg") returned 0 [0062.791] lstrlenA (lpString="*.jpg") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.jpeg") returned 0 [0062.791] lstrlenA (lpString="*.jpeg") returned 6 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.psd") returned 0 [0062.791] lstrlenA (lpString="*.psd") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.cdr") returned 0 [0062.791] lstrlenA (lpString="*.cdr") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.dwg") returned 0 [0062.791] lstrlenA (lpString="*.dwg") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.max") returned 0 [0062.791] lstrlenA (lpString="*.max") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.bmp") returned 0 [0062.791] lstrlenA (lpString="*.bmp") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.gif") returned 0 [0062.791] lstrlenA (lpString="*.gif") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.png") returned 0 [0062.791] lstrlenA (lpString="*.png") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.doc") returned 0 [0062.792] lstrlenA (lpString="*.doc") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.docx") returned 0 [0062.792] lstrlenA (lpString="*.docx") returned 6 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.xls") returned 0 [0062.792] lstrlenA (lpString="*.xls") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.xlsx") returned 0 [0062.792] lstrlenA (lpString="*.xlsx") returned 6 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.ppt") returned 0 [0062.792] lstrlenA (lpString="*.ppt") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.pptx") returned 0 [0062.792] lstrlenA (lpString="*.pptx") returned 6 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.txt") returned 0 [0062.792] lstrlenA (lpString="*.txt") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.pdf") returned 0 [0062.792] lstrlenA (lpString="*.pdf") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.djvu") returned 0 [0062.792] lstrlenA (lpString="*.djvu") returned 6 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.htm") returned 0 [0062.792] lstrlenA (lpString="*.htm") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.html") returned 0 [0062.792] lstrlenA (lpString="*.html") returned 6 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mdb") returned 0 [0062.792] lstrlenA (lpString="*.mdb") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.cer") returned 0 [0062.792] lstrlenA (lpString="*.cer") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.p12") returned 0 [0062.792] lstrlenA (lpString="*.p12") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.pfx") returned 0 [0062.792] lstrlenA (lpString="*.pfx") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.kwm") returned 0 [0062.792] lstrlenA (lpString="*.kwm") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.pwm") returned 0 [0062.792] lstrlenA (lpString="*.pwm") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.1cd") returned 0 [0062.792] lstrlenA (lpString="*.1cd") returned 5 [0062.792] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.md") returned 0 [0062.792] lstrlenA (lpString="*.md") returned 4 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mdf") returned 0 [0062.793] lstrlenA (lpString="*.mdf") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.dbf") returned 0 [0062.793] lstrlenA (lpString="*.dbf") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.odt") returned 0 [0062.793] lstrlenA (lpString="*.odt") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.vob") returned 0 [0062.793] lstrlenA (lpString="*.vob") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.ifo") returned 0 [0062.793] lstrlenA (lpString="*.ifo") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.lnk") returned 0 [0062.793] lstrlenA (lpString="*.lnk") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.torrent") returned 0 [0062.793] lstrlenA (lpString="*.torrent") returned 9 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mov") returned 0 [0062.793] lstrlenA (lpString="*.mov") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.m2v") returned 0 [0062.793] lstrlenA (lpString="*.m2v") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.3gp") returned 0 [0062.793] lstrlenA (lpString="*.3gp") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mpeg") returned 0 [0062.793] lstrlenA (lpString="*.mpeg") returned 6 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mpg") returned 0 [0062.793] lstrlenA (lpString="*.mpg") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.flv") returned 0 [0062.793] lstrlenA (lpString="*.flv") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.avi") returned 0 [0062.793] lstrlenA (lpString="*.avi") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mp4") returned 0 [0062.793] lstrlenA (lpString="*.mp4") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.wmv") returned 0 [0062.793] lstrlenA (lpString="*.wmv") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.divx") returned 0 [0062.793] lstrlenA (lpString="*.divx") returned 6 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mkv") returned 0 [0062.793] lstrlenA (lpString="*.mkv") returned 5 [0062.793] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.mp3") returned 0 [0062.793] lstrlenA (lpString="*.mp3") returned 5 [0062.794] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.wav") returned 0 [0062.794] lstrlenA (lpString="*.wav") returned 5 [0062.794] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.flac") returned 0 [0062.794] lstrlenA (lpString="*.flac") returned 6 [0062.794] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.ape") returned 0 [0062.794] lstrlenA (lpString="*.ape") returned 5 [0062.794] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.wma") returned 0 [0062.794] lstrlenA (lpString="*.wma") returned 5 [0062.794] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.ac3") returned 0 [0062.794] lstrlenA (lpString="*.ac3") returned 5 [0062.794] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", pszSpec="*.doc") returned 0 [0062.794] lstrlenA (lpString="*.doc") returned 5 [0062.794] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0062.794] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.794] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Rotate6.ico") returned -1 [0062.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Rotate6.ico") returned -1 [0062.794] lstrcmpiA (lpString1="", lpString2="Rotate6.ico") returned -1 [0062.794] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned="Rotate5.ico" [0062.794] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.794] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.794] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.794] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.794] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate6.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" [0062.794] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.zip") returned 0 [0062.794] lstrlenA (lpString="*.zip") returned 5 [0062.794] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.rar") returned 0 [0062.794] lstrlenA (lpString="*.rar") returned 5 [0062.794] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.7z") returned 0 [0062.794] lstrlenA (lpString="*.7z") returned 4 [0062.794] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.tar") returned 0 [0062.794] lstrlenA (lpString="*.tar") returned 5 [0062.794] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.gzip") returned 0 [0062.795] lstrlenA (lpString="*.gzip") returned 6 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.jpg") returned 0 [0062.795] lstrlenA (lpString="*.jpg") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.jpeg") returned 0 [0062.795] lstrlenA (lpString="*.jpeg") returned 6 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.psd") returned 0 [0062.795] lstrlenA (lpString="*.psd") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.cdr") returned 0 [0062.795] lstrlenA (lpString="*.cdr") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.dwg") returned 0 [0062.795] lstrlenA (lpString="*.dwg") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.max") returned 0 [0062.795] lstrlenA (lpString="*.max") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.bmp") returned 0 [0062.795] lstrlenA (lpString="*.bmp") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.gif") returned 0 [0062.795] lstrlenA (lpString="*.gif") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.png") returned 0 [0062.795] lstrlenA (lpString="*.png") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.doc") returned 0 [0062.795] lstrlenA (lpString="*.doc") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.docx") returned 0 [0062.795] lstrlenA (lpString="*.docx") returned 6 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.xls") returned 0 [0062.795] lstrlenA (lpString="*.xls") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.xlsx") returned 0 [0062.795] lstrlenA (lpString="*.xlsx") returned 6 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.ppt") returned 0 [0062.795] lstrlenA (lpString="*.ppt") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.pptx") returned 0 [0062.795] lstrlenA (lpString="*.pptx") returned 6 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.txt") returned 0 [0062.795] lstrlenA (lpString="*.txt") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.pdf") returned 0 [0062.795] lstrlenA (lpString="*.pdf") returned 5 [0062.795] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.djvu") returned 0 [0062.795] lstrlenA (lpString="*.djvu") returned 6 [0062.796] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.htm") returned 0 [0062.796] lstrlenA (lpString="*.htm") returned 5 [0062.796] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.html") returned 0 [0062.796] lstrlenA (lpString="*.html") returned 6 [0062.796] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mdb") returned 0 [0062.796] lstrlenA (lpString="*.mdb") returned 5 [0062.796] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.cer") returned 0 [0062.796] lstrlenA (lpString="*.cer") returned 5 [0062.796] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.p12") returned 0 [0062.796] lstrlenA (lpString="*.p12") returned 5 [0062.796] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.pfx") returned 0 [0062.796] lstrlenA (lpString="*.pfx") returned 5 [0062.796] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.kwm") returned 0 [0062.796] lstrlenA (lpString="*.kwm") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.pwm") returned 0 [0062.797] lstrlenA (lpString="*.pwm") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.1cd") returned 0 [0062.797] lstrlenA (lpString="*.1cd") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.md") returned 0 [0062.797] lstrlenA (lpString="*.md") returned 4 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mdf") returned 0 [0062.797] lstrlenA (lpString="*.mdf") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.dbf") returned 0 [0062.797] lstrlenA (lpString="*.dbf") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.odt") returned 0 [0062.797] lstrlenA (lpString="*.odt") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.vob") returned 0 [0062.797] lstrlenA (lpString="*.vob") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.ifo") returned 0 [0062.797] lstrlenA (lpString="*.ifo") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.lnk") returned 0 [0062.797] lstrlenA (lpString="*.lnk") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.torrent") returned 0 [0062.797] lstrlenA (lpString="*.torrent") returned 9 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mov") returned 0 [0062.797] lstrlenA (lpString="*.mov") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.m2v") returned 0 [0062.797] lstrlenA (lpString="*.m2v") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.3gp") returned 0 [0062.797] lstrlenA (lpString="*.3gp") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mpeg") returned 0 [0062.797] lstrlenA (lpString="*.mpeg") returned 6 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mpg") returned 0 [0062.797] lstrlenA (lpString="*.mpg") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.flv") returned 0 [0062.797] lstrlenA (lpString="*.flv") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.avi") returned 0 [0062.797] lstrlenA (lpString="*.avi") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mp4") returned 0 [0062.797] lstrlenA (lpString="*.mp4") returned 5 [0062.797] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.wmv") returned 0 [0062.797] lstrlenA (lpString="*.wmv") returned 5 [0062.798] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.divx") returned 0 [0062.798] lstrlenA (lpString="*.divx") returned 6 [0062.798] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mkv") returned 0 [0062.798] lstrlenA (lpString="*.mkv") returned 5 [0062.798] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.mp3") returned 0 [0062.798] lstrlenA (lpString="*.mp3") returned 5 [0062.798] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.wav") returned 0 [0062.798] lstrlenA (lpString="*.wav") returned 5 [0062.798] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.flac") returned 0 [0062.798] lstrlenA (lpString="*.flac") returned 6 [0062.798] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.ape") returned 0 [0062.798] lstrlenA (lpString="*.ape") returned 5 [0062.798] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.wma") returned 0 [0062.798] lstrlenA (lpString="*.wma") returned 5 [0062.798] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.ac3") returned 0 [0062.798] lstrlenA (lpString="*.ac3") returned 5 [0062.798] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", pszSpec="*.doc") returned 0 [0062.798] lstrlenA (lpString="*.doc") returned 5 [0062.798] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0062.798] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.798] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Rotate7.ico") returned -1 [0062.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Rotate7.ico") returned -1 [0062.798] lstrcmpiA (lpString1="", lpString2="Rotate7.ico") returned -1 [0062.798] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned="Rotate6.ico" [0062.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.798] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.798] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.798] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.798] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate7.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" [0062.798] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.zip") returned 0 [0062.798] lstrlenA (lpString="*.zip") returned 5 [0062.798] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.rar") returned 0 [0062.798] lstrlenA (lpString="*.rar") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.7z") returned 0 [0062.799] lstrlenA (lpString="*.7z") returned 4 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.tar") returned 0 [0062.799] lstrlenA (lpString="*.tar") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.gzip") returned 0 [0062.799] lstrlenA (lpString="*.gzip") returned 6 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.jpg") returned 0 [0062.799] lstrlenA (lpString="*.jpg") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.jpeg") returned 0 [0062.799] lstrlenA (lpString="*.jpeg") returned 6 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.psd") returned 0 [0062.799] lstrlenA (lpString="*.psd") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.cdr") returned 0 [0062.799] lstrlenA (lpString="*.cdr") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.dwg") returned 0 [0062.799] lstrlenA (lpString="*.dwg") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.max") returned 0 [0062.799] lstrlenA (lpString="*.max") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.bmp") returned 0 [0062.799] lstrlenA (lpString="*.bmp") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.gif") returned 0 [0062.799] lstrlenA (lpString="*.gif") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.png") returned 0 [0062.799] lstrlenA (lpString="*.png") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.doc") returned 0 [0062.799] lstrlenA (lpString="*.doc") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.docx") returned 0 [0062.799] lstrlenA (lpString="*.docx") returned 6 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.xls") returned 0 [0062.799] lstrlenA (lpString="*.xls") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.xlsx") returned 0 [0062.799] lstrlenA (lpString="*.xlsx") returned 6 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.ppt") returned 0 [0062.799] lstrlenA (lpString="*.ppt") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.pptx") returned 0 [0062.799] lstrlenA (lpString="*.pptx") returned 6 [0062.799] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.txt") returned 0 [0062.799] lstrlenA (lpString="*.txt") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.pdf") returned 0 [0062.800] lstrlenA (lpString="*.pdf") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.djvu") returned 0 [0062.800] lstrlenA (lpString="*.djvu") returned 6 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.htm") returned 0 [0062.800] lstrlenA (lpString="*.htm") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.html") returned 0 [0062.800] lstrlenA (lpString="*.html") returned 6 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mdb") returned 0 [0062.800] lstrlenA (lpString="*.mdb") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.cer") returned 0 [0062.800] lstrlenA (lpString="*.cer") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.p12") returned 0 [0062.800] lstrlenA (lpString="*.p12") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.pfx") returned 0 [0062.800] lstrlenA (lpString="*.pfx") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.kwm") returned 0 [0062.800] lstrlenA (lpString="*.kwm") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.pwm") returned 0 [0062.800] lstrlenA (lpString="*.pwm") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.1cd") returned 0 [0062.800] lstrlenA (lpString="*.1cd") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.md") returned 0 [0062.800] lstrlenA (lpString="*.md") returned 4 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mdf") returned 0 [0062.800] lstrlenA (lpString="*.mdf") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.dbf") returned 0 [0062.800] lstrlenA (lpString="*.dbf") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.odt") returned 0 [0062.800] lstrlenA (lpString="*.odt") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.vob") returned 0 [0062.800] lstrlenA (lpString="*.vob") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.ifo") returned 0 [0062.800] lstrlenA (lpString="*.ifo") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.lnk") returned 0 [0062.800] lstrlenA (lpString="*.lnk") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.torrent") returned 0 [0062.800] lstrlenA (lpString="*.torrent") returned 9 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mov") returned 0 [0062.801] lstrlenA (lpString="*.mov") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.m2v") returned 0 [0062.801] lstrlenA (lpString="*.m2v") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.3gp") returned 0 [0062.801] lstrlenA (lpString="*.3gp") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mpeg") returned 0 [0062.801] lstrlenA (lpString="*.mpeg") returned 6 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mpg") returned 0 [0062.801] lstrlenA (lpString="*.mpg") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.flv") returned 0 [0062.801] lstrlenA (lpString="*.flv") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.avi") returned 0 [0062.801] lstrlenA (lpString="*.avi") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mp4") returned 0 [0062.801] lstrlenA (lpString="*.mp4") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.wmv") returned 0 [0062.801] lstrlenA (lpString="*.wmv") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.divx") returned 0 [0062.801] lstrlenA (lpString="*.divx") returned 6 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mkv") returned 0 [0062.801] lstrlenA (lpString="*.mkv") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.mp3") returned 0 [0062.801] lstrlenA (lpString="*.mp3") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.wav") returned 0 [0062.801] lstrlenA (lpString="*.wav") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.flac") returned 0 [0062.801] lstrlenA (lpString="*.flac") returned 6 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.ape") returned 0 [0062.801] lstrlenA (lpString="*.ape") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.wma") returned 0 [0062.801] lstrlenA (lpString="*.wma") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.ac3") returned 0 [0062.801] lstrlenA (lpString="*.ac3") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", pszSpec="*.doc") returned 0 [0062.801] lstrlenA (lpString="*.doc") returned 5 [0062.801] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0062.802] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Rotate8.ico") returned -1 [0062.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Rotate8.ico") returned -1 [0062.802] lstrcmpiA (lpString1="", lpString2="Rotate8.ico") returned -1 [0062.802] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned="Rotate7.ico" [0062.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.802] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.802] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.802] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.802] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate8.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.zip") returned 0 [0062.802] lstrlenA (lpString="*.zip") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.rar") returned 0 [0062.802] lstrlenA (lpString="*.rar") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.7z") returned 0 [0062.802] lstrlenA (lpString="*.7z") returned 4 [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.tar") returned 0 [0062.802] lstrlenA (lpString="*.tar") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.gzip") returned 0 [0062.802] lstrlenA (lpString="*.gzip") returned 6 [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.jpg") returned 0 [0062.802] lstrlenA (lpString="*.jpg") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.jpeg") returned 0 [0062.802] lstrlenA (lpString="*.jpeg") returned 6 [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.psd") returned 0 [0062.802] lstrlenA (lpString="*.psd") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.cdr") returned 0 [0062.802] lstrlenA (lpString="*.cdr") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.dwg") returned 0 [0062.802] lstrlenA (lpString="*.dwg") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.max") returned 0 [0062.802] lstrlenA (lpString="*.max") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.bmp") returned 0 [0062.802] lstrlenA (lpString="*.bmp") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.gif") returned 0 [0062.803] lstrlenA (lpString="*.gif") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.png") returned 0 [0062.803] lstrlenA (lpString="*.png") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.doc") returned 0 [0062.803] lstrlenA (lpString="*.doc") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.docx") returned 0 [0062.803] lstrlenA (lpString="*.docx") returned 6 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.xls") returned 0 [0062.803] lstrlenA (lpString="*.xls") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.xlsx") returned 0 [0062.803] lstrlenA (lpString="*.xlsx") returned 6 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.ppt") returned 0 [0062.803] lstrlenA (lpString="*.ppt") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.pptx") returned 0 [0062.803] lstrlenA (lpString="*.pptx") returned 6 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.txt") returned 0 [0062.803] lstrlenA (lpString="*.txt") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.pdf") returned 0 [0062.803] lstrlenA (lpString="*.pdf") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.djvu") returned 0 [0062.803] lstrlenA (lpString="*.djvu") returned 6 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.htm") returned 0 [0062.803] lstrlenA (lpString="*.htm") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.html") returned 0 [0062.803] lstrlenA (lpString="*.html") returned 6 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mdb") returned 0 [0062.803] lstrlenA (lpString="*.mdb") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.cer") returned 0 [0062.803] lstrlenA (lpString="*.cer") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.p12") returned 0 [0062.803] lstrlenA (lpString="*.p12") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.pfx") returned 0 [0062.803] lstrlenA (lpString="*.pfx") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.kwm") returned 0 [0062.803] lstrlenA (lpString="*.kwm") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.pwm") returned 0 [0062.803] lstrlenA (lpString="*.pwm") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.1cd") returned 0 [0062.804] lstrlenA (lpString="*.1cd") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.md") returned 0 [0062.804] lstrlenA (lpString="*.md") returned 4 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mdf") returned 0 [0062.804] lstrlenA (lpString="*.mdf") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.dbf") returned 0 [0062.804] lstrlenA (lpString="*.dbf") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.odt") returned 0 [0062.804] lstrlenA (lpString="*.odt") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.vob") returned 0 [0062.804] lstrlenA (lpString="*.vob") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.ifo") returned 0 [0062.804] lstrlenA (lpString="*.ifo") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.lnk") returned 0 [0062.804] lstrlenA (lpString="*.lnk") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.torrent") returned 0 [0062.804] lstrlenA (lpString="*.torrent") returned 9 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mov") returned 0 [0062.804] lstrlenA (lpString="*.mov") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.m2v") returned 0 [0062.804] lstrlenA (lpString="*.m2v") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.3gp") returned 0 [0062.804] lstrlenA (lpString="*.3gp") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mpeg") returned 0 [0062.804] lstrlenA (lpString="*.mpeg") returned 6 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mpg") returned 0 [0062.804] lstrlenA (lpString="*.mpg") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.flv") returned 0 [0062.804] lstrlenA (lpString="*.flv") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.avi") returned 0 [0062.804] lstrlenA (lpString="*.avi") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mp4") returned 0 [0062.804] lstrlenA (lpString="*.mp4") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.wmv") returned 0 [0062.804] lstrlenA (lpString="*.wmv") returned 5 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.divx") returned 0 [0062.804] lstrlenA (lpString="*.divx") returned 6 [0062.804] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mkv") returned 0 [0062.805] lstrlenA (lpString="*.mkv") returned 5 [0062.805] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.mp3") returned 0 [0062.805] lstrlenA (lpString="*.mp3") returned 5 [0062.805] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.wav") returned 0 [0062.805] lstrlenA (lpString="*.wav") returned 5 [0062.805] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.flac") returned 0 [0062.805] lstrlenA (lpString="*.flac") returned 6 [0062.805] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.ape") returned 0 [0062.805] lstrlenA (lpString="*.ape") returned 5 [0062.805] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.wma") returned 0 [0062.805] lstrlenA (lpString="*.wma") returned 5 [0062.805] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.ac3") returned 0 [0062.805] lstrlenA (lpString="*.ac3") returned 5 [0062.805] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", pszSpec="*.doc") returned 0 [0062.805] lstrlenA (lpString="*.doc") returned 5 [0062.805] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0062.805] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Save.ico") returned -1 [0062.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Save.ico") returned -1 [0062.805] lstrcmpiA (lpString1="", lpString2="Save.ico") returned -1 [0062.805] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned="Rotate8.ico" [0062.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.805] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.805] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.805] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.805] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Save.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Save.ico" [0062.805] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.zip") returned 0 [0062.805] lstrlenA (lpString="*.zip") returned 5 [0062.805] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.rar") returned 0 [0062.805] lstrlenA (lpString="*.rar") returned 5 [0062.805] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.7z") returned 0 [0062.805] lstrlenA (lpString="*.7z") returned 4 [0062.805] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.tar") returned 0 [0062.805] lstrlenA (lpString="*.tar") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.gzip") returned 0 [0062.806] lstrlenA (lpString="*.gzip") returned 6 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.jpg") returned 0 [0062.806] lstrlenA (lpString="*.jpg") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.jpeg") returned 0 [0062.806] lstrlenA (lpString="*.jpeg") returned 6 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.psd") returned 0 [0062.806] lstrlenA (lpString="*.psd") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.cdr") returned 0 [0062.806] lstrlenA (lpString="*.cdr") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.dwg") returned 0 [0062.806] lstrlenA (lpString="*.dwg") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.max") returned 0 [0062.806] lstrlenA (lpString="*.max") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.bmp") returned 0 [0062.806] lstrlenA (lpString="*.bmp") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.gif") returned 0 [0062.806] lstrlenA (lpString="*.gif") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.png") returned 0 [0062.806] lstrlenA (lpString="*.png") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.doc") returned 0 [0062.806] lstrlenA (lpString="*.doc") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.docx") returned 0 [0062.806] lstrlenA (lpString="*.docx") returned 6 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.xls") returned 0 [0062.806] lstrlenA (lpString="*.xls") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.xlsx") returned 0 [0062.806] lstrlenA (lpString="*.xlsx") returned 6 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.ppt") returned 0 [0062.806] lstrlenA (lpString="*.ppt") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.pptx") returned 0 [0062.806] lstrlenA (lpString="*.pptx") returned 6 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.txt") returned 0 [0062.806] lstrlenA (lpString="*.txt") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.pdf") returned 0 [0062.806] lstrlenA (lpString="*.pdf") returned 5 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.djvu") returned 0 [0062.806] lstrlenA (lpString="*.djvu") returned 6 [0062.806] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.htm") returned 0 [0062.807] lstrlenA (lpString="*.htm") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.html") returned 0 [0062.807] lstrlenA (lpString="*.html") returned 6 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mdb") returned 0 [0062.807] lstrlenA (lpString="*.mdb") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.cer") returned 0 [0062.807] lstrlenA (lpString="*.cer") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.p12") returned 0 [0062.807] lstrlenA (lpString="*.p12") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.pfx") returned 0 [0062.807] lstrlenA (lpString="*.pfx") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.kwm") returned 0 [0062.807] lstrlenA (lpString="*.kwm") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.pwm") returned 0 [0062.807] lstrlenA (lpString="*.pwm") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.1cd") returned 0 [0062.807] lstrlenA (lpString="*.1cd") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.md") returned 0 [0062.807] lstrlenA (lpString="*.md") returned 4 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mdf") returned 0 [0062.807] lstrlenA (lpString="*.mdf") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.dbf") returned 0 [0062.807] lstrlenA (lpString="*.dbf") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.odt") returned 0 [0062.807] lstrlenA (lpString="*.odt") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.vob") returned 0 [0062.807] lstrlenA (lpString="*.vob") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.ifo") returned 0 [0062.807] lstrlenA (lpString="*.ifo") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.lnk") returned 0 [0062.807] lstrlenA (lpString="*.lnk") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.torrent") returned 0 [0062.807] lstrlenA (lpString="*.torrent") returned 9 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mov") returned 0 [0062.807] lstrlenA (lpString="*.mov") returned 5 [0062.807] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.m2v") returned 0 [0062.807] lstrlenA (lpString="*.m2v") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.3gp") returned 0 [0062.808] lstrlenA (lpString="*.3gp") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mpeg") returned 0 [0062.808] lstrlenA (lpString="*.mpeg") returned 6 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mpg") returned 0 [0062.808] lstrlenA (lpString="*.mpg") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.flv") returned 0 [0062.808] lstrlenA (lpString="*.flv") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.avi") returned 0 [0062.808] lstrlenA (lpString="*.avi") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mp4") returned 0 [0062.808] lstrlenA (lpString="*.mp4") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.wmv") returned 0 [0062.808] lstrlenA (lpString="*.wmv") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.divx") returned 0 [0062.808] lstrlenA (lpString="*.divx") returned 6 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mkv") returned 0 [0062.808] lstrlenA (lpString="*.mkv") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.mp3") returned 0 [0062.808] lstrlenA (lpString="*.mp3") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.wav") returned 0 [0062.808] lstrlenA (lpString="*.wav") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.flac") returned 0 [0062.808] lstrlenA (lpString="*.flac") returned 6 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.ape") returned 0 [0062.808] lstrlenA (lpString="*.ape") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.wma") returned 0 [0062.808] lstrlenA (lpString="*.wma") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.ac3") returned 0 [0062.808] lstrlenA (lpString="*.ac3") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Save.ico", pszSpec="*.doc") returned 0 [0062.808] lstrlenA (lpString="*.doc") returned 5 [0062.808] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0062.808] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.808] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.ico") returned -1 [0062.808] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.ico") returned -1 [0062.808] lstrcmpiA (lpString1="", lpString2="Setup.ico") returned -1 [0062.809] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned="Save.ico" [0062.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.809] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.809] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.809] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.809] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Setup.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.zip") returned 0 [0062.809] lstrlenA (lpString="*.zip") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.rar") returned 0 [0062.809] lstrlenA (lpString="*.rar") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.7z") returned 0 [0062.809] lstrlenA (lpString="*.7z") returned 4 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.tar") returned 0 [0062.809] lstrlenA (lpString="*.tar") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.gzip") returned 0 [0062.809] lstrlenA (lpString="*.gzip") returned 6 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.jpg") returned 0 [0062.809] lstrlenA (lpString="*.jpg") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.jpeg") returned 0 [0062.809] lstrlenA (lpString="*.jpeg") returned 6 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.psd") returned 0 [0062.809] lstrlenA (lpString="*.psd") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.cdr") returned 0 [0062.809] lstrlenA (lpString="*.cdr") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.dwg") returned 0 [0062.809] lstrlenA (lpString="*.dwg") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.max") returned 0 [0062.809] lstrlenA (lpString="*.max") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.bmp") returned 0 [0062.809] lstrlenA (lpString="*.bmp") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.gif") returned 0 [0062.809] lstrlenA (lpString="*.gif") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.png") returned 0 [0062.809] lstrlenA (lpString="*.png") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.doc") returned 0 [0062.810] lstrlenA (lpString="*.doc") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.docx") returned 0 [0062.810] lstrlenA (lpString="*.docx") returned 6 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.xls") returned 0 [0062.810] lstrlenA (lpString="*.xls") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.xlsx") returned 0 [0062.810] lstrlenA (lpString="*.xlsx") returned 6 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.ppt") returned 0 [0062.810] lstrlenA (lpString="*.ppt") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.pptx") returned 0 [0062.810] lstrlenA (lpString="*.pptx") returned 6 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.txt") returned 0 [0062.810] lstrlenA (lpString="*.txt") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.pdf") returned 0 [0062.810] lstrlenA (lpString="*.pdf") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.djvu") returned 0 [0062.810] lstrlenA (lpString="*.djvu") returned 6 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.htm") returned 0 [0062.810] lstrlenA (lpString="*.htm") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.html") returned 0 [0062.810] lstrlenA (lpString="*.html") returned 6 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mdb") returned 0 [0062.810] lstrlenA (lpString="*.mdb") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.cer") returned 0 [0062.810] lstrlenA (lpString="*.cer") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.p12") returned 0 [0062.810] lstrlenA (lpString="*.p12") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.pfx") returned 0 [0062.810] lstrlenA (lpString="*.pfx") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.kwm") returned 0 [0062.810] lstrlenA (lpString="*.kwm") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.pwm") returned 0 [0062.810] lstrlenA (lpString="*.pwm") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.1cd") returned 0 [0062.810] lstrlenA (lpString="*.1cd") returned 5 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.md") returned 0 [0062.810] lstrlenA (lpString="*.md") returned 4 [0062.810] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mdf") returned 0 [0062.811] lstrlenA (lpString="*.mdf") returned 5 [0062.811] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.dbf") returned 0 [0062.811] lstrlenA (lpString="*.dbf") returned 5 [0062.811] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.odt") returned 0 [0062.811] lstrlenA (lpString="*.odt") returned 5 [0062.811] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.vob") returned 0 [0062.811] lstrlenA (lpString="*.vob") returned 5 [0062.811] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.ifo") returned 0 [0062.811] lstrlenA (lpString="*.ifo") returned 5 [0062.811] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.lnk") returned 0 [0062.811] lstrlenA (lpString="*.lnk") returned 5 [0062.811] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.torrent") returned 0 [0062.811] lstrlenA (lpString="*.torrent") returned 9 [0062.811] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mov") returned 0 [0062.811] lstrlenA (lpString="*.mov") returned 5 [0062.811] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.m2v") returned 0 [0062.811] lstrlenA (lpString="*.m2v") returned 5 [0062.811] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.3gp") returned 0 [0062.811] lstrlenA (lpString="*.3gp") returned 5 [0062.811] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mpeg") returned 0 [0062.811] lstrlenA (lpString="*.mpeg") returned 6 [0062.811] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mpg") returned 0 [0062.811] lstrlenA (lpString="*.mpg") returned 5 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.flv") returned 0 [0062.812] lstrlenA (lpString="*.flv") returned 5 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.avi") returned 0 [0062.812] lstrlenA (lpString="*.avi") returned 5 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mp4") returned 0 [0062.812] lstrlenA (lpString="*.mp4") returned 5 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.wmv") returned 0 [0062.812] lstrlenA (lpString="*.wmv") returned 5 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.divx") returned 0 [0062.812] lstrlenA (lpString="*.divx") returned 6 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mkv") returned 0 [0062.812] lstrlenA (lpString="*.mkv") returned 5 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.mp3") returned 0 [0062.812] lstrlenA (lpString="*.mp3") returned 5 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.wav") returned 0 [0062.812] lstrlenA (lpString="*.wav") returned 5 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.flac") returned 0 [0062.812] lstrlenA (lpString="*.flac") returned 6 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.ape") returned 0 [0062.812] lstrlenA (lpString="*.ape") returned 5 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.wma") returned 0 [0062.812] lstrlenA (lpString="*.wma") returned 5 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.ac3") returned 0 [0062.812] lstrlenA (lpString="*.ac3") returned 5 [0062.812] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", pszSpec="*.doc") returned 0 [0062.812] lstrlenA (lpString="*.doc") returned 5 [0062.812] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0062.812] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.812] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="stop.ico") returned -1 [0062.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="stop.ico") returned -1 [0062.812] lstrcmpiA (lpString1="", lpString2="stop.ico") returned -1 [0062.812] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned="Setup.ico" [0062.813] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.813] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.813] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.813] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.813] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="stop.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned="C:\\588bce7c90097ed212\\Graphics\\stop.ico" [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.zip") returned 0 [0062.813] lstrlenA (lpString="*.zip") returned 5 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.rar") returned 0 [0062.813] lstrlenA (lpString="*.rar") returned 5 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.7z") returned 0 [0062.813] lstrlenA (lpString="*.7z") returned 4 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.tar") returned 0 [0062.813] lstrlenA (lpString="*.tar") returned 5 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.gzip") returned 0 [0062.813] lstrlenA (lpString="*.gzip") returned 6 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.jpg") returned 0 [0062.813] lstrlenA (lpString="*.jpg") returned 5 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.jpeg") returned 0 [0062.813] lstrlenA (lpString="*.jpeg") returned 6 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.psd") returned 0 [0062.813] lstrlenA (lpString="*.psd") returned 5 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.cdr") returned 0 [0062.813] lstrlenA (lpString="*.cdr") returned 5 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.dwg") returned 0 [0062.813] lstrlenA (lpString="*.dwg") returned 5 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.max") returned 0 [0062.813] lstrlenA (lpString="*.max") returned 5 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.bmp") returned 0 [0062.813] lstrlenA (lpString="*.bmp") returned 5 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.gif") returned 0 [0062.813] lstrlenA (lpString="*.gif") returned 5 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.png") returned 0 [0062.813] lstrlenA (lpString="*.png") returned 5 [0062.813] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.doc") returned 0 [0062.814] lstrlenA (lpString="*.doc") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.docx") returned 0 [0062.814] lstrlenA (lpString="*.docx") returned 6 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.xls") returned 0 [0062.814] lstrlenA (lpString="*.xls") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.xlsx") returned 0 [0062.814] lstrlenA (lpString="*.xlsx") returned 6 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.ppt") returned 0 [0062.814] lstrlenA (lpString="*.ppt") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.pptx") returned 0 [0062.814] lstrlenA (lpString="*.pptx") returned 6 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.txt") returned 0 [0062.814] lstrlenA (lpString="*.txt") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.pdf") returned 0 [0062.814] lstrlenA (lpString="*.pdf") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.djvu") returned 0 [0062.814] lstrlenA (lpString="*.djvu") returned 6 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.htm") returned 0 [0062.814] lstrlenA (lpString="*.htm") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.html") returned 0 [0062.814] lstrlenA (lpString="*.html") returned 6 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mdb") returned 0 [0062.814] lstrlenA (lpString="*.mdb") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.cer") returned 0 [0062.814] lstrlenA (lpString="*.cer") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.p12") returned 0 [0062.814] lstrlenA (lpString="*.p12") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.pfx") returned 0 [0062.814] lstrlenA (lpString="*.pfx") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.kwm") returned 0 [0062.814] lstrlenA (lpString="*.kwm") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.pwm") returned 0 [0062.814] lstrlenA (lpString="*.pwm") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.1cd") returned 0 [0062.814] lstrlenA (lpString="*.1cd") returned 5 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.md") returned 0 [0062.814] lstrlenA (lpString="*.md") returned 4 [0062.814] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mdf") returned 0 [0062.815] lstrlenA (lpString="*.mdf") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.dbf") returned 0 [0062.815] lstrlenA (lpString="*.dbf") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.odt") returned 0 [0062.815] lstrlenA (lpString="*.odt") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.vob") returned 0 [0062.815] lstrlenA (lpString="*.vob") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.ifo") returned 0 [0062.815] lstrlenA (lpString="*.ifo") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.lnk") returned 0 [0062.815] lstrlenA (lpString="*.lnk") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.torrent") returned 0 [0062.815] lstrlenA (lpString="*.torrent") returned 9 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mov") returned 0 [0062.815] lstrlenA (lpString="*.mov") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.m2v") returned 0 [0062.815] lstrlenA (lpString="*.m2v") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.3gp") returned 0 [0062.815] lstrlenA (lpString="*.3gp") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mpeg") returned 0 [0062.815] lstrlenA (lpString="*.mpeg") returned 6 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mpg") returned 0 [0062.815] lstrlenA (lpString="*.mpg") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.flv") returned 0 [0062.815] lstrlenA (lpString="*.flv") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.avi") returned 0 [0062.815] lstrlenA (lpString="*.avi") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mp4") returned 0 [0062.815] lstrlenA (lpString="*.mp4") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.wmv") returned 0 [0062.815] lstrlenA (lpString="*.wmv") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.divx") returned 0 [0062.815] lstrlenA (lpString="*.divx") returned 6 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mkv") returned 0 [0062.815] lstrlenA (lpString="*.mkv") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.mp3") returned 0 [0062.815] lstrlenA (lpString="*.mp3") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.wav") returned 0 [0062.816] lstrlenA (lpString="*.wav") returned 5 [0062.816] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.flac") returned 0 [0062.816] lstrlenA (lpString="*.flac") returned 6 [0062.816] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.ape") returned 0 [0062.816] lstrlenA (lpString="*.ape") returned 5 [0062.816] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.wma") returned 0 [0062.816] lstrlenA (lpString="*.wma") returned 5 [0062.816] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.ac3") returned 0 [0062.816] lstrlenA (lpString="*.ac3") returned 5 [0062.816] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\stop.ico", pszSpec="*.doc") returned 0 [0062.816] lstrlenA (lpString="*.doc") returned 5 [0062.816] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0062.816] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.816] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SysReqMet.ico") returned -1 [0062.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SysReqMet.ico") returned -1 [0062.816] lstrcmpiA (lpString1="", lpString2="SysReqMet.ico") returned -1 [0062.816] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned="stop.ico" [0062.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.816] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.816] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.816] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.816] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="SysReqMet.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" [0062.816] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.zip") returned 0 [0062.816] lstrlenA (lpString="*.zip") returned 5 [0062.816] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.rar") returned 0 [0062.816] lstrlenA (lpString="*.rar") returned 5 [0062.816] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.7z") returned 0 [0062.816] lstrlenA (lpString="*.7z") returned 4 [0062.816] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.tar") returned 0 [0062.816] lstrlenA (lpString="*.tar") returned 5 [0062.816] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.gzip") returned 0 [0062.816] lstrlenA (lpString="*.gzip") returned 6 [0062.816] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.jpg") returned 0 [0062.816] lstrlenA (lpString="*.jpg") returned 5 [0062.816] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.jpeg") returned 0 [0062.817] lstrlenA (lpString="*.jpeg") returned 6 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.psd") returned 0 [0062.817] lstrlenA (lpString="*.psd") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.cdr") returned 0 [0062.817] lstrlenA (lpString="*.cdr") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.dwg") returned 0 [0062.817] lstrlenA (lpString="*.dwg") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.max") returned 0 [0062.817] lstrlenA (lpString="*.max") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.bmp") returned 0 [0062.817] lstrlenA (lpString="*.bmp") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.gif") returned 0 [0062.817] lstrlenA (lpString="*.gif") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.png") returned 0 [0062.817] lstrlenA (lpString="*.png") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.doc") returned 0 [0062.817] lstrlenA (lpString="*.doc") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.docx") returned 0 [0062.817] lstrlenA (lpString="*.docx") returned 6 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.xls") returned 0 [0062.817] lstrlenA (lpString="*.xls") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.xlsx") returned 0 [0062.817] lstrlenA (lpString="*.xlsx") returned 6 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.ppt") returned 0 [0062.817] lstrlenA (lpString="*.ppt") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.pptx") returned 0 [0062.817] lstrlenA (lpString="*.pptx") returned 6 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.txt") returned 0 [0062.817] lstrlenA (lpString="*.txt") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.pdf") returned 0 [0062.817] lstrlenA (lpString="*.pdf") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.djvu") returned 0 [0062.817] lstrlenA (lpString="*.djvu") returned 6 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.htm") returned 0 [0062.817] lstrlenA (lpString="*.htm") returned 5 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.html") returned 0 [0062.817] lstrlenA (lpString="*.html") returned 6 [0062.817] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mdb") returned 0 [0062.818] lstrlenA (lpString="*.mdb") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.cer") returned 0 [0062.818] lstrlenA (lpString="*.cer") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.p12") returned 0 [0062.818] lstrlenA (lpString="*.p12") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.pfx") returned 0 [0062.818] lstrlenA (lpString="*.pfx") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.kwm") returned 0 [0062.818] lstrlenA (lpString="*.kwm") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.pwm") returned 0 [0062.818] lstrlenA (lpString="*.pwm") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.1cd") returned 0 [0062.818] lstrlenA (lpString="*.1cd") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.md") returned 0 [0062.818] lstrlenA (lpString="*.md") returned 4 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mdf") returned 0 [0062.818] lstrlenA (lpString="*.mdf") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.dbf") returned 0 [0062.818] lstrlenA (lpString="*.dbf") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.odt") returned 0 [0062.818] lstrlenA (lpString="*.odt") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.vob") returned 0 [0062.818] lstrlenA (lpString="*.vob") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.ifo") returned 0 [0062.818] lstrlenA (lpString="*.ifo") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.lnk") returned 0 [0062.818] lstrlenA (lpString="*.lnk") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.torrent") returned 0 [0062.818] lstrlenA (lpString="*.torrent") returned 9 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mov") returned 0 [0062.818] lstrlenA (lpString="*.mov") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.m2v") returned 0 [0062.818] lstrlenA (lpString="*.m2v") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.3gp") returned 0 [0062.818] lstrlenA (lpString="*.3gp") returned 5 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mpeg") returned 0 [0062.818] lstrlenA (lpString="*.mpeg") returned 6 [0062.818] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mpg") returned 0 [0062.819] lstrlenA (lpString="*.mpg") returned 5 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.flv") returned 0 [0062.819] lstrlenA (lpString="*.flv") returned 5 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.avi") returned 0 [0062.819] lstrlenA (lpString="*.avi") returned 5 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mp4") returned 0 [0062.819] lstrlenA (lpString="*.mp4") returned 5 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.wmv") returned 0 [0062.819] lstrlenA (lpString="*.wmv") returned 5 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.divx") returned 0 [0062.819] lstrlenA (lpString="*.divx") returned 6 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mkv") returned 0 [0062.819] lstrlenA (lpString="*.mkv") returned 5 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.mp3") returned 0 [0062.819] lstrlenA (lpString="*.mp3") returned 5 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.wav") returned 0 [0062.819] lstrlenA (lpString="*.wav") returned 5 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.flac") returned 0 [0062.819] lstrlenA (lpString="*.flac") returned 6 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.ape") returned 0 [0062.819] lstrlenA (lpString="*.ape") returned 5 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.wma") returned 0 [0062.819] lstrlenA (lpString="*.wma") returned 5 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.ac3") returned 0 [0062.819] lstrlenA (lpString="*.ac3") returned 5 [0062.819] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", pszSpec="*.doc") returned 0 [0062.819] lstrlenA (lpString="*.doc") returned 5 [0062.819] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0062.819] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.819] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SysReqNotMet.ico") returned -1 [0062.819] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SysReqNotMet.ico") returned -1 [0062.819] lstrcmpiA (lpString1="", lpString2="SysReqNotMet.ico") returned -1 [0062.819] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned="SysReqMet.ico" [0062.819] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.819] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.819] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.819] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.820] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="SysReqNotMet.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.zip") returned 0 [0062.820] lstrlenA (lpString="*.zip") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.rar") returned 0 [0062.820] lstrlenA (lpString="*.rar") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.7z") returned 0 [0062.820] lstrlenA (lpString="*.7z") returned 4 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.tar") returned 0 [0062.820] lstrlenA (lpString="*.tar") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.gzip") returned 0 [0062.820] lstrlenA (lpString="*.gzip") returned 6 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.jpg") returned 0 [0062.820] lstrlenA (lpString="*.jpg") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.jpeg") returned 0 [0062.820] lstrlenA (lpString="*.jpeg") returned 6 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.psd") returned 0 [0062.820] lstrlenA (lpString="*.psd") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.cdr") returned 0 [0062.820] lstrlenA (lpString="*.cdr") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.dwg") returned 0 [0062.820] lstrlenA (lpString="*.dwg") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.max") returned 0 [0062.820] lstrlenA (lpString="*.max") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.bmp") returned 0 [0062.820] lstrlenA (lpString="*.bmp") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.gif") returned 0 [0062.820] lstrlenA (lpString="*.gif") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.png") returned 0 [0062.820] lstrlenA (lpString="*.png") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.doc") returned 0 [0062.820] lstrlenA (lpString="*.doc") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.docx") returned 0 [0062.820] lstrlenA (lpString="*.docx") returned 6 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.xls") returned 0 [0062.820] lstrlenA (lpString="*.xls") returned 5 [0062.820] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.xlsx") returned 0 [0062.821] lstrlenA (lpString="*.xlsx") returned 6 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.ppt") returned 0 [0062.821] lstrlenA (lpString="*.ppt") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.pptx") returned 0 [0062.821] lstrlenA (lpString="*.pptx") returned 6 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.txt") returned 0 [0062.821] lstrlenA (lpString="*.txt") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.pdf") returned 0 [0062.821] lstrlenA (lpString="*.pdf") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.djvu") returned 0 [0062.821] lstrlenA (lpString="*.djvu") returned 6 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.htm") returned 0 [0062.821] lstrlenA (lpString="*.htm") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.html") returned 0 [0062.821] lstrlenA (lpString="*.html") returned 6 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mdb") returned 0 [0062.821] lstrlenA (lpString="*.mdb") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.cer") returned 0 [0062.821] lstrlenA (lpString="*.cer") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.p12") returned 0 [0062.821] lstrlenA (lpString="*.p12") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.pfx") returned 0 [0062.821] lstrlenA (lpString="*.pfx") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.kwm") returned 0 [0062.821] lstrlenA (lpString="*.kwm") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.pwm") returned 0 [0062.821] lstrlenA (lpString="*.pwm") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.1cd") returned 0 [0062.821] lstrlenA (lpString="*.1cd") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.md") returned 0 [0062.821] lstrlenA (lpString="*.md") returned 4 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mdf") returned 0 [0062.821] lstrlenA (lpString="*.mdf") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.dbf") returned 0 [0062.821] lstrlenA (lpString="*.dbf") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.odt") returned 0 [0062.821] lstrlenA (lpString="*.odt") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.vob") returned 0 [0062.822] lstrlenA (lpString="*.vob") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.ifo") returned 0 [0062.822] lstrlenA (lpString="*.ifo") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.lnk") returned 0 [0062.822] lstrlenA (lpString="*.lnk") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.torrent") returned 0 [0062.822] lstrlenA (lpString="*.torrent") returned 9 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mov") returned 0 [0062.822] lstrlenA (lpString="*.mov") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.m2v") returned 0 [0062.822] lstrlenA (lpString="*.m2v") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.3gp") returned 0 [0062.822] lstrlenA (lpString="*.3gp") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mpeg") returned 0 [0062.822] lstrlenA (lpString="*.mpeg") returned 6 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mpg") returned 0 [0062.822] lstrlenA (lpString="*.mpg") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.flv") returned 0 [0062.822] lstrlenA (lpString="*.flv") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.avi") returned 0 [0062.822] lstrlenA (lpString="*.avi") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mp4") returned 0 [0062.822] lstrlenA (lpString="*.mp4") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.wmv") returned 0 [0062.822] lstrlenA (lpString="*.wmv") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.divx") returned 0 [0062.822] lstrlenA (lpString="*.divx") returned 6 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mkv") returned 0 [0062.822] lstrlenA (lpString="*.mkv") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.mp3") returned 0 [0062.822] lstrlenA (lpString="*.mp3") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.wav") returned 0 [0062.822] lstrlenA (lpString="*.wav") returned 5 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.flac") returned 0 [0062.822] lstrlenA (lpString="*.flac") returned 6 [0062.822] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.ape") returned 0 [0062.822] lstrlenA (lpString="*.ape") returned 5 [0062.823] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.wma") returned 0 [0062.823] lstrlenA (lpString="*.wma") returned 5 [0062.823] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.ac3") returned 0 [0062.823] lstrlenA (lpString="*.ac3") returned 5 [0062.823] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", pszSpec="*.doc") returned 0 [0062.823] lstrlenA (lpString="*.doc") returned 5 [0062.823] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0062.823] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.823] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="warn.ico") returned -1 [0062.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="warn.ico") returned -1 [0062.823] lstrcmpiA (lpString1="", lpString2="warn.ico") returned -1 [0062.823] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned="SysReqNotMet.ico" [0062.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0062.823] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\Graphics\\" | out: pszPath="C:\\588bce7c90097ed212\\Graphics\\") returned="" [0062.823] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" [0062.823] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to decrypt files.txt")) returned 0x20 [0062.823] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="warn.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned="C:\\588bce7c90097ed212\\Graphics\\warn.ico" [0062.823] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.zip") returned 0 [0062.823] lstrlenA (lpString="*.zip") returned 5 [0062.823] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.rar") returned 0 [0062.823] lstrlenA (lpString="*.rar") returned 5 [0062.823] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.7z") returned 0 [0062.823] lstrlenA (lpString="*.7z") returned 4 [0062.823] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.tar") returned 0 [0062.823] lstrlenA (lpString="*.tar") returned 5 [0062.823] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.gzip") returned 0 [0062.823] lstrlenA (lpString="*.gzip") returned 6 [0062.823] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.jpg") returned 0 [0062.823] lstrlenA (lpString="*.jpg") returned 5 [0062.823] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.jpeg") returned 0 [0062.823] lstrlenA (lpString="*.jpeg") returned 6 [0062.823] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.psd") returned 0 [0062.823] lstrlenA (lpString="*.psd") returned 5 [0062.823] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.cdr") returned 0 [0062.823] lstrlenA (lpString="*.cdr") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.dwg") returned 0 [0062.824] lstrlenA (lpString="*.dwg") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.max") returned 0 [0062.824] lstrlenA (lpString="*.max") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.bmp") returned 0 [0062.824] lstrlenA (lpString="*.bmp") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.gif") returned 0 [0062.824] lstrlenA (lpString="*.gif") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.png") returned 0 [0062.824] lstrlenA (lpString="*.png") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.doc") returned 0 [0062.824] lstrlenA (lpString="*.doc") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.docx") returned 0 [0062.824] lstrlenA (lpString="*.docx") returned 6 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.xls") returned 0 [0062.824] lstrlenA (lpString="*.xls") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.xlsx") returned 0 [0062.824] lstrlenA (lpString="*.xlsx") returned 6 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.ppt") returned 0 [0062.824] lstrlenA (lpString="*.ppt") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.pptx") returned 0 [0062.824] lstrlenA (lpString="*.pptx") returned 6 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.txt") returned 0 [0062.824] lstrlenA (lpString="*.txt") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.pdf") returned 0 [0062.824] lstrlenA (lpString="*.pdf") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.djvu") returned 0 [0062.824] lstrlenA (lpString="*.djvu") returned 6 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.htm") returned 0 [0062.824] lstrlenA (lpString="*.htm") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.html") returned 0 [0062.824] lstrlenA (lpString="*.html") returned 6 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mdb") returned 0 [0062.824] lstrlenA (lpString="*.mdb") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.cer") returned 0 [0062.824] lstrlenA (lpString="*.cer") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.p12") returned 0 [0062.824] lstrlenA (lpString="*.p12") returned 5 [0062.824] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.pfx") returned 0 [0062.825] lstrlenA (lpString="*.pfx") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.kwm") returned 0 [0062.825] lstrlenA (lpString="*.kwm") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.pwm") returned 0 [0062.825] lstrlenA (lpString="*.pwm") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.1cd") returned 0 [0062.825] lstrlenA (lpString="*.1cd") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.md") returned 0 [0062.825] lstrlenA (lpString="*.md") returned 4 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mdf") returned 0 [0062.825] lstrlenA (lpString="*.mdf") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.dbf") returned 0 [0062.825] lstrlenA (lpString="*.dbf") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.odt") returned 0 [0062.825] lstrlenA (lpString="*.odt") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.vob") returned 0 [0062.825] lstrlenA (lpString="*.vob") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.ifo") returned 0 [0062.825] lstrlenA (lpString="*.ifo") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.lnk") returned 0 [0062.825] lstrlenA (lpString="*.lnk") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.torrent") returned 0 [0062.825] lstrlenA (lpString="*.torrent") returned 9 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mov") returned 0 [0062.825] lstrlenA (lpString="*.mov") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.m2v") returned 0 [0062.825] lstrlenA (lpString="*.m2v") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.3gp") returned 0 [0062.825] lstrlenA (lpString="*.3gp") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mpeg") returned 0 [0062.825] lstrlenA (lpString="*.mpeg") returned 6 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mpg") returned 0 [0062.825] lstrlenA (lpString="*.mpg") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.flv") returned 0 [0062.825] lstrlenA (lpString="*.flv") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.avi") returned 0 [0062.825] lstrlenA (lpString="*.avi") returned 5 [0062.825] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mp4") returned 0 [0062.826] lstrlenA (lpString="*.mp4") returned 5 [0062.826] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.wmv") returned 0 [0062.826] lstrlenA (lpString="*.wmv") returned 5 [0062.826] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.divx") returned 0 [0062.826] lstrlenA (lpString="*.divx") returned 6 [0062.826] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mkv") returned 0 [0062.826] lstrlenA (lpString="*.mkv") returned 5 [0062.826] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.mp3") returned 0 [0062.826] lstrlenA (lpString="*.mp3") returned 5 [0062.826] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.wav") returned 0 [0062.826] lstrlenA (lpString="*.wav") returned 5 [0062.826] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.flac") returned 0 [0062.826] lstrlenA (lpString="*.flac") returned 6 [0062.826] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.ape") returned 0 [0062.826] lstrlenA (lpString="*.ape") returned 5 [0062.826] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.wma") returned 0 [0062.826] lstrlenA (lpString="*.wma") returned 5 [0062.826] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.ac3") returned 0 [0062.826] lstrlenA (lpString="*.ac3") returned 5 [0062.826] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Graphics\\warn.ico", pszSpec="*.doc") returned 0 [0062.826] lstrlenA (lpString="*.doc") returned 5 [0062.826] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0062.826] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0062.826] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0062.826] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.826] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="header.bmp") returned -1 [0062.826] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="header.bmp") returned 1 [0062.826] lstrcmpiA (lpString1="", lpString2="header.bmp") returned -1 [0062.826] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\*.*") returned="*.*" [0062.826] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.826] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.827] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.827] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.827] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="header.bmp" | out: lpString1="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp" [0062.827] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.zip") returned 0 [0062.827] lstrlenA (lpString="*.zip") returned 5 [0062.827] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.rar") returned 0 [0062.827] lstrlenA (lpString="*.rar") returned 5 [0062.827] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.7z") returned 0 [0062.827] lstrlenA (lpString="*.7z") returned 4 [0062.828] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.tar") returned 0 [0062.828] lstrlenA (lpString="*.tar") returned 5 [0062.828] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.gzip") returned 0 [0062.828] lstrlenA (lpString="*.gzip") returned 6 [0062.828] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.jpg") returned 0 [0062.828] lstrlenA (lpString="*.jpg") returned 5 [0062.828] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.jpeg") returned 0 [0062.828] lstrlenA (lpString="*.jpeg") returned 6 [0062.828] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.psd") returned 0 [0062.828] lstrlenA (lpString="*.psd") returned 5 [0062.828] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.cdr") returned 0 [0062.828] lstrlenA (lpString="*.cdr") returned 5 [0062.828] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.dwg") returned 0 [0062.828] lstrlenA (lpString="*.dwg") returned 5 [0062.828] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.max") returned 0 [0062.828] lstrlenA (lpString="*.max") returned 5 [0062.828] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\header.bmp", pszSpec="*.bmp") returned 1 [0062.828] lstrlenA (lpString="*.bmp") returned 5 [0062.828] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\588bce7c90097ed212\\header.bmp" | out: lpString1="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp" [0062.828] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\588bce7c90097ed212\\header.bmp" | out: lpString1="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp" [0062.828] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\header.bmp", lpString2="." | out: lpString1="C:\\588bce7c90097ed212\\header.bmp.") returned="C:\\588bce7c90097ed212\\header.bmp." [0062.828] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\header.bmp.", lpString2="EnCiPhErEd" | out: lpString1="C:\\588bce7c90097ed212\\header.bmp.EnCiPhErEd") returned="C:\\588bce7c90097ed212\\header.bmp.EnCiPhErEd" [0062.828] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.829] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2c [0062.829] GetFileTime (in: hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x87910600, dwHighDateTime=0x1ca2a27), lpLastAccessTime=0x407536*(dwLowDateTime=0x87910600, dwHighDateTime=0x1ca2a27), lpLastWriteTime=0x40753e*(dwLowDateTime=0x87910600, dwHighDateTime=0x1ca2a27)) returned 1 [0062.829] SetFilePointer (in: hFile=0x204, lDistanceToMove=124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c [0062.829] ReadFile (in: hFile=0x204, lpBuffer=0x2143020, nNumberOfBytesToRead=0x1a8bf8, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2143020*, lpNumberOfBytesRead=0x40655d*=0xdb0, lpOverlapped=0x0) returned 1 [0062.831] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\header.bmp") returned="header.bmp" [0062.831] SetFilePointer (in: hFile=0x204, lDistanceToMove=124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c [0062.831] WriteFile (in: hFile=0x204, lpBuffer=0x2143020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2143020*, lpNumberOfBytesWritten=0x406561*=0xdb0, lpOverlapped=0x0) returned 1 [0062.832] SetFileTime (hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.832] CloseHandle (hObject=0x204) returned 1 [0062.833] MoveFileA (lpExistingFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\header.bmp.EnCiPhErEd" (normalized: "c:\\588bce7c90097ed212\\header.bmp.enciphered")) returned 1 [0062.833] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0xf, dwReserved1=0x1, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0062.833] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.833] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="netfx_Core.mzz") returned -1 [0062.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="netfx_Core.mzz") returned -1 [0062.833] lstrcmpiA (lpString1="", lpString2="netfx_Core.mzz") returned -1 [0062.833] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\header.bmp") returned="header.bmp" [0062.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.833] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.833] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.833] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.834] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Core.mzz" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz" [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.zip") returned 0 [0062.834] lstrlenA (lpString="*.zip") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.rar") returned 0 [0062.834] lstrlenA (lpString="*.rar") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.7z") returned 0 [0062.834] lstrlenA (lpString="*.7z") returned 4 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.tar") returned 0 [0062.834] lstrlenA (lpString="*.tar") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.gzip") returned 0 [0062.834] lstrlenA (lpString="*.gzip") returned 6 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.jpg") returned 0 [0062.834] lstrlenA (lpString="*.jpg") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.jpeg") returned 0 [0062.834] lstrlenA (lpString="*.jpeg") returned 6 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.psd") returned 0 [0062.834] lstrlenA (lpString="*.psd") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.cdr") returned 0 [0062.834] lstrlenA (lpString="*.cdr") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.dwg") returned 0 [0062.834] lstrlenA (lpString="*.dwg") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.max") returned 0 [0062.834] lstrlenA (lpString="*.max") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.bmp") returned 0 [0062.834] lstrlenA (lpString="*.bmp") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.gif") returned 0 [0062.834] lstrlenA (lpString="*.gif") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.png") returned 0 [0062.834] lstrlenA (lpString="*.png") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.doc") returned 0 [0062.834] lstrlenA (lpString="*.doc") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.docx") returned 0 [0062.834] lstrlenA (lpString="*.docx") returned 6 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.xls") returned 0 [0062.834] lstrlenA (lpString="*.xls") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.xlsx") returned 0 [0062.834] lstrlenA (lpString="*.xlsx") returned 6 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.ppt") returned 0 [0062.835] lstrlenA (lpString="*.ppt") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.pptx") returned 0 [0062.835] lstrlenA (lpString="*.pptx") returned 6 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.txt") returned 0 [0062.835] lstrlenA (lpString="*.txt") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.pdf") returned 0 [0062.835] lstrlenA (lpString="*.pdf") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.djvu") returned 0 [0062.835] lstrlenA (lpString="*.djvu") returned 6 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.htm") returned 0 [0062.835] lstrlenA (lpString="*.htm") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.html") returned 0 [0062.835] lstrlenA (lpString="*.html") returned 6 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mdb") returned 0 [0062.835] lstrlenA (lpString="*.mdb") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.cer") returned 0 [0062.835] lstrlenA (lpString="*.cer") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.p12") returned 0 [0062.835] lstrlenA (lpString="*.p12") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.pfx") returned 0 [0062.835] lstrlenA (lpString="*.pfx") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.kwm") returned 0 [0062.835] lstrlenA (lpString="*.kwm") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.pwm") returned 0 [0062.835] lstrlenA (lpString="*.pwm") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.1cd") returned 0 [0062.835] lstrlenA (lpString="*.1cd") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.md") returned 0 [0062.835] lstrlenA (lpString="*.md") returned 4 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mdf") returned 0 [0062.835] lstrlenA (lpString="*.mdf") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.dbf") returned 0 [0062.835] lstrlenA (lpString="*.dbf") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.odt") returned 0 [0062.835] lstrlenA (lpString="*.odt") returned 5 [0062.835] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.vob") returned 0 [0062.835] lstrlenA (lpString="*.vob") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.ifo") returned 0 [0062.836] lstrlenA (lpString="*.ifo") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.lnk") returned 0 [0062.836] lstrlenA (lpString="*.lnk") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.torrent") returned 0 [0062.836] lstrlenA (lpString="*.torrent") returned 9 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mov") returned 0 [0062.836] lstrlenA (lpString="*.mov") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.m2v") returned 0 [0062.836] lstrlenA (lpString="*.m2v") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.3gp") returned 0 [0062.836] lstrlenA (lpString="*.3gp") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mpeg") returned 0 [0062.836] lstrlenA (lpString="*.mpeg") returned 6 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mpg") returned 0 [0062.836] lstrlenA (lpString="*.mpg") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.flv") returned 0 [0062.836] lstrlenA (lpString="*.flv") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.avi") returned 0 [0062.836] lstrlenA (lpString="*.avi") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mp4") returned 0 [0062.836] lstrlenA (lpString="*.mp4") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.wmv") returned 0 [0062.836] lstrlenA (lpString="*.wmv") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.divx") returned 0 [0062.836] lstrlenA (lpString="*.divx") returned 6 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mkv") returned 0 [0062.836] lstrlenA (lpString="*.mkv") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.mp3") returned 0 [0062.836] lstrlenA (lpString="*.mp3") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.wav") returned 0 [0062.836] lstrlenA (lpString="*.wav") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.flac") returned 0 [0062.836] lstrlenA (lpString="*.flac") returned 6 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.ape") returned 0 [0062.836] lstrlenA (lpString="*.ape") returned 5 [0062.836] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.wma") returned 0 [0062.836] lstrlenA (lpString="*.wma") returned 5 [0062.837] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.ac3") returned 0 [0062.837] lstrlenA (lpString="*.ac3") returned 5 [0062.837] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core.mzz", pszSpec="*.doc") returned 0 [0062.837] lstrlenA (lpString="*.doc") returned 5 [0062.837] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0062.837] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.837] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="netfx_Core_x64.msi") returned -1 [0062.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="netfx_Core_x64.msi") returned -1 [0062.837] lstrcmpiA (lpString1="", lpString2="netfx_Core_x64.msi") returned -1 [0062.837] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned="netfx_Core.mzz" [0062.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.837] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.837] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.837] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.837] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Core_x64.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" [0062.837] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.zip") returned 0 [0062.837] lstrlenA (lpString="*.zip") returned 5 [0062.837] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.rar") returned 0 [0062.837] lstrlenA (lpString="*.rar") returned 5 [0062.837] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.7z") returned 0 [0062.837] lstrlenA (lpString="*.7z") returned 4 [0062.837] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.tar") returned 0 [0062.837] lstrlenA (lpString="*.tar") returned 5 [0062.837] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.gzip") returned 0 [0062.837] lstrlenA (lpString="*.gzip") returned 6 [0062.837] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.jpg") returned 0 [0062.837] lstrlenA (lpString="*.jpg") returned 5 [0062.837] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.jpeg") returned 0 [0062.837] lstrlenA (lpString="*.jpeg") returned 6 [0062.837] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.psd") returned 0 [0062.837] lstrlenA (lpString="*.psd") returned 5 [0062.837] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.cdr") returned 0 [0062.837] lstrlenA (lpString="*.cdr") returned 5 [0062.837] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.dwg") returned 0 [0062.838] lstrlenA (lpString="*.dwg") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.max") returned 0 [0062.838] lstrlenA (lpString="*.max") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.bmp") returned 0 [0062.838] lstrlenA (lpString="*.bmp") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.gif") returned 0 [0062.838] lstrlenA (lpString="*.gif") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.png") returned 0 [0062.838] lstrlenA (lpString="*.png") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.doc") returned 0 [0062.838] lstrlenA (lpString="*.doc") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.docx") returned 0 [0062.838] lstrlenA (lpString="*.docx") returned 6 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.xls") returned 0 [0062.838] lstrlenA (lpString="*.xls") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.xlsx") returned 0 [0062.838] lstrlenA (lpString="*.xlsx") returned 6 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.ppt") returned 0 [0062.838] lstrlenA (lpString="*.ppt") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.pptx") returned 0 [0062.838] lstrlenA (lpString="*.pptx") returned 6 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.txt") returned 0 [0062.838] lstrlenA (lpString="*.txt") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.pdf") returned 0 [0062.838] lstrlenA (lpString="*.pdf") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.djvu") returned 0 [0062.838] lstrlenA (lpString="*.djvu") returned 6 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.htm") returned 0 [0062.838] lstrlenA (lpString="*.htm") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.html") returned 0 [0062.838] lstrlenA (lpString="*.html") returned 6 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mdb") returned 0 [0062.838] lstrlenA (lpString="*.mdb") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.cer") returned 0 [0062.838] lstrlenA (lpString="*.cer") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.p12") returned 0 [0062.838] lstrlenA (lpString="*.p12") returned 5 [0062.838] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.pfx") returned 0 [0062.839] lstrlenA (lpString="*.pfx") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.kwm") returned 0 [0062.839] lstrlenA (lpString="*.kwm") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.pwm") returned 0 [0062.839] lstrlenA (lpString="*.pwm") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.1cd") returned 0 [0062.839] lstrlenA (lpString="*.1cd") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.md") returned 0 [0062.839] lstrlenA (lpString="*.md") returned 4 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mdf") returned 0 [0062.839] lstrlenA (lpString="*.mdf") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.dbf") returned 0 [0062.839] lstrlenA (lpString="*.dbf") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.odt") returned 0 [0062.839] lstrlenA (lpString="*.odt") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.vob") returned 0 [0062.839] lstrlenA (lpString="*.vob") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.ifo") returned 0 [0062.839] lstrlenA (lpString="*.ifo") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.lnk") returned 0 [0062.839] lstrlenA (lpString="*.lnk") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.torrent") returned 0 [0062.839] lstrlenA (lpString="*.torrent") returned 9 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mov") returned 0 [0062.839] lstrlenA (lpString="*.mov") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.m2v") returned 0 [0062.839] lstrlenA (lpString="*.m2v") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.3gp") returned 0 [0062.839] lstrlenA (lpString="*.3gp") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mpeg") returned 0 [0062.839] lstrlenA (lpString="*.mpeg") returned 6 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mpg") returned 0 [0062.839] lstrlenA (lpString="*.mpg") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.flv") returned 0 [0062.839] lstrlenA (lpString="*.flv") returned 5 [0062.839] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.avi") returned 0 [0062.839] lstrlenA (lpString="*.avi") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mp4") returned 0 [0062.840] lstrlenA (lpString="*.mp4") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.wmv") returned 0 [0062.840] lstrlenA (lpString="*.wmv") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.divx") returned 0 [0062.840] lstrlenA (lpString="*.divx") returned 6 [0062.840] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mkv") returned 0 [0062.840] lstrlenA (lpString="*.mkv") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.mp3") returned 0 [0062.840] lstrlenA (lpString="*.mp3") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.wav") returned 0 [0062.840] lstrlenA (lpString="*.wav") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.flac") returned 0 [0062.840] lstrlenA (lpString="*.flac") returned 6 [0062.840] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.ape") returned 0 [0062.840] lstrlenA (lpString="*.ape") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.wma") returned 0 [0062.840] lstrlenA (lpString="*.wma") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.ac3") returned 0 [0062.840] lstrlenA (lpString="*.ac3") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", pszSpec="*.doc") returned 0 [0062.840] lstrlenA (lpString="*.doc") returned 5 [0062.840] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0062.840] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.840] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="netfx_Core_x86.msi") returned -1 [0062.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="netfx_Core_x86.msi") returned -1 [0062.840] lstrcmpiA (lpString1="", lpString2="netfx_Core_x86.msi") returned -1 [0062.840] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned="netfx_Core_x64.msi" [0062.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.840] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.840] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.840] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.840] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Core_x86.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" [0062.840] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.zip") returned 0 [0062.840] lstrlenA (lpString="*.zip") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.rar") returned 0 [0062.841] lstrlenA (lpString="*.rar") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.7z") returned 0 [0062.841] lstrlenA (lpString="*.7z") returned 4 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.tar") returned 0 [0062.841] lstrlenA (lpString="*.tar") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.gzip") returned 0 [0062.841] lstrlenA (lpString="*.gzip") returned 6 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.jpg") returned 0 [0062.841] lstrlenA (lpString="*.jpg") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.jpeg") returned 0 [0062.841] lstrlenA (lpString="*.jpeg") returned 6 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.psd") returned 0 [0062.841] lstrlenA (lpString="*.psd") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.cdr") returned 0 [0062.841] lstrlenA (lpString="*.cdr") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.dwg") returned 0 [0062.841] lstrlenA (lpString="*.dwg") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.max") returned 0 [0062.841] lstrlenA (lpString="*.max") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.bmp") returned 0 [0062.841] lstrlenA (lpString="*.bmp") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.gif") returned 0 [0062.841] lstrlenA (lpString="*.gif") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.png") returned 0 [0062.841] lstrlenA (lpString="*.png") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.doc") returned 0 [0062.841] lstrlenA (lpString="*.doc") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.docx") returned 0 [0062.841] lstrlenA (lpString="*.docx") returned 6 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.xls") returned 0 [0062.841] lstrlenA (lpString="*.xls") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.xlsx") returned 0 [0062.841] lstrlenA (lpString="*.xlsx") returned 6 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.ppt") returned 0 [0062.841] lstrlenA (lpString="*.ppt") returned 5 [0062.841] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.pptx") returned 0 [0062.842] lstrlenA (lpString="*.pptx") returned 6 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.txt") returned 0 [0062.842] lstrlenA (lpString="*.txt") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.pdf") returned 0 [0062.842] lstrlenA (lpString="*.pdf") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.djvu") returned 0 [0062.842] lstrlenA (lpString="*.djvu") returned 6 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.htm") returned 0 [0062.842] lstrlenA (lpString="*.htm") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.html") returned 0 [0062.842] lstrlenA (lpString="*.html") returned 6 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mdb") returned 0 [0062.842] lstrlenA (lpString="*.mdb") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.cer") returned 0 [0062.842] lstrlenA (lpString="*.cer") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.p12") returned 0 [0062.842] lstrlenA (lpString="*.p12") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.pfx") returned 0 [0062.842] lstrlenA (lpString="*.pfx") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.kwm") returned 0 [0062.842] lstrlenA (lpString="*.kwm") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.pwm") returned 0 [0062.842] lstrlenA (lpString="*.pwm") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.1cd") returned 0 [0062.842] lstrlenA (lpString="*.1cd") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.md") returned 0 [0062.842] lstrlenA (lpString="*.md") returned 4 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mdf") returned 0 [0062.842] lstrlenA (lpString="*.mdf") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.dbf") returned 0 [0062.842] lstrlenA (lpString="*.dbf") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.odt") returned 0 [0062.842] lstrlenA (lpString="*.odt") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.vob") returned 0 [0062.842] lstrlenA (lpString="*.vob") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.ifo") returned 0 [0062.842] lstrlenA (lpString="*.ifo") returned 5 [0062.842] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.lnk") returned 0 [0062.842] lstrlenA (lpString="*.lnk") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.torrent") returned 0 [0062.843] lstrlenA (lpString="*.torrent") returned 9 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mov") returned 0 [0062.843] lstrlenA (lpString="*.mov") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.m2v") returned 0 [0062.843] lstrlenA (lpString="*.m2v") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.3gp") returned 0 [0062.843] lstrlenA (lpString="*.3gp") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mpeg") returned 0 [0062.843] lstrlenA (lpString="*.mpeg") returned 6 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mpg") returned 0 [0062.843] lstrlenA (lpString="*.mpg") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.flv") returned 0 [0062.843] lstrlenA (lpString="*.flv") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.avi") returned 0 [0062.843] lstrlenA (lpString="*.avi") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mp4") returned 0 [0062.843] lstrlenA (lpString="*.mp4") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.wmv") returned 0 [0062.843] lstrlenA (lpString="*.wmv") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.divx") returned 0 [0062.843] lstrlenA (lpString="*.divx") returned 6 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mkv") returned 0 [0062.843] lstrlenA (lpString="*.mkv") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.mp3") returned 0 [0062.843] lstrlenA (lpString="*.mp3") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.wav") returned 0 [0062.843] lstrlenA (lpString="*.wav") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.flac") returned 0 [0062.843] lstrlenA (lpString="*.flac") returned 6 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.ape") returned 0 [0062.843] lstrlenA (lpString="*.ape") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.wma") returned 0 [0062.843] lstrlenA (lpString="*.wma") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.ac3") returned 0 [0062.843] lstrlenA (lpString="*.ac3") returned 5 [0062.843] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", pszSpec="*.doc") returned 0 [0062.843] lstrlenA (lpString="*.doc") returned 5 [0062.844] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0062.844] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="netfx_Extended.mzz") returned -1 [0062.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="netfx_Extended.mzz") returned -1 [0062.844] lstrcmpiA (lpString1="", lpString2="netfx_Extended.mzz") returned -1 [0062.844] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned="netfx_Core_x86.msi" [0062.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.844] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.844] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.844] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.844] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Extended.mzz" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz" [0062.844] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.zip") returned 0 [0062.844] lstrlenA (lpString="*.zip") returned 5 [0062.844] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.rar") returned 0 [0062.844] lstrlenA (lpString="*.rar") returned 5 [0062.844] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.7z") returned 0 [0062.844] lstrlenA (lpString="*.7z") returned 4 [0062.844] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.tar") returned 0 [0062.844] lstrlenA (lpString="*.tar") returned 5 [0062.844] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.gzip") returned 0 [0062.844] lstrlenA (lpString="*.gzip") returned 6 [0062.844] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.jpg") returned 0 [0062.844] lstrlenA (lpString="*.jpg") returned 5 [0062.844] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.jpeg") returned 0 [0062.844] lstrlenA (lpString="*.jpeg") returned 6 [0062.844] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.psd") returned 0 [0062.844] lstrlenA (lpString="*.psd") returned 5 [0062.844] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.cdr") returned 0 [0062.845] lstrlenA (lpString="*.cdr") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.dwg") returned 0 [0062.845] lstrlenA (lpString="*.dwg") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.max") returned 0 [0062.845] lstrlenA (lpString="*.max") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.bmp") returned 0 [0062.845] lstrlenA (lpString="*.bmp") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.gif") returned 0 [0062.845] lstrlenA (lpString="*.gif") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.png") returned 0 [0062.845] lstrlenA (lpString="*.png") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.doc") returned 0 [0062.845] lstrlenA (lpString="*.doc") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.docx") returned 0 [0062.845] lstrlenA (lpString="*.docx") returned 6 [0062.845] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.xls") returned 0 [0062.845] lstrlenA (lpString="*.xls") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.xlsx") returned 0 [0062.845] lstrlenA (lpString="*.xlsx") returned 6 [0062.845] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.ppt") returned 0 [0062.845] lstrlenA (lpString="*.ppt") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.pptx") returned 0 [0062.845] lstrlenA (lpString="*.pptx") returned 6 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.txt") returned 0 [0062.846] lstrlenA (lpString="*.txt") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.pdf") returned 0 [0062.846] lstrlenA (lpString="*.pdf") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.djvu") returned 0 [0062.846] lstrlenA (lpString="*.djvu") returned 6 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.htm") returned 0 [0062.846] lstrlenA (lpString="*.htm") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.html") returned 0 [0062.846] lstrlenA (lpString="*.html") returned 6 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mdb") returned 0 [0062.846] lstrlenA (lpString="*.mdb") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.cer") returned 0 [0062.846] lstrlenA (lpString="*.cer") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.p12") returned 0 [0062.846] lstrlenA (lpString="*.p12") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.pfx") returned 0 [0062.846] lstrlenA (lpString="*.pfx") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.kwm") returned 0 [0062.846] lstrlenA (lpString="*.kwm") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.pwm") returned 0 [0062.846] lstrlenA (lpString="*.pwm") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.1cd") returned 0 [0062.846] lstrlenA (lpString="*.1cd") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.md") returned 0 [0062.846] lstrlenA (lpString="*.md") returned 4 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mdf") returned 0 [0062.846] lstrlenA (lpString="*.mdf") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.dbf") returned 0 [0062.846] lstrlenA (lpString="*.dbf") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.odt") returned 0 [0062.846] lstrlenA (lpString="*.odt") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.vob") returned 0 [0062.846] lstrlenA (lpString="*.vob") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.ifo") returned 0 [0062.846] lstrlenA (lpString="*.ifo") returned 5 [0062.846] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.lnk") returned 0 [0062.846] lstrlenA (lpString="*.lnk") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.torrent") returned 0 [0062.847] lstrlenA (lpString="*.torrent") returned 9 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mov") returned 0 [0062.847] lstrlenA (lpString="*.mov") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.m2v") returned 0 [0062.847] lstrlenA (lpString="*.m2v") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.3gp") returned 0 [0062.847] lstrlenA (lpString="*.3gp") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mpeg") returned 0 [0062.847] lstrlenA (lpString="*.mpeg") returned 6 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mpg") returned 0 [0062.847] lstrlenA (lpString="*.mpg") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.flv") returned 0 [0062.847] lstrlenA (lpString="*.flv") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.avi") returned 0 [0062.847] lstrlenA (lpString="*.avi") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mp4") returned 0 [0062.847] lstrlenA (lpString="*.mp4") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.wmv") returned 0 [0062.847] lstrlenA (lpString="*.wmv") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.divx") returned 0 [0062.847] lstrlenA (lpString="*.divx") returned 6 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mkv") returned 0 [0062.847] lstrlenA (lpString="*.mkv") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.mp3") returned 0 [0062.847] lstrlenA (lpString="*.mp3") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.wav") returned 0 [0062.847] lstrlenA (lpString="*.wav") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.flac") returned 0 [0062.847] lstrlenA (lpString="*.flac") returned 6 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.ape") returned 0 [0062.847] lstrlenA (lpString="*.ape") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.wma") returned 0 [0062.847] lstrlenA (lpString="*.wma") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.ac3") returned 0 [0062.847] lstrlenA (lpString="*.ac3") returned 5 [0062.847] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended.mzz", pszSpec="*.doc") returned 0 [0062.847] lstrlenA (lpString="*.doc") returned 5 [0062.848] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0062.848] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.848] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="netfx_Extended_x64.msi") returned -1 [0062.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="netfx_Extended_x64.msi") returned -1 [0062.848] lstrcmpiA (lpString1="", lpString2="netfx_Extended_x64.msi") returned -1 [0062.848] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned="netfx_Extended.mzz" [0062.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.848] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.848] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.848] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.848] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Extended_x64.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" [0062.848] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.zip") returned 0 [0062.848] lstrlenA (lpString="*.zip") returned 5 [0062.848] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.rar") returned 0 [0062.848] lstrlenA (lpString="*.rar") returned 5 [0062.848] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.7z") returned 0 [0062.848] lstrlenA (lpString="*.7z") returned 4 [0062.848] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.tar") returned 0 [0062.848] lstrlenA (lpString="*.tar") returned 5 [0062.848] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.gzip") returned 0 [0062.848] lstrlenA (lpString="*.gzip") returned 6 [0062.848] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.jpg") returned 0 [0062.848] lstrlenA (lpString="*.jpg") returned 5 [0062.848] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.jpeg") returned 0 [0062.848] lstrlenA (lpString="*.jpeg") returned 6 [0062.848] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.psd") returned 0 [0062.848] lstrlenA (lpString="*.psd") returned 5 [0062.848] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.cdr") returned 0 [0062.848] lstrlenA (lpString="*.cdr") returned 5 [0062.848] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.dwg") returned 0 [0062.848] lstrlenA (lpString="*.dwg") returned 5 [0062.848] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.max") returned 0 [0062.848] lstrlenA (lpString="*.max") returned 5 [0062.848] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.bmp") returned 0 [0062.849] lstrlenA (lpString="*.bmp") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.gif") returned 0 [0062.849] lstrlenA (lpString="*.gif") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.png") returned 0 [0062.849] lstrlenA (lpString="*.png") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.doc") returned 0 [0062.849] lstrlenA (lpString="*.doc") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.docx") returned 0 [0062.849] lstrlenA (lpString="*.docx") returned 6 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.xls") returned 0 [0062.849] lstrlenA (lpString="*.xls") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.xlsx") returned 0 [0062.849] lstrlenA (lpString="*.xlsx") returned 6 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.ppt") returned 0 [0062.849] lstrlenA (lpString="*.ppt") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.pptx") returned 0 [0062.849] lstrlenA (lpString="*.pptx") returned 6 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.txt") returned 0 [0062.849] lstrlenA (lpString="*.txt") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.pdf") returned 0 [0062.849] lstrlenA (lpString="*.pdf") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.djvu") returned 0 [0062.849] lstrlenA (lpString="*.djvu") returned 6 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.htm") returned 0 [0062.849] lstrlenA (lpString="*.htm") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.html") returned 0 [0062.849] lstrlenA (lpString="*.html") returned 6 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mdb") returned 0 [0062.849] lstrlenA (lpString="*.mdb") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.cer") returned 0 [0062.849] lstrlenA (lpString="*.cer") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.p12") returned 0 [0062.849] lstrlenA (lpString="*.p12") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.pfx") returned 0 [0062.849] lstrlenA (lpString="*.pfx") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.kwm") returned 0 [0062.849] lstrlenA (lpString="*.kwm") returned 5 [0062.849] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.pwm") returned 0 [0062.850] lstrlenA (lpString="*.pwm") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.1cd") returned 0 [0062.850] lstrlenA (lpString="*.1cd") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.md") returned 0 [0062.850] lstrlenA (lpString="*.md") returned 4 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mdf") returned 0 [0062.850] lstrlenA (lpString="*.mdf") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.dbf") returned 0 [0062.850] lstrlenA (lpString="*.dbf") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.odt") returned 0 [0062.850] lstrlenA (lpString="*.odt") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.vob") returned 0 [0062.850] lstrlenA (lpString="*.vob") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.ifo") returned 0 [0062.850] lstrlenA (lpString="*.ifo") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.lnk") returned 0 [0062.850] lstrlenA (lpString="*.lnk") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.torrent") returned 0 [0062.850] lstrlenA (lpString="*.torrent") returned 9 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mov") returned 0 [0062.850] lstrlenA (lpString="*.mov") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.m2v") returned 0 [0062.850] lstrlenA (lpString="*.m2v") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.3gp") returned 0 [0062.850] lstrlenA (lpString="*.3gp") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mpeg") returned 0 [0062.850] lstrlenA (lpString="*.mpeg") returned 6 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mpg") returned 0 [0062.850] lstrlenA (lpString="*.mpg") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.flv") returned 0 [0062.850] lstrlenA (lpString="*.flv") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.avi") returned 0 [0062.850] lstrlenA (lpString="*.avi") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mp4") returned 0 [0062.850] lstrlenA (lpString="*.mp4") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.wmv") returned 0 [0062.850] lstrlenA (lpString="*.wmv") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.divx") returned 0 [0062.851] lstrlenA (lpString="*.divx") returned 6 [0062.851] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mkv") returned 0 [0062.851] lstrlenA (lpString="*.mkv") returned 5 [0062.851] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.mp3") returned 0 [0062.851] lstrlenA (lpString="*.mp3") returned 5 [0062.851] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.wav") returned 0 [0062.851] lstrlenA (lpString="*.wav") returned 5 [0062.851] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.flac") returned 0 [0062.851] lstrlenA (lpString="*.flac") returned 6 [0062.851] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.ape") returned 0 [0062.851] lstrlenA (lpString="*.ape") returned 5 [0062.851] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.wma") returned 0 [0062.851] lstrlenA (lpString="*.wma") returned 5 [0062.851] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.ac3") returned 0 [0062.851] lstrlenA (lpString="*.ac3") returned 5 [0062.851] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", pszSpec="*.doc") returned 0 [0062.851] lstrlenA (lpString="*.doc") returned 5 [0062.851] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0062.852] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.852] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="netfx_Extended_x86.msi") returned -1 [0062.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="netfx_Extended_x86.msi") returned -1 [0062.852] lstrcmpiA (lpString1="", lpString2="netfx_Extended_x86.msi") returned -1 [0062.852] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned="netfx_Extended_x64.msi" [0062.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.852] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.852] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.852] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.852] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Extended_x86.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" [0062.852] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.zip") returned 0 [0062.852] lstrlenA (lpString="*.zip") returned 5 [0062.852] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.rar") returned 0 [0062.852] lstrlenA (lpString="*.rar") returned 5 [0062.852] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.7z") returned 0 [0062.852] lstrlenA (lpString="*.7z") returned 4 [0062.852] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.tar") returned 0 [0062.852] lstrlenA (lpString="*.tar") returned 5 [0062.852] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.gzip") returned 0 [0062.852] lstrlenA (lpString="*.gzip") returned 6 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.jpg") returned 0 [0062.853] lstrlenA (lpString="*.jpg") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.jpeg") returned 0 [0062.853] lstrlenA (lpString="*.jpeg") returned 6 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.psd") returned 0 [0062.853] lstrlenA (lpString="*.psd") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.cdr") returned 0 [0062.853] lstrlenA (lpString="*.cdr") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.dwg") returned 0 [0062.853] lstrlenA (lpString="*.dwg") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.max") returned 0 [0062.853] lstrlenA (lpString="*.max") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.bmp") returned 0 [0062.853] lstrlenA (lpString="*.bmp") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.gif") returned 0 [0062.853] lstrlenA (lpString="*.gif") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.png") returned 0 [0062.853] lstrlenA (lpString="*.png") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.doc") returned 0 [0062.853] lstrlenA (lpString="*.doc") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.docx") returned 0 [0062.853] lstrlenA (lpString="*.docx") returned 6 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.xls") returned 0 [0062.853] lstrlenA (lpString="*.xls") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.xlsx") returned 0 [0062.853] lstrlenA (lpString="*.xlsx") returned 6 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.ppt") returned 0 [0062.853] lstrlenA (lpString="*.ppt") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.pptx") returned 0 [0062.853] lstrlenA (lpString="*.pptx") returned 6 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.txt") returned 0 [0062.853] lstrlenA (lpString="*.txt") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.pdf") returned 0 [0062.853] lstrlenA (lpString="*.pdf") returned 5 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.djvu") returned 0 [0062.853] lstrlenA (lpString="*.djvu") returned 6 [0062.853] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.htm") returned 0 [0062.853] lstrlenA (lpString="*.htm") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.html") returned 0 [0062.854] lstrlenA (lpString="*.html") returned 6 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mdb") returned 0 [0062.854] lstrlenA (lpString="*.mdb") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.cer") returned 0 [0062.854] lstrlenA (lpString="*.cer") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.p12") returned 0 [0062.854] lstrlenA (lpString="*.p12") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.pfx") returned 0 [0062.854] lstrlenA (lpString="*.pfx") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.kwm") returned 0 [0062.854] lstrlenA (lpString="*.kwm") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.pwm") returned 0 [0062.854] lstrlenA (lpString="*.pwm") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.1cd") returned 0 [0062.854] lstrlenA (lpString="*.1cd") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.md") returned 0 [0062.854] lstrlenA (lpString="*.md") returned 4 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mdf") returned 0 [0062.854] lstrlenA (lpString="*.mdf") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.dbf") returned 0 [0062.854] lstrlenA (lpString="*.dbf") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.odt") returned 0 [0062.854] lstrlenA (lpString="*.odt") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.vob") returned 0 [0062.854] lstrlenA (lpString="*.vob") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.ifo") returned 0 [0062.854] lstrlenA (lpString="*.ifo") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.lnk") returned 0 [0062.854] lstrlenA (lpString="*.lnk") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.torrent") returned 0 [0062.854] lstrlenA (lpString="*.torrent") returned 9 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mov") returned 0 [0062.854] lstrlenA (lpString="*.mov") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.m2v") returned 0 [0062.854] lstrlenA (lpString="*.m2v") returned 5 [0062.854] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.3gp") returned 0 [0062.855] lstrlenA (lpString="*.3gp") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mpeg") returned 0 [0062.855] lstrlenA (lpString="*.mpeg") returned 6 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mpg") returned 0 [0062.855] lstrlenA (lpString="*.mpg") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.flv") returned 0 [0062.855] lstrlenA (lpString="*.flv") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.avi") returned 0 [0062.855] lstrlenA (lpString="*.avi") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mp4") returned 0 [0062.855] lstrlenA (lpString="*.mp4") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.wmv") returned 0 [0062.855] lstrlenA (lpString="*.wmv") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.divx") returned 0 [0062.855] lstrlenA (lpString="*.divx") returned 6 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mkv") returned 0 [0062.855] lstrlenA (lpString="*.mkv") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.mp3") returned 0 [0062.855] lstrlenA (lpString="*.mp3") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.wav") returned 0 [0062.855] lstrlenA (lpString="*.wav") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.flac") returned 0 [0062.855] lstrlenA (lpString="*.flac") returned 6 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.ape") returned 0 [0062.855] lstrlenA (lpString="*.ape") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.wma") returned 0 [0062.855] lstrlenA (lpString="*.wma") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.ac3") returned 0 [0062.855] lstrlenA (lpString="*.ac3") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", pszSpec="*.doc") returned 0 [0062.855] lstrlenA (lpString="*.doc") returned 5 [0062.855] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0062.855] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.855] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ParameterInfo.xml") returned -1 [0062.856] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ParameterInfo.xml") returned -1 [0062.856] lstrcmpiA (lpString1="", lpString2="ParameterInfo.xml") returned -1 [0062.856] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned="netfx_Extended_x86.msi" [0062.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.856] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.856] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.856] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.856] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="ParameterInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml" [0062.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.zip") returned 0 [0062.856] lstrlenA (lpString="*.zip") returned 5 [0062.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.rar") returned 0 [0062.856] lstrlenA (lpString="*.rar") returned 5 [0062.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.7z") returned 0 [0062.856] lstrlenA (lpString="*.7z") returned 4 [0062.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.tar") returned 0 [0062.856] lstrlenA (lpString="*.tar") returned 5 [0062.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.gzip") returned 0 [0062.856] lstrlenA (lpString="*.gzip") returned 6 [0062.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.jpg") returned 0 [0062.856] lstrlenA (lpString="*.jpg") returned 5 [0062.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.jpeg") returned 0 [0062.856] lstrlenA (lpString="*.jpeg") returned 6 [0062.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.psd") returned 0 [0062.856] lstrlenA (lpString="*.psd") returned 5 [0062.856] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.cdr") returned 0 [0062.857] lstrlenA (lpString="*.cdr") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.dwg") returned 0 [0062.857] lstrlenA (lpString="*.dwg") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.max") returned 0 [0062.857] lstrlenA (lpString="*.max") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.bmp") returned 0 [0062.857] lstrlenA (lpString="*.bmp") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.gif") returned 0 [0062.857] lstrlenA (lpString="*.gif") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.png") returned 0 [0062.857] lstrlenA (lpString="*.png") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.doc") returned 0 [0062.857] lstrlenA (lpString="*.doc") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.docx") returned 0 [0062.857] lstrlenA (lpString="*.docx") returned 6 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.xls") returned 0 [0062.857] lstrlenA (lpString="*.xls") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.xlsx") returned 0 [0062.857] lstrlenA (lpString="*.xlsx") returned 6 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.ppt") returned 0 [0062.857] lstrlenA (lpString="*.ppt") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.pptx") returned 0 [0062.857] lstrlenA (lpString="*.pptx") returned 6 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.txt") returned 0 [0062.857] lstrlenA (lpString="*.txt") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.pdf") returned 0 [0062.857] lstrlenA (lpString="*.pdf") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.djvu") returned 0 [0062.857] lstrlenA (lpString="*.djvu") returned 6 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.htm") returned 0 [0062.857] lstrlenA (lpString="*.htm") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.html") returned 0 [0062.857] lstrlenA (lpString="*.html") returned 6 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mdb") returned 0 [0062.857] lstrlenA (lpString="*.mdb") returned 5 [0062.857] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.cer") returned 0 [0062.858] lstrlenA (lpString="*.cer") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.p12") returned 0 [0062.858] lstrlenA (lpString="*.p12") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.pfx") returned 0 [0062.858] lstrlenA (lpString="*.pfx") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.kwm") returned 0 [0062.858] lstrlenA (lpString="*.kwm") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.pwm") returned 0 [0062.858] lstrlenA (lpString="*.pwm") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.1cd") returned 0 [0062.858] lstrlenA (lpString="*.1cd") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.md") returned 0 [0062.858] lstrlenA (lpString="*.md") returned 4 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mdf") returned 0 [0062.858] lstrlenA (lpString="*.mdf") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.dbf") returned 0 [0062.858] lstrlenA (lpString="*.dbf") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.odt") returned 0 [0062.858] lstrlenA (lpString="*.odt") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.vob") returned 0 [0062.858] lstrlenA (lpString="*.vob") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.ifo") returned 0 [0062.858] lstrlenA (lpString="*.ifo") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.lnk") returned 0 [0062.858] lstrlenA (lpString="*.lnk") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.torrent") returned 0 [0062.858] lstrlenA (lpString="*.torrent") returned 9 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mov") returned 0 [0062.858] lstrlenA (lpString="*.mov") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.m2v") returned 0 [0062.858] lstrlenA (lpString="*.m2v") returned 5 [0062.858] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.3gp") returned 0 [0062.858] lstrlenA (lpString="*.3gp") returned 5 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mpeg") returned 0 [0062.859] lstrlenA (lpString="*.mpeg") returned 6 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mpg") returned 0 [0062.859] lstrlenA (lpString="*.mpg") returned 5 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.flv") returned 0 [0062.859] lstrlenA (lpString="*.flv") returned 5 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.avi") returned 0 [0062.859] lstrlenA (lpString="*.avi") returned 5 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mp4") returned 0 [0062.859] lstrlenA (lpString="*.mp4") returned 5 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.wmv") returned 0 [0062.859] lstrlenA (lpString="*.wmv") returned 5 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.divx") returned 0 [0062.859] lstrlenA (lpString="*.divx") returned 6 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mkv") returned 0 [0062.859] lstrlenA (lpString="*.mkv") returned 5 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.mp3") returned 0 [0062.859] lstrlenA (lpString="*.mp3") returned 5 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.wav") returned 0 [0062.859] lstrlenA (lpString="*.wav") returned 5 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.flac") returned 0 [0062.859] lstrlenA (lpString="*.flac") returned 6 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.ape") returned 0 [0062.859] lstrlenA (lpString="*.ape") returned 5 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.wma") returned 0 [0062.859] lstrlenA (lpString="*.wma") returned 5 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.ac3") returned 0 [0062.859] lstrlenA (lpString="*.ac3") returned 5 [0062.859] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\ParameterInfo.xml", pszSpec="*.doc") returned 0 [0062.859] lstrlenA (lpString="*.doc") returned 5 [0062.859] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0062.859] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.859] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RGB9RAST_x64.msi") returned -1 [0062.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RGB9RAST_x64.msi") returned -1 [0062.859] lstrcmpiA (lpString1="", lpString2="RGB9RAST_x64.msi") returned -1 [0062.859] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned="ParameterInfo.xml" [0062.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.860] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.860] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.860] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.860] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="RGB9RAST_x64.msi" | out: lpString1="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.zip") returned 0 [0062.860] lstrlenA (lpString="*.zip") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.rar") returned 0 [0062.860] lstrlenA (lpString="*.rar") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.7z") returned 0 [0062.860] lstrlenA (lpString="*.7z") returned 4 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.tar") returned 0 [0062.860] lstrlenA (lpString="*.tar") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.gzip") returned 0 [0062.860] lstrlenA (lpString="*.gzip") returned 6 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.jpg") returned 0 [0062.860] lstrlenA (lpString="*.jpg") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.jpeg") returned 0 [0062.860] lstrlenA (lpString="*.jpeg") returned 6 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.psd") returned 0 [0062.860] lstrlenA (lpString="*.psd") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.cdr") returned 0 [0062.860] lstrlenA (lpString="*.cdr") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.dwg") returned 0 [0062.860] lstrlenA (lpString="*.dwg") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.max") returned 0 [0062.860] lstrlenA (lpString="*.max") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.bmp") returned 0 [0062.860] lstrlenA (lpString="*.bmp") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.gif") returned 0 [0062.860] lstrlenA (lpString="*.gif") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.png") returned 0 [0062.860] lstrlenA (lpString="*.png") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.doc") returned 0 [0062.860] lstrlenA (lpString="*.doc") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.docx") returned 0 [0062.861] lstrlenA (lpString="*.docx") returned 6 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.xls") returned 0 [0062.861] lstrlenA (lpString="*.xls") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.xlsx") returned 0 [0062.861] lstrlenA (lpString="*.xlsx") returned 6 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.ppt") returned 0 [0062.861] lstrlenA (lpString="*.ppt") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.pptx") returned 0 [0062.861] lstrlenA (lpString="*.pptx") returned 6 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.txt") returned 0 [0062.861] lstrlenA (lpString="*.txt") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.pdf") returned 0 [0062.861] lstrlenA (lpString="*.pdf") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.djvu") returned 0 [0062.861] lstrlenA (lpString="*.djvu") returned 6 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.htm") returned 0 [0062.861] lstrlenA (lpString="*.htm") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.html") returned 0 [0062.861] lstrlenA (lpString="*.html") returned 6 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mdb") returned 0 [0062.861] lstrlenA (lpString="*.mdb") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.cer") returned 0 [0062.861] lstrlenA (lpString="*.cer") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.p12") returned 0 [0062.861] lstrlenA (lpString="*.p12") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.pfx") returned 0 [0062.861] lstrlenA (lpString="*.pfx") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.kwm") returned 0 [0062.861] lstrlenA (lpString="*.kwm") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.pwm") returned 0 [0062.861] lstrlenA (lpString="*.pwm") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.1cd") returned 0 [0062.861] lstrlenA (lpString="*.1cd") returned 5 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.md") returned 0 [0062.861] lstrlenA (lpString="*.md") returned 4 [0062.861] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mdf") returned 0 [0062.862] lstrlenA (lpString="*.mdf") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.dbf") returned 0 [0062.862] lstrlenA (lpString="*.dbf") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.odt") returned 0 [0062.862] lstrlenA (lpString="*.odt") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.vob") returned 0 [0062.862] lstrlenA (lpString="*.vob") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.ifo") returned 0 [0062.862] lstrlenA (lpString="*.ifo") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.lnk") returned 0 [0062.862] lstrlenA (lpString="*.lnk") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.torrent") returned 0 [0062.862] lstrlenA (lpString="*.torrent") returned 9 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mov") returned 0 [0062.862] lstrlenA (lpString="*.mov") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.m2v") returned 0 [0062.862] lstrlenA (lpString="*.m2v") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.3gp") returned 0 [0062.862] lstrlenA (lpString="*.3gp") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mpeg") returned 0 [0062.862] lstrlenA (lpString="*.mpeg") returned 6 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mpg") returned 0 [0062.862] lstrlenA (lpString="*.mpg") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.flv") returned 0 [0062.862] lstrlenA (lpString="*.flv") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.avi") returned 0 [0062.862] lstrlenA (lpString="*.avi") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mp4") returned 0 [0062.862] lstrlenA (lpString="*.mp4") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.wmv") returned 0 [0062.862] lstrlenA (lpString="*.wmv") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.divx") returned 0 [0062.862] lstrlenA (lpString="*.divx") returned 6 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mkv") returned 0 [0062.862] lstrlenA (lpString="*.mkv") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.mp3") returned 0 [0062.862] lstrlenA (lpString="*.mp3") returned 5 [0062.862] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.wav") returned 0 [0062.863] lstrlenA (lpString="*.wav") returned 5 [0062.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.flac") returned 0 [0062.863] lstrlenA (lpString="*.flac") returned 6 [0062.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.ape") returned 0 [0062.863] lstrlenA (lpString="*.ape") returned 5 [0062.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.wma") returned 0 [0062.863] lstrlenA (lpString="*.wma") returned 5 [0062.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.ac3") returned 0 [0062.863] lstrlenA (lpString="*.ac3") returned 5 [0062.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", pszSpec="*.doc") returned 0 [0062.863] lstrlenA (lpString="*.doc") returned 5 [0062.863] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0062.863] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.863] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RGB9Rast_x86.msi") returned -1 [0062.863] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RGB9Rast_x86.msi") returned -1 [0062.863] lstrcmpiA (lpString1="", lpString2="RGB9Rast_x86.msi") returned -1 [0062.863] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned="RGB9RAST_x64.msi" [0062.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.863] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.863] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.863] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.863] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="RGB9Rast_x86.msi" | out: lpString1="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" [0062.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.zip") returned 0 [0062.863] lstrlenA (lpString="*.zip") returned 5 [0062.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.rar") returned 0 [0062.863] lstrlenA (lpString="*.rar") returned 5 [0062.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.7z") returned 0 [0062.863] lstrlenA (lpString="*.7z") returned 4 [0062.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.tar") returned 0 [0062.863] lstrlenA (lpString="*.tar") returned 5 [0062.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.gzip") returned 0 [0062.863] lstrlenA (lpString="*.gzip") returned 6 [0062.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.jpg") returned 0 [0062.863] lstrlenA (lpString="*.jpg") returned 5 [0062.863] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.jpeg") returned 0 [0062.864] lstrlenA (lpString="*.jpeg") returned 6 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.psd") returned 0 [0062.864] lstrlenA (lpString="*.psd") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.cdr") returned 0 [0062.864] lstrlenA (lpString="*.cdr") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.dwg") returned 0 [0062.864] lstrlenA (lpString="*.dwg") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.max") returned 0 [0062.864] lstrlenA (lpString="*.max") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.bmp") returned 0 [0062.864] lstrlenA (lpString="*.bmp") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.gif") returned 0 [0062.864] lstrlenA (lpString="*.gif") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.png") returned 0 [0062.864] lstrlenA (lpString="*.png") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.doc") returned 0 [0062.864] lstrlenA (lpString="*.doc") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.docx") returned 0 [0062.864] lstrlenA (lpString="*.docx") returned 6 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.xls") returned 0 [0062.864] lstrlenA (lpString="*.xls") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.xlsx") returned 0 [0062.864] lstrlenA (lpString="*.xlsx") returned 6 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.ppt") returned 0 [0062.864] lstrlenA (lpString="*.ppt") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.pptx") returned 0 [0062.864] lstrlenA (lpString="*.pptx") returned 6 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.txt") returned 0 [0062.864] lstrlenA (lpString="*.txt") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.pdf") returned 0 [0062.864] lstrlenA (lpString="*.pdf") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.djvu") returned 0 [0062.864] lstrlenA (lpString="*.djvu") returned 6 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.htm") returned 0 [0062.864] lstrlenA (lpString="*.htm") returned 5 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.html") returned 0 [0062.864] lstrlenA (lpString="*.html") returned 6 [0062.864] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mdb") returned 0 [0062.865] lstrlenA (lpString="*.mdb") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.cer") returned 0 [0062.865] lstrlenA (lpString="*.cer") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.p12") returned 0 [0062.865] lstrlenA (lpString="*.p12") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.pfx") returned 0 [0062.865] lstrlenA (lpString="*.pfx") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.kwm") returned 0 [0062.865] lstrlenA (lpString="*.kwm") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.pwm") returned 0 [0062.865] lstrlenA (lpString="*.pwm") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.1cd") returned 0 [0062.865] lstrlenA (lpString="*.1cd") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.md") returned 0 [0062.865] lstrlenA (lpString="*.md") returned 4 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mdf") returned 0 [0062.865] lstrlenA (lpString="*.mdf") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.dbf") returned 0 [0062.865] lstrlenA (lpString="*.dbf") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.odt") returned 0 [0062.865] lstrlenA (lpString="*.odt") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.vob") returned 0 [0062.865] lstrlenA (lpString="*.vob") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.ifo") returned 0 [0062.865] lstrlenA (lpString="*.ifo") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.lnk") returned 0 [0062.865] lstrlenA (lpString="*.lnk") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.torrent") returned 0 [0062.865] lstrlenA (lpString="*.torrent") returned 9 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mov") returned 0 [0062.865] lstrlenA (lpString="*.mov") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.m2v") returned 0 [0062.865] lstrlenA (lpString="*.m2v") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.3gp") returned 0 [0062.865] lstrlenA (lpString="*.3gp") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mpeg") returned 0 [0062.865] lstrlenA (lpString="*.mpeg") returned 6 [0062.865] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mpg") returned 0 [0062.866] lstrlenA (lpString="*.mpg") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.flv") returned 0 [0062.866] lstrlenA (lpString="*.flv") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.avi") returned 0 [0062.866] lstrlenA (lpString="*.avi") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mp4") returned 0 [0062.866] lstrlenA (lpString="*.mp4") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.wmv") returned 0 [0062.866] lstrlenA (lpString="*.wmv") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.divx") returned 0 [0062.866] lstrlenA (lpString="*.divx") returned 6 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mkv") returned 0 [0062.866] lstrlenA (lpString="*.mkv") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.mp3") returned 0 [0062.866] lstrlenA (lpString="*.mp3") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.wav") returned 0 [0062.866] lstrlenA (lpString="*.wav") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.flac") returned 0 [0062.866] lstrlenA (lpString="*.flac") returned 6 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.ape") returned 0 [0062.866] lstrlenA (lpString="*.ape") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.wma") returned 0 [0062.866] lstrlenA (lpString="*.wma") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.ac3") returned 0 [0062.866] lstrlenA (lpString="*.ac3") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", pszSpec="*.doc") returned 0 [0062.866] lstrlenA (lpString="*.doc") returned 5 [0062.866] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0062.866] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.866] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.exe") returned -1 [0062.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.exe") returned -1 [0062.866] lstrcmpiA (lpString1="", lpString2="Setup.exe") returned -1 [0062.866] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned="RGB9Rast_x86.msi" [0062.866] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.866] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.866] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.867] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.867] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Setup.exe" | out: lpString1="C:\\588bce7c90097ed212\\Setup.exe") returned="C:\\588bce7c90097ed212\\Setup.exe" [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.zip") returned 0 [0062.867] lstrlenA (lpString="*.zip") returned 5 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.rar") returned 0 [0062.867] lstrlenA (lpString="*.rar") returned 5 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.7z") returned 0 [0062.867] lstrlenA (lpString="*.7z") returned 4 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.tar") returned 0 [0062.867] lstrlenA (lpString="*.tar") returned 5 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.gzip") returned 0 [0062.867] lstrlenA (lpString="*.gzip") returned 6 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.jpg") returned 0 [0062.867] lstrlenA (lpString="*.jpg") returned 5 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.jpeg") returned 0 [0062.867] lstrlenA (lpString="*.jpeg") returned 6 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.psd") returned 0 [0062.867] lstrlenA (lpString="*.psd") returned 5 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.cdr") returned 0 [0062.867] lstrlenA (lpString="*.cdr") returned 5 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.dwg") returned 0 [0062.867] lstrlenA (lpString="*.dwg") returned 5 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.max") returned 0 [0062.867] lstrlenA (lpString="*.max") returned 5 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.bmp") returned 0 [0062.867] lstrlenA (lpString="*.bmp") returned 5 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.gif") returned 0 [0062.867] lstrlenA (lpString="*.gif") returned 5 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.png") returned 0 [0062.867] lstrlenA (lpString="*.png") returned 5 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.doc") returned 0 [0062.867] lstrlenA (lpString="*.doc") returned 5 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.docx") returned 0 [0062.867] lstrlenA (lpString="*.docx") returned 6 [0062.867] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.xls") returned 0 [0062.867] lstrlenA (lpString="*.xls") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.xlsx") returned 0 [0062.868] lstrlenA (lpString="*.xlsx") returned 6 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.ppt") returned 0 [0062.868] lstrlenA (lpString="*.ppt") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.pptx") returned 0 [0062.868] lstrlenA (lpString="*.pptx") returned 6 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.txt") returned 0 [0062.868] lstrlenA (lpString="*.txt") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.pdf") returned 0 [0062.868] lstrlenA (lpString="*.pdf") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.djvu") returned 0 [0062.868] lstrlenA (lpString="*.djvu") returned 6 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.htm") returned 0 [0062.868] lstrlenA (lpString="*.htm") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.html") returned 0 [0062.868] lstrlenA (lpString="*.html") returned 6 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mdb") returned 0 [0062.868] lstrlenA (lpString="*.mdb") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.cer") returned 0 [0062.868] lstrlenA (lpString="*.cer") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.p12") returned 0 [0062.868] lstrlenA (lpString="*.p12") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.pfx") returned 0 [0062.868] lstrlenA (lpString="*.pfx") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.kwm") returned 0 [0062.868] lstrlenA (lpString="*.kwm") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.pwm") returned 0 [0062.868] lstrlenA (lpString="*.pwm") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.1cd") returned 0 [0062.868] lstrlenA (lpString="*.1cd") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.md") returned 0 [0062.868] lstrlenA (lpString="*.md") returned 4 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mdf") returned 0 [0062.868] lstrlenA (lpString="*.mdf") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.dbf") returned 0 [0062.868] lstrlenA (lpString="*.dbf") returned 5 [0062.868] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.odt") returned 0 [0062.868] lstrlenA (lpString="*.odt") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.vob") returned 0 [0062.869] lstrlenA (lpString="*.vob") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.ifo") returned 0 [0062.869] lstrlenA (lpString="*.ifo") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.lnk") returned 0 [0062.869] lstrlenA (lpString="*.lnk") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.torrent") returned 0 [0062.869] lstrlenA (lpString="*.torrent") returned 9 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mov") returned 0 [0062.869] lstrlenA (lpString="*.mov") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.m2v") returned 0 [0062.869] lstrlenA (lpString="*.m2v") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.3gp") returned 0 [0062.869] lstrlenA (lpString="*.3gp") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mpeg") returned 0 [0062.869] lstrlenA (lpString="*.mpeg") returned 6 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mpg") returned 0 [0062.869] lstrlenA (lpString="*.mpg") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.flv") returned 0 [0062.869] lstrlenA (lpString="*.flv") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.avi") returned 0 [0062.869] lstrlenA (lpString="*.avi") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mp4") returned 0 [0062.869] lstrlenA (lpString="*.mp4") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.wmv") returned 0 [0062.869] lstrlenA (lpString="*.wmv") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.divx") returned 0 [0062.869] lstrlenA (lpString="*.divx") returned 6 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mkv") returned 0 [0062.869] lstrlenA (lpString="*.mkv") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.mp3") returned 0 [0062.869] lstrlenA (lpString="*.mp3") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.wav") returned 0 [0062.869] lstrlenA (lpString="*.wav") returned 5 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.flac") returned 0 [0062.869] lstrlenA (lpString="*.flac") returned 6 [0062.869] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.ape") returned 0 [0062.870] lstrlenA (lpString="*.ape") returned 5 [0062.870] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.wma") returned 0 [0062.870] lstrlenA (lpString="*.wma") returned 5 [0062.870] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.ac3") returned 0 [0062.870] lstrlenA (lpString="*.ac3") returned 5 [0062.870] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Setup.exe", pszSpec="*.doc") returned 0 [0062.870] lstrlenA (lpString="*.doc") returned 5 [0062.870] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0062.870] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.870] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupEngine.dll") returned -1 [0062.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupEngine.dll") returned -1 [0062.870] lstrcmpiA (lpString1="", lpString2="SetupEngine.dll") returned -1 [0062.870] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Setup.exe") returned="Setup.exe" [0062.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.870] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.870] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.870] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.870] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="SetupEngine.dll" | out: lpString1="C:\\588bce7c90097ed212\\SetupEngine.dll") returned="C:\\588bce7c90097ed212\\SetupEngine.dll" [0062.870] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.zip") returned 0 [0062.870] lstrlenA (lpString="*.zip") returned 5 [0062.870] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.rar") returned 0 [0062.870] lstrlenA (lpString="*.rar") returned 5 [0062.870] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.7z") returned 0 [0062.870] lstrlenA (lpString="*.7z") returned 4 [0062.870] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.tar") returned 0 [0062.870] lstrlenA (lpString="*.tar") returned 5 [0062.870] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.gzip") returned 0 [0062.870] lstrlenA (lpString="*.gzip") returned 6 [0062.870] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.jpg") returned 0 [0062.870] lstrlenA (lpString="*.jpg") returned 5 [0062.870] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.jpeg") returned 0 [0062.870] lstrlenA (lpString="*.jpeg") returned 6 [0062.870] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.psd") returned 0 [0062.870] lstrlenA (lpString="*.psd") returned 5 [0062.870] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.cdr") returned 0 [0062.871] lstrlenA (lpString="*.cdr") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.dwg") returned 0 [0062.871] lstrlenA (lpString="*.dwg") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.max") returned 0 [0062.871] lstrlenA (lpString="*.max") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.bmp") returned 0 [0062.871] lstrlenA (lpString="*.bmp") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.gif") returned 0 [0062.871] lstrlenA (lpString="*.gif") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.png") returned 0 [0062.871] lstrlenA (lpString="*.png") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.doc") returned 0 [0062.871] lstrlenA (lpString="*.doc") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.docx") returned 0 [0062.871] lstrlenA (lpString="*.docx") returned 6 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.xls") returned 0 [0062.871] lstrlenA (lpString="*.xls") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.xlsx") returned 0 [0062.871] lstrlenA (lpString="*.xlsx") returned 6 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.ppt") returned 0 [0062.871] lstrlenA (lpString="*.ppt") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.pptx") returned 0 [0062.871] lstrlenA (lpString="*.pptx") returned 6 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.txt") returned 0 [0062.871] lstrlenA (lpString="*.txt") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.pdf") returned 0 [0062.871] lstrlenA (lpString="*.pdf") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.djvu") returned 0 [0062.871] lstrlenA (lpString="*.djvu") returned 6 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.htm") returned 0 [0062.871] lstrlenA (lpString="*.htm") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.html") returned 0 [0062.871] lstrlenA (lpString="*.html") returned 6 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mdb") returned 0 [0062.871] lstrlenA (lpString="*.mdb") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.cer") returned 0 [0062.871] lstrlenA (lpString="*.cer") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.p12") returned 0 [0062.872] lstrlenA (lpString="*.p12") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.pfx") returned 0 [0062.872] lstrlenA (lpString="*.pfx") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.kwm") returned 0 [0062.872] lstrlenA (lpString="*.kwm") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.pwm") returned 0 [0062.872] lstrlenA (lpString="*.pwm") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.1cd") returned 0 [0062.872] lstrlenA (lpString="*.1cd") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.md") returned 0 [0062.872] lstrlenA (lpString="*.md") returned 4 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mdf") returned 0 [0062.872] lstrlenA (lpString="*.mdf") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.dbf") returned 0 [0062.872] lstrlenA (lpString="*.dbf") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.odt") returned 0 [0062.872] lstrlenA (lpString="*.odt") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.vob") returned 0 [0062.872] lstrlenA (lpString="*.vob") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.ifo") returned 0 [0062.872] lstrlenA (lpString="*.ifo") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.lnk") returned 0 [0062.872] lstrlenA (lpString="*.lnk") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.torrent") returned 0 [0062.872] lstrlenA (lpString="*.torrent") returned 9 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mov") returned 0 [0062.872] lstrlenA (lpString="*.mov") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.m2v") returned 0 [0062.872] lstrlenA (lpString="*.m2v") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.3gp") returned 0 [0062.872] lstrlenA (lpString="*.3gp") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mpeg") returned 0 [0062.872] lstrlenA (lpString="*.mpeg") returned 6 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mpg") returned 0 [0062.872] lstrlenA (lpString="*.mpg") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.flv") returned 0 [0062.872] lstrlenA (lpString="*.flv") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.avi") returned 0 [0062.873] lstrlenA (lpString="*.avi") returned 5 [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mp4") returned 0 [0062.873] lstrlenA (lpString="*.mp4") returned 5 [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.wmv") returned 0 [0062.873] lstrlenA (lpString="*.wmv") returned 5 [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.divx") returned 0 [0062.873] lstrlenA (lpString="*.divx") returned 6 [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mkv") returned 0 [0062.873] lstrlenA (lpString="*.mkv") returned 5 [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.mp3") returned 0 [0062.873] lstrlenA (lpString="*.mp3") returned 5 [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.wav") returned 0 [0062.873] lstrlenA (lpString="*.wav") returned 5 [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.flac") returned 0 [0062.873] lstrlenA (lpString="*.flac") returned 6 [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.ape") returned 0 [0062.873] lstrlenA (lpString="*.ape") returned 5 [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.wma") returned 0 [0062.873] lstrlenA (lpString="*.wma") returned 5 [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.ac3") returned 0 [0062.873] lstrlenA (lpString="*.ac3") returned 5 [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupEngine.dll", pszSpec="*.doc") returned 0 [0062.873] lstrlenA (lpString="*.doc") returned 5 [0062.873] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0062.873] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.873] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupUi.dll") returned -1 [0062.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupUi.dll") returned -1 [0062.873] lstrcmpiA (lpString1="", lpString2="SetupUi.dll") returned -1 [0062.873] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\SetupEngine.dll") returned="SetupEngine.dll" [0062.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.873] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.873] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.873] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.873] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="SetupUi.dll" | out: lpString1="C:\\588bce7c90097ed212\\SetupUi.dll") returned="C:\\588bce7c90097ed212\\SetupUi.dll" [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.zip") returned 0 [0062.873] lstrlenA (lpString="*.zip") returned 5 [0062.873] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.rar") returned 0 [0062.874] lstrlenA (lpString="*.rar") returned 5 [0062.874] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.7z") returned 0 [0062.874] lstrlenA (lpString="*.7z") returned 4 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.tar") returned 0 [0062.892] lstrlenA (lpString="*.tar") returned 5 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.gzip") returned 0 [0062.892] lstrlenA (lpString="*.gzip") returned 6 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.jpg") returned 0 [0062.892] lstrlenA (lpString="*.jpg") returned 5 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.jpeg") returned 0 [0062.892] lstrlenA (lpString="*.jpeg") returned 6 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.psd") returned 0 [0062.892] lstrlenA (lpString="*.psd") returned 5 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.cdr") returned 0 [0062.892] lstrlenA (lpString="*.cdr") returned 5 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.dwg") returned 0 [0062.892] lstrlenA (lpString="*.dwg") returned 5 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.max") returned 0 [0062.892] lstrlenA (lpString="*.max") returned 5 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.bmp") returned 0 [0062.892] lstrlenA (lpString="*.bmp") returned 5 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.gif") returned 0 [0062.892] lstrlenA (lpString="*.gif") returned 5 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.png") returned 0 [0062.892] lstrlenA (lpString="*.png") returned 5 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.doc") returned 0 [0062.892] lstrlenA (lpString="*.doc") returned 5 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.docx") returned 0 [0062.892] lstrlenA (lpString="*.docx") returned 6 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.xls") returned 0 [0062.892] lstrlenA (lpString="*.xls") returned 5 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.xlsx") returned 0 [0062.892] lstrlenA (lpString="*.xlsx") returned 6 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.ppt") returned 0 [0062.892] lstrlenA (lpString="*.ppt") returned 5 [0062.892] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.pptx") returned 0 [0062.893] lstrlenA (lpString="*.pptx") returned 6 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.txt") returned 0 [0062.893] lstrlenA (lpString="*.txt") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.pdf") returned 0 [0062.893] lstrlenA (lpString="*.pdf") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.djvu") returned 0 [0062.893] lstrlenA (lpString="*.djvu") returned 6 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.htm") returned 0 [0062.893] lstrlenA (lpString="*.htm") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.html") returned 0 [0062.893] lstrlenA (lpString="*.html") returned 6 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mdb") returned 0 [0062.893] lstrlenA (lpString="*.mdb") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.cer") returned 0 [0062.893] lstrlenA (lpString="*.cer") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.p12") returned 0 [0062.893] lstrlenA (lpString="*.p12") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.pfx") returned 0 [0062.893] lstrlenA (lpString="*.pfx") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.kwm") returned 0 [0062.893] lstrlenA (lpString="*.kwm") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.pwm") returned 0 [0062.893] lstrlenA (lpString="*.pwm") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.1cd") returned 0 [0062.893] lstrlenA (lpString="*.1cd") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.md") returned 0 [0062.893] lstrlenA (lpString="*.md") returned 4 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mdf") returned 0 [0062.893] lstrlenA (lpString="*.mdf") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.dbf") returned 0 [0062.893] lstrlenA (lpString="*.dbf") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.odt") returned 0 [0062.893] lstrlenA (lpString="*.odt") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.vob") returned 0 [0062.893] lstrlenA (lpString="*.vob") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.ifo") returned 0 [0062.894] lstrlenA (lpString="*.ifo") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.lnk") returned 0 [0062.894] lstrlenA (lpString="*.lnk") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.torrent") returned 0 [0062.894] lstrlenA (lpString="*.torrent") returned 9 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mov") returned 0 [0062.894] lstrlenA (lpString="*.mov") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.m2v") returned 0 [0062.894] lstrlenA (lpString="*.m2v") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.3gp") returned 0 [0062.894] lstrlenA (lpString="*.3gp") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mpeg") returned 0 [0062.894] lstrlenA (lpString="*.mpeg") returned 6 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mpg") returned 0 [0062.894] lstrlenA (lpString="*.mpg") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.flv") returned 0 [0062.894] lstrlenA (lpString="*.flv") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.avi") returned 0 [0062.894] lstrlenA (lpString="*.avi") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mp4") returned 0 [0062.894] lstrlenA (lpString="*.mp4") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.wmv") returned 0 [0062.894] lstrlenA (lpString="*.wmv") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.divx") returned 0 [0062.894] lstrlenA (lpString="*.divx") returned 6 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mkv") returned 0 [0062.894] lstrlenA (lpString="*.mkv") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.mp3") returned 0 [0062.894] lstrlenA (lpString="*.mp3") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.wav") returned 0 [0062.894] lstrlenA (lpString="*.wav") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.flac") returned 0 [0062.894] lstrlenA (lpString="*.flac") returned 6 [0062.894] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.ape") returned 0 [0062.894] lstrlenA (lpString="*.ape") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.wma") returned 0 [0062.895] lstrlenA (lpString="*.wma") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.ac3") returned 0 [0062.895] lstrlenA (lpString="*.ac3") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.dll", pszSpec="*.doc") returned 0 [0062.895] lstrlenA (lpString="*.doc") returned 5 [0062.895] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0062.895] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.895] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupUi.xsd") returned -1 [0062.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupUi.xsd") returned -1 [0062.895] lstrcmpiA (lpString1="", lpString2="SetupUi.xsd") returned -1 [0062.895] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\SetupUi.dll") returned="SetupUi.dll" [0062.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.895] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.895] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.895] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.895] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="SetupUi.xsd" | out: lpString1="C:\\588bce7c90097ed212\\SetupUi.xsd") returned="C:\\588bce7c90097ed212\\SetupUi.xsd" [0062.895] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.zip") returned 0 [0062.895] lstrlenA (lpString="*.zip") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.rar") returned 0 [0062.895] lstrlenA (lpString="*.rar") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.7z") returned 0 [0062.895] lstrlenA (lpString="*.7z") returned 4 [0062.895] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.tar") returned 0 [0062.895] lstrlenA (lpString="*.tar") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.gzip") returned 0 [0062.896] lstrlenA (lpString="*.gzip") returned 6 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.jpg") returned 0 [0062.896] lstrlenA (lpString="*.jpg") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.jpeg") returned 0 [0062.896] lstrlenA (lpString="*.jpeg") returned 6 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.psd") returned 0 [0062.896] lstrlenA (lpString="*.psd") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.cdr") returned 0 [0062.896] lstrlenA (lpString="*.cdr") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.dwg") returned 0 [0062.896] lstrlenA (lpString="*.dwg") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.max") returned 0 [0062.896] lstrlenA (lpString="*.max") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.bmp") returned 0 [0062.896] lstrlenA (lpString="*.bmp") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.gif") returned 0 [0062.896] lstrlenA (lpString="*.gif") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.png") returned 0 [0062.896] lstrlenA (lpString="*.png") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.doc") returned 0 [0062.896] lstrlenA (lpString="*.doc") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.docx") returned 0 [0062.896] lstrlenA (lpString="*.docx") returned 6 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.xls") returned 0 [0062.896] lstrlenA (lpString="*.xls") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.xlsx") returned 0 [0062.896] lstrlenA (lpString="*.xlsx") returned 6 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.ppt") returned 0 [0062.896] lstrlenA (lpString="*.ppt") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.pptx") returned 0 [0062.896] lstrlenA (lpString="*.pptx") returned 6 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.txt") returned 0 [0062.896] lstrlenA (lpString="*.txt") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.pdf") returned 0 [0062.896] lstrlenA (lpString="*.pdf") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.djvu") returned 0 [0062.897] lstrlenA (lpString="*.djvu") returned 6 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.htm") returned 0 [0062.897] lstrlenA (lpString="*.htm") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.html") returned 0 [0062.897] lstrlenA (lpString="*.html") returned 6 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mdb") returned 0 [0062.897] lstrlenA (lpString="*.mdb") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.cer") returned 0 [0062.897] lstrlenA (lpString="*.cer") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.p12") returned 0 [0062.897] lstrlenA (lpString="*.p12") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.pfx") returned 0 [0062.897] lstrlenA (lpString="*.pfx") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.kwm") returned 0 [0062.897] lstrlenA (lpString="*.kwm") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.pwm") returned 0 [0062.897] lstrlenA (lpString="*.pwm") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.1cd") returned 0 [0062.897] lstrlenA (lpString="*.1cd") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.md") returned 0 [0062.897] lstrlenA (lpString="*.md") returned 4 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mdf") returned 0 [0062.897] lstrlenA (lpString="*.mdf") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.dbf") returned 0 [0062.897] lstrlenA (lpString="*.dbf") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.odt") returned 0 [0062.897] lstrlenA (lpString="*.odt") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.vob") returned 0 [0062.897] lstrlenA (lpString="*.vob") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.ifo") returned 0 [0062.897] lstrlenA (lpString="*.ifo") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.lnk") returned 0 [0062.897] lstrlenA (lpString="*.lnk") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.torrent") returned 0 [0062.898] lstrlenA (lpString="*.torrent") returned 9 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mov") returned 0 [0062.898] lstrlenA (lpString="*.mov") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.m2v") returned 0 [0062.898] lstrlenA (lpString="*.m2v") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.3gp") returned 0 [0062.898] lstrlenA (lpString="*.3gp") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mpeg") returned 0 [0062.898] lstrlenA (lpString="*.mpeg") returned 6 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mpg") returned 0 [0062.898] lstrlenA (lpString="*.mpg") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.flv") returned 0 [0062.898] lstrlenA (lpString="*.flv") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.avi") returned 0 [0062.898] lstrlenA (lpString="*.avi") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mp4") returned 0 [0062.898] lstrlenA (lpString="*.mp4") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.wmv") returned 0 [0062.898] lstrlenA (lpString="*.wmv") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.divx") returned 0 [0062.898] lstrlenA (lpString="*.divx") returned 6 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mkv") returned 0 [0062.898] lstrlenA (lpString="*.mkv") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.mp3") returned 0 [0062.898] lstrlenA (lpString="*.mp3") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.wav") returned 0 [0062.898] lstrlenA (lpString="*.wav") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.flac") returned 0 [0062.898] lstrlenA (lpString="*.flac") returned 6 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.ape") returned 0 [0062.898] lstrlenA (lpString="*.ape") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.wma") returned 0 [0062.898] lstrlenA (lpString="*.wma") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.ac3") returned 0 [0062.898] lstrlenA (lpString="*.ac3") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUi.xsd", pszSpec="*.doc") returned 0 [0062.899] lstrlenA (lpString="*.doc") returned 5 [0062.899] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0062.899] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.899] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SetupUtility.exe") returned -1 [0062.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SetupUtility.exe") returned -1 [0062.899] lstrcmpiA (lpString1="", lpString2="SetupUtility.exe") returned -1 [0062.899] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\SetupUi.xsd") returned="SetupUi.xsd" [0062.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.899] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.899] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.899] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.899] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="SetupUtility.exe" | out: lpString1="C:\\588bce7c90097ed212\\SetupUtility.exe") returned="C:\\588bce7c90097ed212\\SetupUtility.exe" [0062.899] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.zip") returned 0 [0062.899] lstrlenA (lpString="*.zip") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.rar") returned 0 [0062.899] lstrlenA (lpString="*.rar") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.7z") returned 0 [0062.899] lstrlenA (lpString="*.7z") returned 4 [0062.899] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.tar") returned 0 [0062.899] lstrlenA (lpString="*.tar") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.gzip") returned 0 [0062.899] lstrlenA (lpString="*.gzip") returned 6 [0062.899] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.jpg") returned 0 [0062.899] lstrlenA (lpString="*.jpg") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.jpeg") returned 0 [0062.899] lstrlenA (lpString="*.jpeg") returned 6 [0062.899] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.psd") returned 0 [0062.899] lstrlenA (lpString="*.psd") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.cdr") returned 0 [0062.899] lstrlenA (lpString="*.cdr") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.dwg") returned 0 [0062.900] lstrlenA (lpString="*.dwg") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.max") returned 0 [0062.900] lstrlenA (lpString="*.max") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.bmp") returned 0 [0062.900] lstrlenA (lpString="*.bmp") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.gif") returned 0 [0062.900] lstrlenA (lpString="*.gif") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.png") returned 0 [0062.900] lstrlenA (lpString="*.png") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.doc") returned 0 [0062.900] lstrlenA (lpString="*.doc") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.docx") returned 0 [0062.900] lstrlenA (lpString="*.docx") returned 6 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.xls") returned 0 [0062.900] lstrlenA (lpString="*.xls") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.xlsx") returned 0 [0062.900] lstrlenA (lpString="*.xlsx") returned 6 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.ppt") returned 0 [0062.900] lstrlenA (lpString="*.ppt") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.pptx") returned 0 [0062.900] lstrlenA (lpString="*.pptx") returned 6 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.txt") returned 0 [0062.900] lstrlenA (lpString="*.txt") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.pdf") returned 0 [0062.900] lstrlenA (lpString="*.pdf") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.djvu") returned 0 [0062.900] lstrlenA (lpString="*.djvu") returned 6 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.htm") returned 0 [0062.900] lstrlenA (lpString="*.htm") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.html") returned 0 [0062.900] lstrlenA (lpString="*.html") returned 6 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mdb") returned 0 [0062.900] lstrlenA (lpString="*.mdb") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.cer") returned 0 [0062.901] lstrlenA (lpString="*.cer") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.p12") returned 0 [0062.901] lstrlenA (lpString="*.p12") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.pfx") returned 0 [0062.901] lstrlenA (lpString="*.pfx") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.kwm") returned 0 [0062.901] lstrlenA (lpString="*.kwm") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.pwm") returned 0 [0062.901] lstrlenA (lpString="*.pwm") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.1cd") returned 0 [0062.901] lstrlenA (lpString="*.1cd") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.md") returned 0 [0062.901] lstrlenA (lpString="*.md") returned 4 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mdf") returned 0 [0062.901] lstrlenA (lpString="*.mdf") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.dbf") returned 0 [0062.901] lstrlenA (lpString="*.dbf") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.odt") returned 0 [0062.901] lstrlenA (lpString="*.odt") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.vob") returned 0 [0062.901] lstrlenA (lpString="*.vob") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.ifo") returned 0 [0062.901] lstrlenA (lpString="*.ifo") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.lnk") returned 0 [0062.901] lstrlenA (lpString="*.lnk") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.torrent") returned 0 [0062.901] lstrlenA (lpString="*.torrent") returned 9 [0062.901] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mov") returned 0 [0062.902] lstrlenA (lpString="*.mov") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.m2v") returned 0 [0062.902] lstrlenA (lpString="*.m2v") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.3gp") returned 0 [0062.902] lstrlenA (lpString="*.3gp") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mpeg") returned 0 [0062.902] lstrlenA (lpString="*.mpeg") returned 6 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mpg") returned 0 [0062.902] lstrlenA (lpString="*.mpg") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.flv") returned 0 [0062.902] lstrlenA (lpString="*.flv") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.avi") returned 0 [0062.902] lstrlenA (lpString="*.avi") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mp4") returned 0 [0062.902] lstrlenA (lpString="*.mp4") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.wmv") returned 0 [0062.902] lstrlenA (lpString="*.wmv") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.divx") returned 0 [0062.902] lstrlenA (lpString="*.divx") returned 6 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mkv") returned 0 [0062.902] lstrlenA (lpString="*.mkv") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.mp3") returned 0 [0062.902] lstrlenA (lpString="*.mp3") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.wav") returned 0 [0062.902] lstrlenA (lpString="*.wav") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.flac") returned 0 [0062.902] lstrlenA (lpString="*.flac") returned 6 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.ape") returned 0 [0062.902] lstrlenA (lpString="*.ape") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.wma") returned 0 [0062.902] lstrlenA (lpString="*.wma") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.ac3") returned 0 [0062.902] lstrlenA (lpString="*.ac3") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SetupUtility.exe", pszSpec="*.doc") returned 0 [0062.902] lstrlenA (lpString="*.doc") returned 5 [0062.902] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0062.903] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SplashScreen.bmp") returned -1 [0062.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SplashScreen.bmp") returned -1 [0062.903] lstrcmpiA (lpString1="", lpString2="SplashScreen.bmp") returned -1 [0062.903] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\SetupUtility.exe") returned="SetupUtility.exe" [0062.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.903] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.903] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.903] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.903] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="SplashScreen.bmp" | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp" [0062.903] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.zip") returned 0 [0062.903] lstrlenA (lpString="*.zip") returned 5 [0062.903] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.rar") returned 0 [0062.903] lstrlenA (lpString="*.rar") returned 5 [0062.903] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.7z") returned 0 [0062.903] lstrlenA (lpString="*.7z") returned 4 [0062.903] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.tar") returned 0 [0062.903] lstrlenA (lpString="*.tar") returned 5 [0062.903] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.gzip") returned 0 [0062.903] lstrlenA (lpString="*.gzip") returned 6 [0062.903] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.jpg") returned 0 [0062.903] lstrlenA (lpString="*.jpg") returned 5 [0062.903] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.jpeg") returned 0 [0062.903] lstrlenA (lpString="*.jpeg") returned 6 [0062.903] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.psd") returned 0 [0062.903] lstrlenA (lpString="*.psd") returned 5 [0062.903] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.cdr") returned 0 [0062.904] lstrlenA (lpString="*.cdr") returned 5 [0062.904] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.dwg") returned 0 [0062.904] lstrlenA (lpString="*.dwg") returned 5 [0062.904] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.max") returned 0 [0062.904] lstrlenA (lpString="*.max") returned 5 [0062.904] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\SplashScreen.bmp", pszSpec="*.bmp") returned 1 [0062.904] lstrlenA (lpString="*.bmp") returned 5 [0062.904] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\588bce7c90097ed212\\SplashScreen.bmp" | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp" [0062.904] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\588bce7c90097ed212\\SplashScreen.bmp" | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp" [0062.904] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp", lpString2="." | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp.") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp." [0062.904] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp.", lpString2="EnCiPhErEd" | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp.EnCiPhErEd") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp.EnCiPhErEd" [0062.904] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.904] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa078 [0062.904] GetFileTime (in: hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xce333000, dwHighDateTime=0x1ca2a28), lpLastAccessTime=0x407536*(dwLowDateTime=0xce333000, dwHighDateTime=0x1ca2a28), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce333000, dwHighDateTime=0x1ca2a28)) returned 1 [0062.904] SetFilePointer (in: hFile=0x204, lDistanceToMove=124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c [0062.904] ReadFile (in: hFile=0x204, lpBuffer=0x2143020, nNumberOfBytesToRead=0x1a8bf8, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2143020*, lpNumberOfBytesRead=0x40655d*=0x9ffc, lpOverlapped=0x0) returned 1 [0062.910] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="SplashScreen.bmp" [0062.911] SetFilePointer (in: hFile=0x204, lDistanceToMove=124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c [0062.911] WriteFile (in: hFile=0x204, lpBuffer=0x2143020*, nNumberOfBytesToWrite=0x9ffc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2143020*, lpNumberOfBytesWritten=0x406561*=0x9ffc, lpOverlapped=0x0) returned 1 [0062.911] SetFileTime (hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.911] CloseHandle (hObject=0x204) returned 1 [0062.913] MoveFileA (lpExistingFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.EnCiPhErEd" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.enciphered")) returned 1 [0062.914] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x13, dwReserved1=0x1, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0062.914] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.914] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sqmapi.dll") returned -1 [0062.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqmapi.dll") returned -1 [0062.914] lstrcmpiA (lpString1="", lpString2="sqmapi.dll") returned -1 [0062.914] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="SplashScreen.bmp" [0062.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.914] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.914] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.914] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.914] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="sqmapi.dll" | out: lpString1="C:\\588bce7c90097ed212\\sqmapi.dll") returned="C:\\588bce7c90097ed212\\sqmapi.dll" [0062.914] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.zip") returned 0 [0062.914] lstrlenA (lpString="*.zip") returned 5 [0062.914] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.rar") returned 0 [0062.914] lstrlenA (lpString="*.rar") returned 5 [0062.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.7z") returned 0 [0062.915] lstrlenA (lpString="*.7z") returned 4 [0062.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.tar") returned 0 [0062.915] lstrlenA (lpString="*.tar") returned 5 [0062.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.gzip") returned 0 [0062.915] lstrlenA (lpString="*.gzip") returned 6 [0062.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.jpg") returned 0 [0062.915] lstrlenA (lpString="*.jpg") returned 5 [0062.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.jpeg") returned 0 [0062.915] lstrlenA (lpString="*.jpeg") returned 6 [0062.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.psd") returned 0 [0062.915] lstrlenA (lpString="*.psd") returned 5 [0062.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.cdr") returned 0 [0062.915] lstrlenA (lpString="*.cdr") returned 5 [0062.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.dwg") returned 0 [0062.915] lstrlenA (lpString="*.dwg") returned 5 [0062.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.max") returned 0 [0062.915] lstrlenA (lpString="*.max") returned 5 [0062.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.bmp") returned 0 [0062.915] lstrlenA (lpString="*.bmp") returned 5 [0062.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.gif") returned 0 [0062.915] lstrlenA (lpString="*.gif") returned 5 [0062.915] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.png") returned 0 [0062.916] lstrlenA (lpString="*.png") returned 5 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.doc") returned 0 [0062.916] lstrlenA (lpString="*.doc") returned 5 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.docx") returned 0 [0062.916] lstrlenA (lpString="*.docx") returned 6 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.xls") returned 0 [0062.916] lstrlenA (lpString="*.xls") returned 5 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.xlsx") returned 0 [0062.916] lstrlenA (lpString="*.xlsx") returned 6 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.ppt") returned 0 [0062.916] lstrlenA (lpString="*.ppt") returned 5 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.pptx") returned 0 [0062.916] lstrlenA (lpString="*.pptx") returned 6 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.txt") returned 0 [0062.916] lstrlenA (lpString="*.txt") returned 5 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.pdf") returned 0 [0062.916] lstrlenA (lpString="*.pdf") returned 5 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.djvu") returned 0 [0062.916] lstrlenA (lpString="*.djvu") returned 6 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.htm") returned 0 [0062.916] lstrlenA (lpString="*.htm") returned 5 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.html") returned 0 [0062.916] lstrlenA (lpString="*.html") returned 6 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mdb") returned 0 [0062.916] lstrlenA (lpString="*.mdb") returned 5 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.cer") returned 0 [0062.916] lstrlenA (lpString="*.cer") returned 5 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.p12") returned 0 [0062.916] lstrlenA (lpString="*.p12") returned 5 [0062.916] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.pfx") returned 0 [0062.916] lstrlenA (lpString="*.pfx") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.kwm") returned 0 [0062.917] lstrlenA (lpString="*.kwm") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.pwm") returned 0 [0062.917] lstrlenA (lpString="*.pwm") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.1cd") returned 0 [0062.917] lstrlenA (lpString="*.1cd") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.md") returned 0 [0062.917] lstrlenA (lpString="*.md") returned 4 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mdf") returned 0 [0062.917] lstrlenA (lpString="*.mdf") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.dbf") returned 0 [0062.917] lstrlenA (lpString="*.dbf") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.odt") returned 0 [0062.917] lstrlenA (lpString="*.odt") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.vob") returned 0 [0062.917] lstrlenA (lpString="*.vob") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.ifo") returned 0 [0062.917] lstrlenA (lpString="*.ifo") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.lnk") returned 0 [0062.917] lstrlenA (lpString="*.lnk") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.torrent") returned 0 [0062.917] lstrlenA (lpString="*.torrent") returned 9 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mov") returned 0 [0062.917] lstrlenA (lpString="*.mov") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.m2v") returned 0 [0062.917] lstrlenA (lpString="*.m2v") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.3gp") returned 0 [0062.917] lstrlenA (lpString="*.3gp") returned 5 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mpeg") returned 0 [0062.917] lstrlenA (lpString="*.mpeg") returned 6 [0062.917] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mpg") returned 0 [0062.918] lstrlenA (lpString="*.mpg") returned 5 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.flv") returned 0 [0062.918] lstrlenA (lpString="*.flv") returned 5 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.avi") returned 0 [0062.918] lstrlenA (lpString="*.avi") returned 5 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mp4") returned 0 [0062.918] lstrlenA (lpString="*.mp4") returned 5 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.wmv") returned 0 [0062.918] lstrlenA (lpString="*.wmv") returned 5 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.divx") returned 0 [0062.918] lstrlenA (lpString="*.divx") returned 6 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mkv") returned 0 [0062.918] lstrlenA (lpString="*.mkv") returned 5 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.mp3") returned 0 [0062.918] lstrlenA (lpString="*.mp3") returned 5 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.wav") returned 0 [0062.918] lstrlenA (lpString="*.wav") returned 5 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.flac") returned 0 [0062.918] lstrlenA (lpString="*.flac") returned 6 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.ape") returned 0 [0062.918] lstrlenA (lpString="*.ape") returned 5 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.wma") returned 0 [0062.918] lstrlenA (lpString="*.wma") returned 5 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.ac3") returned 0 [0062.918] lstrlenA (lpString="*.ac3") returned 5 [0062.918] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\sqmapi.dll", pszSpec="*.doc") returned 0 [0062.918] lstrlenA (lpString="*.doc") returned 5 [0062.918] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0062.918] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.918] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Strings.xml") returned -1 [0062.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Strings.xml") returned -1 [0062.919] lstrcmpiA (lpString1="", lpString2="Strings.xml") returned -1 [0062.919] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\sqmapi.dll") returned="sqmapi.dll" [0062.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.919] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.919] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.919] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.919] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Strings.xml" | out: lpString1="C:\\588bce7c90097ed212\\Strings.xml") returned="C:\\588bce7c90097ed212\\Strings.xml" [0062.919] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.zip") returned 0 [0062.919] lstrlenA (lpString="*.zip") returned 5 [0062.919] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.rar") returned 0 [0062.919] lstrlenA (lpString="*.rar") returned 5 [0062.919] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.7z") returned 0 [0062.919] lstrlenA (lpString="*.7z") returned 4 [0062.919] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.tar") returned 0 [0062.919] lstrlenA (lpString="*.tar") returned 5 [0062.919] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.gzip") returned 0 [0062.919] lstrlenA (lpString="*.gzip") returned 6 [0062.919] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.jpg") returned 0 [0062.919] lstrlenA (lpString="*.jpg") returned 5 [0062.919] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.jpeg") returned 0 [0062.919] lstrlenA (lpString="*.jpeg") returned 6 [0062.919] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.psd") returned 0 [0062.919] lstrlenA (lpString="*.psd") returned 5 [0062.919] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.cdr") returned 0 [0062.920] lstrlenA (lpString="*.cdr") returned 5 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.dwg") returned 0 [0062.920] lstrlenA (lpString="*.dwg") returned 5 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.max") returned 0 [0062.920] lstrlenA (lpString="*.max") returned 5 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.bmp") returned 0 [0062.920] lstrlenA (lpString="*.bmp") returned 5 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.gif") returned 0 [0062.920] lstrlenA (lpString="*.gif") returned 5 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.png") returned 0 [0062.920] lstrlenA (lpString="*.png") returned 5 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.doc") returned 0 [0062.920] lstrlenA (lpString="*.doc") returned 5 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.docx") returned 0 [0062.920] lstrlenA (lpString="*.docx") returned 6 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.xls") returned 0 [0062.920] lstrlenA (lpString="*.xls") returned 5 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.xlsx") returned 0 [0062.920] lstrlenA (lpString="*.xlsx") returned 6 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.ppt") returned 0 [0062.920] lstrlenA (lpString="*.ppt") returned 5 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.pptx") returned 0 [0062.920] lstrlenA (lpString="*.pptx") returned 6 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.txt") returned 0 [0062.920] lstrlenA (lpString="*.txt") returned 5 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.pdf") returned 0 [0062.920] lstrlenA (lpString="*.pdf") returned 5 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.djvu") returned 0 [0062.920] lstrlenA (lpString="*.djvu") returned 6 [0062.920] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.htm") returned 0 [0062.920] lstrlenA (lpString="*.htm") returned 5 [0062.921] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.html") returned 0 [0062.921] lstrlenA (lpString="*.html") returned 6 [0062.921] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mdb") returned 0 [0062.921] lstrlenA (lpString="*.mdb") returned 5 [0062.921] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.cer") returned 0 [0062.921] lstrlenA (lpString="*.cer") returned 5 [0062.921] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.p12") returned 0 [0062.921] lstrlenA (lpString="*.p12") returned 5 [0062.921] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.pfx") returned 0 [0062.921] lstrlenA (lpString="*.pfx") returned 5 [0062.921] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.kwm") returned 0 [0062.921] lstrlenA (lpString="*.kwm") returned 5 [0062.921] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.pwm") returned 0 [0062.921] lstrlenA (lpString="*.pwm") returned 5 [0062.921] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.1cd") returned 0 [0062.921] lstrlenA (lpString="*.1cd") returned 5 [0062.921] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.md") returned 0 [0062.921] lstrlenA (lpString="*.md") returned 4 [0062.921] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mdf") returned 0 [0062.922] lstrlenA (lpString="*.mdf") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.dbf") returned 0 [0062.922] lstrlenA (lpString="*.dbf") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.odt") returned 0 [0062.922] lstrlenA (lpString="*.odt") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.vob") returned 0 [0062.922] lstrlenA (lpString="*.vob") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.ifo") returned 0 [0062.922] lstrlenA (lpString="*.ifo") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.lnk") returned 0 [0062.922] lstrlenA (lpString="*.lnk") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.torrent") returned 0 [0062.922] lstrlenA (lpString="*.torrent") returned 9 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mov") returned 0 [0062.922] lstrlenA (lpString="*.mov") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.m2v") returned 0 [0062.922] lstrlenA (lpString="*.m2v") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.3gp") returned 0 [0062.922] lstrlenA (lpString="*.3gp") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mpeg") returned 0 [0062.922] lstrlenA (lpString="*.mpeg") returned 6 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mpg") returned 0 [0062.922] lstrlenA (lpString="*.mpg") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.flv") returned 0 [0062.922] lstrlenA (lpString="*.flv") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.avi") returned 0 [0062.922] lstrlenA (lpString="*.avi") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mp4") returned 0 [0062.922] lstrlenA (lpString="*.mp4") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.wmv") returned 0 [0062.922] lstrlenA (lpString="*.wmv") returned 5 [0062.922] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.divx") returned 0 [0062.923] lstrlenA (lpString="*.divx") returned 6 [0062.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mkv") returned 0 [0062.923] lstrlenA (lpString="*.mkv") returned 5 [0062.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.mp3") returned 0 [0062.923] lstrlenA (lpString="*.mp3") returned 5 [0062.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.wav") returned 0 [0062.923] lstrlenA (lpString="*.wav") returned 5 [0062.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.flac") returned 0 [0062.923] lstrlenA (lpString="*.flac") returned 6 [0062.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.ape") returned 0 [0062.923] lstrlenA (lpString="*.ape") returned 5 [0062.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.wma") returned 0 [0062.923] lstrlenA (lpString="*.wma") returned 5 [0062.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.ac3") returned 0 [0062.923] lstrlenA (lpString="*.ac3") returned 5 [0062.923] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Strings.xml", pszSpec="*.doc") returned 0 [0062.923] lstrlenA (lpString="*.doc") returned 5 [0062.923] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0062.923] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.923] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UiInfo.xml") returned -1 [0062.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UiInfo.xml") returned -1 [0062.923] lstrcmpiA (lpString1="", lpString2="UiInfo.xml") returned -1 [0062.923] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Strings.xml") returned="Strings.xml" [0062.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.923] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.923] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.923] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.924] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\UiInfo.xml" [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.zip") returned 0 [0062.924] lstrlenA (lpString="*.zip") returned 5 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.rar") returned 0 [0062.924] lstrlenA (lpString="*.rar") returned 5 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.7z") returned 0 [0062.924] lstrlenA (lpString="*.7z") returned 4 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.tar") returned 0 [0062.924] lstrlenA (lpString="*.tar") returned 5 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.gzip") returned 0 [0062.924] lstrlenA (lpString="*.gzip") returned 6 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.jpg") returned 0 [0062.924] lstrlenA (lpString="*.jpg") returned 5 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.jpeg") returned 0 [0062.924] lstrlenA (lpString="*.jpeg") returned 6 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.psd") returned 0 [0062.924] lstrlenA (lpString="*.psd") returned 5 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.cdr") returned 0 [0062.924] lstrlenA (lpString="*.cdr") returned 5 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.dwg") returned 0 [0062.924] lstrlenA (lpString="*.dwg") returned 5 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.max") returned 0 [0062.924] lstrlenA (lpString="*.max") returned 5 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.bmp") returned 0 [0062.924] lstrlenA (lpString="*.bmp") returned 5 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.gif") returned 0 [0062.924] lstrlenA (lpString="*.gif") returned 5 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.png") returned 0 [0062.924] lstrlenA (lpString="*.png") returned 5 [0062.924] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.doc") returned 0 [0062.924] lstrlenA (lpString="*.doc") returned 5 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.docx") returned 0 [0062.925] lstrlenA (lpString="*.docx") returned 6 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.xls") returned 0 [0062.925] lstrlenA (lpString="*.xls") returned 5 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.xlsx") returned 0 [0062.925] lstrlenA (lpString="*.xlsx") returned 6 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.ppt") returned 0 [0062.925] lstrlenA (lpString="*.ppt") returned 5 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.pptx") returned 0 [0062.925] lstrlenA (lpString="*.pptx") returned 6 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.txt") returned 0 [0062.925] lstrlenA (lpString="*.txt") returned 5 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.pdf") returned 0 [0062.925] lstrlenA (lpString="*.pdf") returned 5 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.djvu") returned 0 [0062.925] lstrlenA (lpString="*.djvu") returned 6 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.htm") returned 0 [0062.925] lstrlenA (lpString="*.htm") returned 5 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.html") returned 0 [0062.925] lstrlenA (lpString="*.html") returned 6 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mdb") returned 0 [0062.925] lstrlenA (lpString="*.mdb") returned 5 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.cer") returned 0 [0062.925] lstrlenA (lpString="*.cer") returned 5 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.p12") returned 0 [0062.925] lstrlenA (lpString="*.p12") returned 5 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.pfx") returned 0 [0062.925] lstrlenA (lpString="*.pfx") returned 5 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.kwm") returned 0 [0062.925] lstrlenA (lpString="*.kwm") returned 5 [0062.925] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.pwm") returned 0 [0062.926] lstrlenA (lpString="*.pwm") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.1cd") returned 0 [0062.926] lstrlenA (lpString="*.1cd") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.md") returned 0 [0062.926] lstrlenA (lpString="*.md") returned 4 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mdf") returned 0 [0062.926] lstrlenA (lpString="*.mdf") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.dbf") returned 0 [0062.926] lstrlenA (lpString="*.dbf") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.odt") returned 0 [0062.926] lstrlenA (lpString="*.odt") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.vob") returned 0 [0062.926] lstrlenA (lpString="*.vob") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.ifo") returned 0 [0062.926] lstrlenA (lpString="*.ifo") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.lnk") returned 0 [0062.926] lstrlenA (lpString="*.lnk") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.torrent") returned 0 [0062.926] lstrlenA (lpString="*.torrent") returned 9 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mov") returned 0 [0062.926] lstrlenA (lpString="*.mov") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.m2v") returned 0 [0062.926] lstrlenA (lpString="*.m2v") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.3gp") returned 0 [0062.926] lstrlenA (lpString="*.3gp") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mpeg") returned 0 [0062.926] lstrlenA (lpString="*.mpeg") returned 6 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mpg") returned 0 [0062.926] lstrlenA (lpString="*.mpg") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.flv") returned 0 [0062.926] lstrlenA (lpString="*.flv") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.avi") returned 0 [0062.926] lstrlenA (lpString="*.avi") returned 5 [0062.926] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mp4") returned 0 [0062.927] lstrlenA (lpString="*.mp4") returned 5 [0062.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.wmv") returned 0 [0062.927] lstrlenA (lpString="*.wmv") returned 5 [0062.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.divx") returned 0 [0062.927] lstrlenA (lpString="*.divx") returned 6 [0062.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mkv") returned 0 [0062.927] lstrlenA (lpString="*.mkv") returned 5 [0062.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.mp3") returned 0 [0062.927] lstrlenA (lpString="*.mp3") returned 5 [0062.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.wav") returned 0 [0062.927] lstrlenA (lpString="*.wav") returned 5 [0062.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.flac") returned 0 [0062.927] lstrlenA (lpString="*.flac") returned 6 [0062.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.ape") returned 0 [0062.927] lstrlenA (lpString="*.ape") returned 5 [0062.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.wma") returned 0 [0062.927] lstrlenA (lpString="*.wma") returned 5 [0062.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.ac3") returned 0 [0062.927] lstrlenA (lpString="*.ac3") returned 5 [0062.927] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\UiInfo.xml", pszSpec="*.doc") returned 0 [0062.927] lstrlenA (lpString="*.doc") returned 5 [0062.927] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0062.927] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.927] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="watermark.bmp") returned -1 [0062.927] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="watermark.bmp") returned -1 [0062.927] lstrcmpiA (lpString1="", lpString2="watermark.bmp") returned -1 [0062.927] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\UiInfo.xml") returned="UiInfo.xml" [0062.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.927] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.927] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.927] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.928] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="watermark.bmp" | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp") returned="C:\\588bce7c90097ed212\\watermark.bmp" [0062.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.zip") returned 0 [0062.928] lstrlenA (lpString="*.zip") returned 5 [0062.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.rar") returned 0 [0062.928] lstrlenA (lpString="*.rar") returned 5 [0062.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.7z") returned 0 [0062.928] lstrlenA (lpString="*.7z") returned 4 [0062.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.tar") returned 0 [0062.928] lstrlenA (lpString="*.tar") returned 5 [0062.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.gzip") returned 0 [0062.928] lstrlenA (lpString="*.gzip") returned 6 [0062.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.jpg") returned 0 [0062.928] lstrlenA (lpString="*.jpg") returned 5 [0062.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.jpeg") returned 0 [0062.928] lstrlenA (lpString="*.jpeg") returned 6 [0062.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.psd") returned 0 [0062.928] lstrlenA (lpString="*.psd") returned 5 [0062.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.cdr") returned 0 [0062.928] lstrlenA (lpString="*.cdr") returned 5 [0062.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.dwg") returned 0 [0062.928] lstrlenA (lpString="*.dwg") returned 5 [0062.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.max") returned 0 [0062.928] lstrlenA (lpString="*.max") returned 5 [0062.928] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\watermark.bmp", pszSpec="*.bmp") returned 1 [0062.928] lstrlenA (lpString="*.bmp") returned 5 [0062.928] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\588bce7c90097ed212\\watermark.bmp" | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp") returned="C:\\588bce7c90097ed212\\watermark.bmp" [0062.928] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\588bce7c90097ed212\\watermark.bmp" | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp") returned="C:\\588bce7c90097ed212\\watermark.bmp" [0062.928] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\watermark.bmp", lpString2="." | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp.") returned="C:\\588bce7c90097ed212\\watermark.bmp." [0062.928] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\watermark.bmp.", lpString2="EnCiPhErEd" | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp.EnCiPhErEd") returned="C:\\588bce7c90097ed212\\watermark.bmp.EnCiPhErEd" [0062.928] CreateFileA (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.929] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19688 [0062.929] GetFileTime (in: hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x87910600, dwHighDateTime=0x1ca2a27), lpLastAccessTime=0x407536*(dwLowDateTime=0x87910600, dwHighDateTime=0x1ca2a27), lpLastWriteTime=0x40753e*(dwLowDateTime=0x87910600, dwHighDateTime=0x1ca2a27)) returned 1 [0062.929] SetFilePointer (in: hFile=0x204, lDistanceToMove=124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c [0062.929] ReadFile (in: hFile=0x204, lpBuffer=0x2143020, nNumberOfBytesToRead=0x1a8bf8, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2143020*, lpNumberOfBytesRead=0x40655d*=0x1960c, lpOverlapped=0x0) returned 1 [0062.948] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\watermark.bmp") returned="watermark.bmp" [0062.948] SetFilePointer (in: hFile=0x204, lDistanceToMove=124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c [0062.948] WriteFile (in: hFile=0x204, lpBuffer=0x2143020*, nNumberOfBytesToWrite=0x1960c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2143020*, lpNumberOfBytesWritten=0x406561*=0x1960c, lpOverlapped=0x0) returned 1 [0062.948] SetFileTime (hFile=0x204, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.949] CloseHandle (hObject=0x204) returned 1 [0062.951] MoveFileA (lpExistingFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\watermark.bmp.EnCiPhErEd" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.enciphered")) returned 1 [0062.952] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x1, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0062.952] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.952] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Windows6.0-KB956250-v6001-x64.msu") returned -1 [0062.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows6.0-KB956250-v6001-x64.msu") returned -1 [0062.953] lstrcmpiA (lpString1="", lpString2="Windows6.0-KB956250-v6001-x64.msu") returned -1 [0062.953] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\watermark.bmp") returned="watermark.bmp" [0062.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.954] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.954] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.954] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.954] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Windows6.0-KB956250-v6001-x64.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.zip") returned 0 [0062.954] lstrlenA (lpString="*.zip") returned 5 [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.rar") returned 0 [0062.954] lstrlenA (lpString="*.rar") returned 5 [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.7z") returned 0 [0062.954] lstrlenA (lpString="*.7z") returned 4 [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.tar") returned 0 [0062.954] lstrlenA (lpString="*.tar") returned 5 [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.gzip") returned 0 [0062.954] lstrlenA (lpString="*.gzip") returned 6 [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.jpg") returned 0 [0062.954] lstrlenA (lpString="*.jpg") returned 5 [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.jpeg") returned 0 [0062.954] lstrlenA (lpString="*.jpeg") returned 6 [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.psd") returned 0 [0062.954] lstrlenA (lpString="*.psd") returned 5 [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.cdr") returned 0 [0062.954] lstrlenA (lpString="*.cdr") returned 5 [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.dwg") returned 0 [0062.954] lstrlenA (lpString="*.dwg") returned 5 [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.max") returned 0 [0062.954] lstrlenA (lpString="*.max") returned 5 [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.bmp") returned 0 [0062.954] lstrlenA (lpString="*.bmp") returned 5 [0062.954] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.gif") returned 0 [0062.955] lstrlenA (lpString="*.gif") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.png") returned 0 [0062.955] lstrlenA (lpString="*.png") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.doc") returned 0 [0062.955] lstrlenA (lpString="*.doc") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.docx") returned 0 [0062.955] lstrlenA (lpString="*.docx") returned 6 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.xls") returned 0 [0062.955] lstrlenA (lpString="*.xls") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.xlsx") returned 0 [0062.955] lstrlenA (lpString="*.xlsx") returned 6 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.ppt") returned 0 [0062.955] lstrlenA (lpString="*.ppt") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.pptx") returned 0 [0062.955] lstrlenA (lpString="*.pptx") returned 6 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.txt") returned 0 [0062.955] lstrlenA (lpString="*.txt") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.pdf") returned 0 [0062.955] lstrlenA (lpString="*.pdf") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.djvu") returned 0 [0062.955] lstrlenA (lpString="*.djvu") returned 6 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.htm") returned 0 [0062.955] lstrlenA (lpString="*.htm") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.html") returned 0 [0062.955] lstrlenA (lpString="*.html") returned 6 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mdb") returned 0 [0062.955] lstrlenA (lpString="*.mdb") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.cer") returned 0 [0062.955] lstrlenA (lpString="*.cer") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.p12") returned 0 [0062.955] lstrlenA (lpString="*.p12") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.pfx") returned 0 [0062.955] lstrlenA (lpString="*.pfx") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.kwm") returned 0 [0062.955] lstrlenA (lpString="*.kwm") returned 5 [0062.955] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.pwm") returned 0 [0062.956] lstrlenA (lpString="*.pwm") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.1cd") returned 0 [0062.956] lstrlenA (lpString="*.1cd") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.md") returned 0 [0062.956] lstrlenA (lpString="*.md") returned 4 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mdf") returned 0 [0062.956] lstrlenA (lpString="*.mdf") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.dbf") returned 0 [0062.956] lstrlenA (lpString="*.dbf") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.odt") returned 0 [0062.956] lstrlenA (lpString="*.odt") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.vob") returned 0 [0062.956] lstrlenA (lpString="*.vob") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.ifo") returned 0 [0062.956] lstrlenA (lpString="*.ifo") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.lnk") returned 0 [0062.956] lstrlenA (lpString="*.lnk") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.torrent") returned 0 [0062.956] lstrlenA (lpString="*.torrent") returned 9 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mov") returned 0 [0062.956] lstrlenA (lpString="*.mov") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.m2v") returned 0 [0062.956] lstrlenA (lpString="*.m2v") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.3gp") returned 0 [0062.956] lstrlenA (lpString="*.3gp") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mpeg") returned 0 [0062.956] lstrlenA (lpString="*.mpeg") returned 6 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mpg") returned 0 [0062.956] lstrlenA (lpString="*.mpg") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.flv") returned 0 [0062.956] lstrlenA (lpString="*.flv") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.avi") returned 0 [0062.956] lstrlenA (lpString="*.avi") returned 5 [0062.956] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mp4") returned 0 [0062.956] lstrlenA (lpString="*.mp4") returned 5 [0062.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.wmv") returned 0 [0062.957] lstrlenA (lpString="*.wmv") returned 5 [0062.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.divx") returned 0 [0062.957] lstrlenA (lpString="*.divx") returned 6 [0062.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mkv") returned 0 [0062.957] lstrlenA (lpString="*.mkv") returned 5 [0062.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.mp3") returned 0 [0062.957] lstrlenA (lpString="*.mp3") returned 5 [0062.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.wav") returned 0 [0062.957] lstrlenA (lpString="*.wav") returned 5 [0062.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.flac") returned 0 [0062.957] lstrlenA (lpString="*.flac") returned 6 [0062.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.ape") returned 0 [0062.957] lstrlenA (lpString="*.ape") returned 5 [0062.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.wma") returned 0 [0062.957] lstrlenA (lpString="*.wma") returned 5 [0062.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.ac3") returned 0 [0062.957] lstrlenA (lpString="*.ac3") returned 5 [0062.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", pszSpec="*.doc") returned 0 [0062.957] lstrlenA (lpString="*.doc") returned 5 [0062.957] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0062.957] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Windows6.0-KB956250-v6001-x86.msu") returned -1 [0062.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows6.0-KB956250-v6001-x86.msu") returned -1 [0062.957] lstrcmpiA (lpString1="", lpString2="Windows6.0-KB956250-v6001-x86.msu") returned -1 [0062.957] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned="Windows6.0-KB956250-v6001-x64.msu" [0062.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.957] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.957] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.957] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.957] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Windows6.0-KB956250-v6001-x86.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" [0062.957] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.zip") returned 0 [0062.958] lstrlenA (lpString="*.zip") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.rar") returned 0 [0062.958] lstrlenA (lpString="*.rar") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.7z") returned 0 [0062.958] lstrlenA (lpString="*.7z") returned 4 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.tar") returned 0 [0062.958] lstrlenA (lpString="*.tar") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.gzip") returned 0 [0062.958] lstrlenA (lpString="*.gzip") returned 6 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.jpg") returned 0 [0062.958] lstrlenA (lpString="*.jpg") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.jpeg") returned 0 [0062.958] lstrlenA (lpString="*.jpeg") returned 6 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.psd") returned 0 [0062.958] lstrlenA (lpString="*.psd") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.cdr") returned 0 [0062.958] lstrlenA (lpString="*.cdr") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.dwg") returned 0 [0062.958] lstrlenA (lpString="*.dwg") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.max") returned 0 [0062.958] lstrlenA (lpString="*.max") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.bmp") returned 0 [0062.958] lstrlenA (lpString="*.bmp") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.gif") returned 0 [0062.958] lstrlenA (lpString="*.gif") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.png") returned 0 [0062.958] lstrlenA (lpString="*.png") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.doc") returned 0 [0062.958] lstrlenA (lpString="*.doc") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.docx") returned 0 [0062.958] lstrlenA (lpString="*.docx") returned 6 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.xls") returned 0 [0062.958] lstrlenA (lpString="*.xls") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.xlsx") returned 0 [0062.958] lstrlenA (lpString="*.xlsx") returned 6 [0062.958] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.ppt") returned 0 [0062.959] lstrlenA (lpString="*.ppt") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.pptx") returned 0 [0062.959] lstrlenA (lpString="*.pptx") returned 6 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.txt") returned 0 [0062.959] lstrlenA (lpString="*.txt") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.pdf") returned 0 [0062.959] lstrlenA (lpString="*.pdf") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.djvu") returned 0 [0062.959] lstrlenA (lpString="*.djvu") returned 6 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.htm") returned 0 [0062.959] lstrlenA (lpString="*.htm") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.html") returned 0 [0062.959] lstrlenA (lpString="*.html") returned 6 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mdb") returned 0 [0062.959] lstrlenA (lpString="*.mdb") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.cer") returned 0 [0062.959] lstrlenA (lpString="*.cer") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.p12") returned 0 [0062.959] lstrlenA (lpString="*.p12") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.pfx") returned 0 [0062.959] lstrlenA (lpString="*.pfx") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.kwm") returned 0 [0062.959] lstrlenA (lpString="*.kwm") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.pwm") returned 0 [0062.959] lstrlenA (lpString="*.pwm") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.1cd") returned 0 [0062.959] lstrlenA (lpString="*.1cd") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.md") returned 0 [0062.959] lstrlenA (lpString="*.md") returned 4 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mdf") returned 0 [0062.959] lstrlenA (lpString="*.mdf") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.dbf") returned 0 [0062.959] lstrlenA (lpString="*.dbf") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.odt") returned 0 [0062.959] lstrlenA (lpString="*.odt") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.vob") returned 0 [0062.960] lstrlenA (lpString="*.vob") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.ifo") returned 0 [0062.960] lstrlenA (lpString="*.ifo") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.lnk") returned 0 [0062.960] lstrlenA (lpString="*.lnk") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.torrent") returned 0 [0062.960] lstrlenA (lpString="*.torrent") returned 9 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mov") returned 0 [0062.960] lstrlenA (lpString="*.mov") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.m2v") returned 0 [0062.960] lstrlenA (lpString="*.m2v") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.3gp") returned 0 [0062.960] lstrlenA (lpString="*.3gp") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mpeg") returned 0 [0062.960] lstrlenA (lpString="*.mpeg") returned 6 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mpg") returned 0 [0062.960] lstrlenA (lpString="*.mpg") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.flv") returned 0 [0062.960] lstrlenA (lpString="*.flv") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.avi") returned 0 [0062.960] lstrlenA (lpString="*.avi") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mp4") returned 0 [0062.960] lstrlenA (lpString="*.mp4") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.wmv") returned 0 [0062.960] lstrlenA (lpString="*.wmv") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.divx") returned 0 [0062.960] lstrlenA (lpString="*.divx") returned 6 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mkv") returned 0 [0062.960] lstrlenA (lpString="*.mkv") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.mp3") returned 0 [0062.960] lstrlenA (lpString="*.mp3") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.wav") returned 0 [0062.960] lstrlenA (lpString="*.wav") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.flac") returned 0 [0062.960] lstrlenA (lpString="*.flac") returned 6 [0062.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.ape") returned 0 [0062.961] lstrlenA (lpString="*.ape") returned 5 [0062.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.wma") returned 0 [0062.961] lstrlenA (lpString="*.wma") returned 5 [0062.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.ac3") returned 0 [0062.961] lstrlenA (lpString="*.ac3") returned 5 [0062.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", pszSpec="*.doc") returned 0 [0062.961] lstrlenA (lpString="*.doc") returned 5 [0062.961] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0062.961] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Windows6.1-KB958488-v6001-x64.msu") returned -1 [0062.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows6.1-KB958488-v6001-x64.msu") returned -1 [0062.961] lstrcmpiA (lpString1="", lpString2="Windows6.1-KB958488-v6001-x64.msu") returned -1 [0062.961] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned="Windows6.0-KB956250-v6001-x86.msu" [0062.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.961] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.961] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.961] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.961] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Windows6.1-KB958488-v6001-x64.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" [0062.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.zip") returned 0 [0062.961] lstrlenA (lpString="*.zip") returned 5 [0062.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.rar") returned 0 [0062.961] lstrlenA (lpString="*.rar") returned 5 [0062.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.7z") returned 0 [0062.961] lstrlenA (lpString="*.7z") returned 4 [0062.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.tar") returned 0 [0062.961] lstrlenA (lpString="*.tar") returned 5 [0062.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.gzip") returned 0 [0062.961] lstrlenA (lpString="*.gzip") returned 6 [0062.961] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.jpg") returned 0 [0062.961] lstrlenA (lpString="*.jpg") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.jpeg") returned 0 [0062.962] lstrlenA (lpString="*.jpeg") returned 6 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.psd") returned 0 [0062.962] lstrlenA (lpString="*.psd") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.cdr") returned 0 [0062.962] lstrlenA (lpString="*.cdr") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.dwg") returned 0 [0062.962] lstrlenA (lpString="*.dwg") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.max") returned 0 [0062.962] lstrlenA (lpString="*.max") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.bmp") returned 0 [0062.962] lstrlenA (lpString="*.bmp") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.gif") returned 0 [0062.962] lstrlenA (lpString="*.gif") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.png") returned 0 [0062.962] lstrlenA (lpString="*.png") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.doc") returned 0 [0062.962] lstrlenA (lpString="*.doc") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.docx") returned 0 [0062.962] lstrlenA (lpString="*.docx") returned 6 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.xls") returned 0 [0062.962] lstrlenA (lpString="*.xls") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.xlsx") returned 0 [0062.962] lstrlenA (lpString="*.xlsx") returned 6 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.ppt") returned 0 [0062.962] lstrlenA (lpString="*.ppt") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.pptx") returned 0 [0062.962] lstrlenA (lpString="*.pptx") returned 6 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.txt") returned 0 [0062.962] lstrlenA (lpString="*.txt") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.pdf") returned 0 [0062.962] lstrlenA (lpString="*.pdf") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.djvu") returned 0 [0062.962] lstrlenA (lpString="*.djvu") returned 6 [0062.962] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.htm") returned 0 [0062.963] lstrlenA (lpString="*.htm") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.html") returned 0 [0062.963] lstrlenA (lpString="*.html") returned 6 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mdb") returned 0 [0062.963] lstrlenA (lpString="*.mdb") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.cer") returned 0 [0062.963] lstrlenA (lpString="*.cer") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.p12") returned 0 [0062.963] lstrlenA (lpString="*.p12") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.pfx") returned 0 [0062.963] lstrlenA (lpString="*.pfx") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.kwm") returned 0 [0062.963] lstrlenA (lpString="*.kwm") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.pwm") returned 0 [0062.963] lstrlenA (lpString="*.pwm") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.1cd") returned 0 [0062.963] lstrlenA (lpString="*.1cd") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.md") returned 0 [0062.963] lstrlenA (lpString="*.md") returned 4 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mdf") returned 0 [0062.963] lstrlenA (lpString="*.mdf") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.dbf") returned 0 [0062.963] lstrlenA (lpString="*.dbf") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.odt") returned 0 [0062.963] lstrlenA (lpString="*.odt") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.vob") returned 0 [0062.963] lstrlenA (lpString="*.vob") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.ifo") returned 0 [0062.963] lstrlenA (lpString="*.ifo") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.lnk") returned 0 [0062.963] lstrlenA (lpString="*.lnk") returned 5 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.torrent") returned 0 [0062.963] lstrlenA (lpString="*.torrent") returned 9 [0062.963] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mov") returned 0 [0062.964] lstrlenA (lpString="*.mov") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.m2v") returned 0 [0062.964] lstrlenA (lpString="*.m2v") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.3gp") returned 0 [0062.964] lstrlenA (lpString="*.3gp") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mpeg") returned 0 [0062.964] lstrlenA (lpString="*.mpeg") returned 6 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mpg") returned 0 [0062.964] lstrlenA (lpString="*.mpg") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.flv") returned 0 [0062.964] lstrlenA (lpString="*.flv") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.avi") returned 0 [0062.964] lstrlenA (lpString="*.avi") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mp4") returned 0 [0062.964] lstrlenA (lpString="*.mp4") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.wmv") returned 0 [0062.964] lstrlenA (lpString="*.wmv") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.divx") returned 0 [0062.964] lstrlenA (lpString="*.divx") returned 6 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mkv") returned 0 [0062.964] lstrlenA (lpString="*.mkv") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.mp3") returned 0 [0062.964] lstrlenA (lpString="*.mp3") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.wav") returned 0 [0062.964] lstrlenA (lpString="*.wav") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.flac") returned 0 [0062.964] lstrlenA (lpString="*.flac") returned 6 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.ape") returned 0 [0062.964] lstrlenA (lpString="*.ape") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.wma") returned 0 [0062.964] lstrlenA (lpString="*.wma") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.ac3") returned 0 [0062.964] lstrlenA (lpString="*.ac3") returned 5 [0062.964] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", pszSpec="*.doc") returned 0 [0062.964] lstrlenA (lpString="*.doc") returned 5 [0062.964] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0062.965] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Windows6.1-KB958488-v6001-x86.msu") returned -1 [0062.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows6.1-KB958488-v6001-x86.msu") returned -1 [0062.965] lstrcmpiA (lpString1="", lpString2="Windows6.1-KB958488-v6001-x86.msu") returned -1 [0062.965] PathFindFileNameA (pszPath="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned="Windows6.1-KB958488-v6001-x64.msu" [0062.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0062.965] PathAddBackslashA (in: pszPath="C:\\588bce7c90097ed212\\" | out: pszPath="C:\\588bce7c90097ed212\\") returned="" [0062.965] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt") returned="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" [0062.965] GetFileAttributesA (lpFileName="C:\\588bce7c90097ed212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\588bce7c90097ed212\\how to decrypt files.txt")) returned 0x20 [0062.965] lstrcatA (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Windows6.1-KB958488-v6001-x86.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" [0062.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.zip") returned 0 [0062.965] lstrlenA (lpString="*.zip") returned 5 [0062.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.rar") returned 0 [0062.965] lstrlenA (lpString="*.rar") returned 5 [0062.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.7z") returned 0 [0062.965] lstrlenA (lpString="*.7z") returned 4 [0062.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.tar") returned 0 [0062.965] lstrlenA (lpString="*.tar") returned 5 [0062.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.gzip") returned 0 [0062.965] lstrlenA (lpString="*.gzip") returned 6 [0062.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.jpg") returned 0 [0062.965] lstrlenA (lpString="*.jpg") returned 5 [0062.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.jpeg") returned 0 [0062.965] lstrlenA (lpString="*.jpeg") returned 6 [0062.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.psd") returned 0 [0062.965] lstrlenA (lpString="*.psd") returned 5 [0062.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.cdr") returned 0 [0062.965] lstrlenA (lpString="*.cdr") returned 5 [0062.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.dwg") returned 0 [0062.965] lstrlenA (lpString="*.dwg") returned 5 [0062.965] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.max") returned 0 [0062.966] lstrlenA (lpString="*.max") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.bmp") returned 0 [0062.966] lstrlenA (lpString="*.bmp") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.gif") returned 0 [0062.966] lstrlenA (lpString="*.gif") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.png") returned 0 [0062.966] lstrlenA (lpString="*.png") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.doc") returned 0 [0062.966] lstrlenA (lpString="*.doc") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.docx") returned 0 [0062.966] lstrlenA (lpString="*.docx") returned 6 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.xls") returned 0 [0062.966] lstrlenA (lpString="*.xls") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.xlsx") returned 0 [0062.966] lstrlenA (lpString="*.xlsx") returned 6 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.ppt") returned 0 [0062.966] lstrlenA (lpString="*.ppt") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.pptx") returned 0 [0062.966] lstrlenA (lpString="*.pptx") returned 6 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.txt") returned 0 [0062.966] lstrlenA (lpString="*.txt") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.pdf") returned 0 [0062.966] lstrlenA (lpString="*.pdf") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.djvu") returned 0 [0062.966] lstrlenA (lpString="*.djvu") returned 6 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.htm") returned 0 [0062.966] lstrlenA (lpString="*.htm") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.html") returned 0 [0062.966] lstrlenA (lpString="*.html") returned 6 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mdb") returned 0 [0062.966] lstrlenA (lpString="*.mdb") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.cer") returned 0 [0062.966] lstrlenA (lpString="*.cer") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.p12") returned 0 [0062.966] lstrlenA (lpString="*.p12") returned 5 [0062.966] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.pfx") returned 0 [0062.967] lstrlenA (lpString="*.pfx") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.kwm") returned 0 [0062.967] lstrlenA (lpString="*.kwm") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.pwm") returned 0 [0062.967] lstrlenA (lpString="*.pwm") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.1cd") returned 0 [0062.967] lstrlenA (lpString="*.1cd") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.md") returned 0 [0062.967] lstrlenA (lpString="*.md") returned 4 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mdf") returned 0 [0062.967] lstrlenA (lpString="*.mdf") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.dbf") returned 0 [0062.967] lstrlenA (lpString="*.dbf") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.odt") returned 0 [0062.967] lstrlenA (lpString="*.odt") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.vob") returned 0 [0062.967] lstrlenA (lpString="*.vob") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.ifo") returned 0 [0062.967] lstrlenA (lpString="*.ifo") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.lnk") returned 0 [0062.967] lstrlenA (lpString="*.lnk") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.torrent") returned 0 [0062.967] lstrlenA (lpString="*.torrent") returned 9 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mov") returned 0 [0062.967] lstrlenA (lpString="*.mov") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.m2v") returned 0 [0062.967] lstrlenA (lpString="*.m2v") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.3gp") returned 0 [0062.967] lstrlenA (lpString="*.3gp") returned 5 [0062.967] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mpeg") returned 0 [0062.968] lstrlenA (lpString="*.mpeg") returned 6 [0062.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mpg") returned 0 [0062.968] lstrlenA (lpString="*.mpg") returned 5 [0062.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.flv") returned 0 [0062.968] lstrlenA (lpString="*.flv") returned 5 [0062.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.avi") returned 0 [0062.968] lstrlenA (lpString="*.avi") returned 5 [0062.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mp4") returned 0 [0062.968] lstrlenA (lpString="*.mp4") returned 5 [0062.968] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.wmv") returned 0 [0062.968] lstrlenA (lpString="*.wmv") returned 5 [0062.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.divx") returned 0 [0062.969] lstrlenA (lpString="*.divx") returned 6 [0062.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mkv") returned 0 [0062.969] lstrlenA (lpString="*.mkv") returned 5 [0062.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.mp3") returned 0 [0062.969] lstrlenA (lpString="*.mp3") returned 5 [0062.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.wav") returned 0 [0062.969] lstrlenA (lpString="*.wav") returned 5 [0062.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.flac") returned 0 [0062.969] lstrlenA (lpString="*.flac") returned 6 [0062.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.ape") returned 0 [0062.969] lstrlenA (lpString="*.ape") returned 5 [0062.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.wma") returned 0 [0062.969] lstrlenA (lpString="*.wma") returned 5 [0062.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.ac3") returned 0 [0062.969] lstrlenA (lpString="*.ac3") returned 5 [0062.969] PathMatchSpecA (pszFile="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", pszSpec="*.doc") returned 0 [0062.969] lstrlenA (lpString="*.doc") returned 5 [0062.969] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0062.969] FindClose (in: hFindFile=0x759ed0 | out: hFindFile=0x759ed0) returned 1 [0062.969] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="Boot", cAlternateFileName="")) returned 1 [0062.969] lstrcmpA (lpString1=".", lpString2="Boot") returned -1 [0062.969] lstrcmpA (lpString1="..", lpString2="Boot") returned -1 [0062.969] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0062.969] lstrcatA (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0062.969] lstrlenA (lpString="C:\\Boot") returned 7 [0062.969] FindFirstFileA (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0062.970] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.970] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.971] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.971] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.971] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0062.971] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.971] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD") returned 1 [0062.971] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD") returned 1 [0062.971] lstrcmpiA (lpString1="", lpString2="BCD") returned -1 [0062.971] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0062.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0062.971] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0062.972] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0062.972] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0xffffffff [0062.972] CreateFileA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.976] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.976] WriteFile (in: hFile=0x204, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.978] SetFileTime (hFile=0x204, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.978] CloseHandle (hObject=0x204) returned 1 [0062.978] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD" [0062.978] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.zip") returned 0 [0062.978] lstrlenA (lpString="*.zip") returned 5 [0062.978] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.rar") returned 0 [0062.978] lstrlenA (lpString="*.rar") returned 5 [0062.978] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.7z") returned 0 [0062.978] lstrlenA (lpString="*.7z") returned 4 [0062.978] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.tar") returned 0 [0062.978] lstrlenA (lpString="*.tar") returned 5 [0062.978] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gzip") returned 0 [0062.978] lstrlenA (lpString="*.gzip") returned 6 [0062.978] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpg") returned 0 [0062.978] lstrlenA (lpString="*.jpg") returned 5 [0062.978] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpeg") returned 0 [0062.978] lstrlenA (lpString="*.jpeg") returned 6 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.psd") returned 0 [0062.979] lstrlenA (lpString="*.psd") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cdr") returned 0 [0062.979] lstrlenA (lpString="*.cdr") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dwg") returned 0 [0062.979] lstrlenA (lpString="*.dwg") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.max") returned 0 [0062.979] lstrlenA (lpString="*.max") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.bmp") returned 0 [0062.979] lstrlenA (lpString="*.bmp") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gif") returned 0 [0062.979] lstrlenA (lpString="*.gif") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.png") returned 0 [0062.979] lstrlenA (lpString="*.png") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.doc") returned 0 [0062.979] lstrlenA (lpString="*.doc") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.docx") returned 0 [0062.979] lstrlenA (lpString="*.docx") returned 6 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xls") returned 0 [0062.979] lstrlenA (lpString="*.xls") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xlsx") returned 0 [0062.979] lstrlenA (lpString="*.xlsx") returned 6 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ppt") returned 0 [0062.979] lstrlenA (lpString="*.ppt") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pptx") returned 0 [0062.979] lstrlenA (lpString="*.pptx") returned 6 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.txt") returned 0 [0062.979] lstrlenA (lpString="*.txt") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pdf") returned 0 [0062.979] lstrlenA (lpString="*.pdf") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.djvu") returned 0 [0062.979] lstrlenA (lpString="*.djvu") returned 6 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.htm") returned 0 [0062.979] lstrlenA (lpString="*.htm") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.html") returned 0 [0062.979] lstrlenA (lpString="*.html") returned 6 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mdb") returned 0 [0062.980] lstrlenA (lpString="*.mdb") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cer") returned 0 [0062.980] lstrlenA (lpString="*.cer") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.p12") returned 0 [0062.980] lstrlenA (lpString="*.p12") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pfx") returned 0 [0062.980] lstrlenA (lpString="*.pfx") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.kwm") returned 0 [0062.980] lstrlenA (lpString="*.kwm") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pwm") returned 0 [0062.980] lstrlenA (lpString="*.pwm") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.1cd") returned 0 [0062.980] lstrlenA (lpString="*.1cd") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.md") returned 0 [0062.980] lstrlenA (lpString="*.md") returned 4 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mdf") returned 0 [0062.980] lstrlenA (lpString="*.mdf") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dbf") returned 0 [0062.980] lstrlenA (lpString="*.dbf") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.odt") returned 0 [0062.980] lstrlenA (lpString="*.odt") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vob") returned 0 [0062.980] lstrlenA (lpString="*.vob") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ifo") returned 0 [0062.980] lstrlenA (lpString="*.ifo") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.lnk") returned 0 [0062.980] lstrlenA (lpString="*.lnk") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.torrent") returned 0 [0062.980] lstrlenA (lpString="*.torrent") returned 9 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mov") returned 0 [0062.980] lstrlenA (lpString="*.mov") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.m2v") returned 0 [0062.980] lstrlenA (lpString="*.m2v") returned 5 [0062.980] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.3gp") returned 0 [0062.981] lstrlenA (lpString="*.3gp") returned 5 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpeg") returned 0 [0062.981] lstrlenA (lpString="*.mpeg") returned 6 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpg") returned 0 [0062.981] lstrlenA (lpString="*.mpg") returned 5 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flv") returned 0 [0062.981] lstrlenA (lpString="*.flv") returned 5 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.avi") returned 0 [0062.981] lstrlenA (lpString="*.avi") returned 5 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp4") returned 0 [0062.981] lstrlenA (lpString="*.mp4") returned 5 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wmv") returned 0 [0062.981] lstrlenA (lpString="*.wmv") returned 5 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.divx") returned 0 [0062.981] lstrlenA (lpString="*.divx") returned 6 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mkv") returned 0 [0062.981] lstrlenA (lpString="*.mkv") returned 5 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp3") returned 0 [0062.981] lstrlenA (lpString="*.mp3") returned 5 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wav") returned 0 [0062.981] lstrlenA (lpString="*.wav") returned 5 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flac") returned 0 [0062.981] lstrlenA (lpString="*.flac") returned 6 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ape") returned 0 [0062.981] lstrlenA (lpString="*.ape") returned 5 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wma") returned 0 [0062.981] lstrlenA (lpString="*.wma") returned 5 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ac3") returned 0 [0062.981] lstrlenA (lpString="*.ac3") returned 5 [0062.981] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.doc") returned 0 [0062.981] lstrlenA (lpString="*.doc") returned 5 [0062.981] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x1, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0062.981] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.981] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD.LOG") returned 1 [0062.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG") returned 1 [0062.982] lstrcmpiA (lpString1="", lpString2="BCD.LOG") returned -1 [0062.982] PathFindFileNameA (pszPath="C:\\Boot\\BCD") returned="BCD" [0062.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0062.982] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0062.982] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0062.982] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0062.982] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG" [0062.982] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.zip") returned 0 [0062.982] lstrlenA (lpString="*.zip") returned 5 [0062.982] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.rar") returned 0 [0062.982] lstrlenA (lpString="*.rar") returned 5 [0062.982] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.7z") returned 0 [0062.982] lstrlenA (lpString="*.7z") returned 4 [0062.982] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.tar") returned 0 [0062.982] lstrlenA (lpString="*.tar") returned 5 [0062.982] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gzip") returned 0 [0062.982] lstrlenA (lpString="*.gzip") returned 6 [0062.982] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpg") returned 0 [0062.982] lstrlenA (lpString="*.jpg") returned 5 [0062.982] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpeg") returned 0 [0062.982] lstrlenA (lpString="*.jpeg") returned 6 [0062.982] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.psd") returned 0 [0062.982] lstrlenA (lpString="*.psd") returned 5 [0062.982] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cdr") returned 0 [0062.982] lstrlenA (lpString="*.cdr") returned 5 [0062.982] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dwg") returned 0 [0062.982] lstrlenA (lpString="*.dwg") returned 5 [0062.982] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.max") returned 0 [0062.982] lstrlenA (lpString="*.max") returned 5 [0062.982] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.bmp") returned 0 [0062.982] lstrlenA (lpString="*.bmp") returned 5 [0062.983] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gif") returned 0 [0062.983] lstrlenA (lpString="*.gif") returned 5 [0062.983] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.png") returned 0 [0062.983] lstrlenA (lpString="*.png") returned 5 [0062.983] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.doc") returned 0 [0062.983] lstrlenA (lpString="*.doc") returned 5 [0062.983] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.docx") returned 0 [0062.983] lstrlenA (lpString="*.docx") returned 6 [0062.983] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xls") returned 0 [0062.983] lstrlenA (lpString="*.xls") returned 5 [0062.983] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xlsx") returned 0 [0062.983] lstrlenA (lpString="*.xlsx") returned 6 [0062.983] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ppt") returned 0 [0062.983] lstrlenA (lpString="*.ppt") returned 5 [0062.983] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pptx") returned 0 [0062.983] lstrlenA (lpString="*.pptx") returned 6 [0062.983] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.txt") returned 0 [0062.983] lstrlenA (lpString="*.txt") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pdf") returned 0 [0062.984] lstrlenA (lpString="*.pdf") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.djvu") returned 0 [0062.984] lstrlenA (lpString="*.djvu") returned 6 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.htm") returned 0 [0062.984] lstrlenA (lpString="*.htm") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.html") returned 0 [0062.984] lstrlenA (lpString="*.html") returned 6 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mdb") returned 0 [0062.984] lstrlenA (lpString="*.mdb") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cer") returned 0 [0062.984] lstrlenA (lpString="*.cer") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.p12") returned 0 [0062.984] lstrlenA (lpString="*.p12") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pfx") returned 0 [0062.984] lstrlenA (lpString="*.pfx") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.kwm") returned 0 [0062.984] lstrlenA (lpString="*.kwm") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pwm") returned 0 [0062.984] lstrlenA (lpString="*.pwm") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.1cd") returned 0 [0062.984] lstrlenA (lpString="*.1cd") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.md") returned 0 [0062.984] lstrlenA (lpString="*.md") returned 4 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mdf") returned 0 [0062.984] lstrlenA (lpString="*.mdf") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dbf") returned 0 [0062.984] lstrlenA (lpString="*.dbf") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.odt") returned 0 [0062.984] lstrlenA (lpString="*.odt") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vob") returned 0 [0062.984] lstrlenA (lpString="*.vob") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ifo") returned 0 [0062.984] lstrlenA (lpString="*.ifo") returned 5 [0062.984] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.lnk") returned 0 [0062.984] lstrlenA (lpString="*.lnk") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.torrent") returned 0 [0062.985] lstrlenA (lpString="*.torrent") returned 9 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mov") returned 0 [0062.985] lstrlenA (lpString="*.mov") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.m2v") returned 0 [0062.985] lstrlenA (lpString="*.m2v") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.3gp") returned 0 [0062.985] lstrlenA (lpString="*.3gp") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpeg") returned 0 [0062.985] lstrlenA (lpString="*.mpeg") returned 6 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpg") returned 0 [0062.985] lstrlenA (lpString="*.mpg") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flv") returned 0 [0062.985] lstrlenA (lpString="*.flv") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.avi") returned 0 [0062.985] lstrlenA (lpString="*.avi") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp4") returned 0 [0062.985] lstrlenA (lpString="*.mp4") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wmv") returned 0 [0062.985] lstrlenA (lpString="*.wmv") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.divx") returned 0 [0062.985] lstrlenA (lpString="*.divx") returned 6 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mkv") returned 0 [0062.985] lstrlenA (lpString="*.mkv") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp3") returned 0 [0062.985] lstrlenA (lpString="*.mp3") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wav") returned 0 [0062.985] lstrlenA (lpString="*.wav") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flac") returned 0 [0062.985] lstrlenA (lpString="*.flac") returned 6 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ape") returned 0 [0062.985] lstrlenA (lpString="*.ape") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wma") returned 0 [0062.985] lstrlenA (lpString="*.wma") returned 5 [0062.986] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ac3") returned 0 [0062.986] lstrlenA (lpString="*.ac3") returned 5 [0062.986] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.doc") returned 0 [0062.986] lstrlenA (lpString="*.doc") returned 5 [0062.986] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0062.986] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD.LOG1") returned 1 [0062.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG1") returned 1 [0062.986] lstrcmpiA (lpString1="", lpString2="BCD.LOG1") returned -1 [0062.986] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG") returned="BCD.LOG" [0062.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0062.986] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0062.986] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0062.986] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0062.986] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1" [0062.986] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.zip") returned 0 [0062.986] lstrlenA (lpString="*.zip") returned 5 [0062.986] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.rar") returned 0 [0062.986] lstrlenA (lpString="*.rar") returned 5 [0062.986] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.7z") returned 0 [0062.986] lstrlenA (lpString="*.7z") returned 4 [0062.986] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.tar") returned 0 [0062.986] lstrlenA (lpString="*.tar") returned 5 [0062.986] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gzip") returned 0 [0062.986] lstrlenA (lpString="*.gzip") returned 6 [0062.986] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpg") returned 0 [0062.986] lstrlenA (lpString="*.jpg") returned 5 [0062.986] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpeg") returned 0 [0062.986] lstrlenA (lpString="*.jpeg") returned 6 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.psd") returned 0 [0062.987] lstrlenA (lpString="*.psd") returned 5 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cdr") returned 0 [0062.987] lstrlenA (lpString="*.cdr") returned 5 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dwg") returned 0 [0062.987] lstrlenA (lpString="*.dwg") returned 5 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.max") returned 0 [0062.987] lstrlenA (lpString="*.max") returned 5 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.bmp") returned 0 [0062.987] lstrlenA (lpString="*.bmp") returned 5 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gif") returned 0 [0062.987] lstrlenA (lpString="*.gif") returned 5 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.png") returned 0 [0062.987] lstrlenA (lpString="*.png") returned 5 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.doc") returned 0 [0062.987] lstrlenA (lpString="*.doc") returned 5 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.docx") returned 0 [0062.987] lstrlenA (lpString="*.docx") returned 6 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xls") returned 0 [0062.987] lstrlenA (lpString="*.xls") returned 5 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xlsx") returned 0 [0062.987] lstrlenA (lpString="*.xlsx") returned 6 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ppt") returned 0 [0062.987] lstrlenA (lpString="*.ppt") returned 5 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pptx") returned 0 [0062.987] lstrlenA (lpString="*.pptx") returned 6 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.txt") returned 0 [0062.987] lstrlenA (lpString="*.txt") returned 5 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pdf") returned 0 [0062.987] lstrlenA (lpString="*.pdf") returned 5 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.djvu") returned 0 [0062.987] lstrlenA (lpString="*.djvu") returned 6 [0062.987] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.htm") returned 0 [0062.987] lstrlenA (lpString="*.htm") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.html") returned 0 [0062.988] lstrlenA (lpString="*.html") returned 6 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mdb") returned 0 [0062.988] lstrlenA (lpString="*.mdb") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cer") returned 0 [0062.988] lstrlenA (lpString="*.cer") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.p12") returned 0 [0062.988] lstrlenA (lpString="*.p12") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pfx") returned 0 [0062.988] lstrlenA (lpString="*.pfx") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.kwm") returned 0 [0062.988] lstrlenA (lpString="*.kwm") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pwm") returned 0 [0062.988] lstrlenA (lpString="*.pwm") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.1cd") returned 0 [0062.988] lstrlenA (lpString="*.1cd") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.md") returned 0 [0062.988] lstrlenA (lpString="*.md") returned 4 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mdf") returned 0 [0062.988] lstrlenA (lpString="*.mdf") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dbf") returned 0 [0062.988] lstrlenA (lpString="*.dbf") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.odt") returned 0 [0062.988] lstrlenA (lpString="*.odt") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vob") returned 0 [0062.988] lstrlenA (lpString="*.vob") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ifo") returned 0 [0062.988] lstrlenA (lpString="*.ifo") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.lnk") returned 0 [0062.988] lstrlenA (lpString="*.lnk") returned 5 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.torrent") returned 0 [0062.988] lstrlenA (lpString="*.torrent") returned 9 [0062.988] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mov") returned 0 [0062.988] lstrlenA (lpString="*.mov") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.m2v") returned 0 [0062.989] lstrlenA (lpString="*.m2v") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.3gp") returned 0 [0062.989] lstrlenA (lpString="*.3gp") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpeg") returned 0 [0062.989] lstrlenA (lpString="*.mpeg") returned 6 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpg") returned 0 [0062.989] lstrlenA (lpString="*.mpg") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flv") returned 0 [0062.989] lstrlenA (lpString="*.flv") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.avi") returned 0 [0062.989] lstrlenA (lpString="*.avi") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp4") returned 0 [0062.989] lstrlenA (lpString="*.mp4") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wmv") returned 0 [0062.989] lstrlenA (lpString="*.wmv") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.divx") returned 0 [0062.989] lstrlenA (lpString="*.divx") returned 6 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mkv") returned 0 [0062.989] lstrlenA (lpString="*.mkv") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp3") returned 0 [0062.989] lstrlenA (lpString="*.mp3") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wav") returned 0 [0062.989] lstrlenA (lpString="*.wav") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flac") returned 0 [0062.989] lstrlenA (lpString="*.flac") returned 6 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ape") returned 0 [0062.989] lstrlenA (lpString="*.ape") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wma") returned 0 [0062.989] lstrlenA (lpString="*.wma") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ac3") returned 0 [0062.989] lstrlenA (lpString="*.ac3") returned 5 [0062.989] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.doc") returned 0 [0062.989] lstrlenA (lpString="*.doc") returned 5 [0062.990] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0062.990] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0062.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD.LOG2") returned 1 [0062.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG2") returned 1 [0062.990] lstrcmpiA (lpString1="", lpString2="BCD.LOG2") returned -1 [0062.990] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG1") returned="BCD.LOG1" [0062.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0062.990] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0062.990] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0062.990] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0062.990] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2" [0062.990] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.zip") returned 0 [0062.990] lstrlenA (lpString="*.zip") returned 5 [0062.990] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.rar") returned 0 [0062.990] lstrlenA (lpString="*.rar") returned 5 [0062.990] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.7z") returned 0 [0062.990] lstrlenA (lpString="*.7z") returned 4 [0062.990] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.tar") returned 0 [0062.990] lstrlenA (lpString="*.tar") returned 5 [0062.990] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gzip") returned 0 [0062.990] lstrlenA (lpString="*.gzip") returned 6 [0062.990] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpg") returned 0 [0062.990] lstrlenA (lpString="*.jpg") returned 5 [0062.990] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpeg") returned 0 [0062.990] lstrlenA (lpString="*.jpeg") returned 6 [0062.990] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.psd") returned 0 [0062.990] lstrlenA (lpString="*.psd") returned 5 [0062.990] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cdr") returned 0 [0062.990] lstrlenA (lpString="*.cdr") returned 5 [0062.990] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dwg") returned 0 [0062.991] lstrlenA (lpString="*.dwg") returned 5 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.max") returned 0 [0062.991] lstrlenA (lpString="*.max") returned 5 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.bmp") returned 0 [0062.991] lstrlenA (lpString="*.bmp") returned 5 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gif") returned 0 [0062.991] lstrlenA (lpString="*.gif") returned 5 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.png") returned 0 [0062.991] lstrlenA (lpString="*.png") returned 5 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.doc") returned 0 [0062.991] lstrlenA (lpString="*.doc") returned 5 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.docx") returned 0 [0062.991] lstrlenA (lpString="*.docx") returned 6 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xls") returned 0 [0062.991] lstrlenA (lpString="*.xls") returned 5 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xlsx") returned 0 [0062.991] lstrlenA (lpString="*.xlsx") returned 6 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ppt") returned 0 [0062.991] lstrlenA (lpString="*.ppt") returned 5 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pptx") returned 0 [0062.991] lstrlenA (lpString="*.pptx") returned 6 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.txt") returned 0 [0062.991] lstrlenA (lpString="*.txt") returned 5 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pdf") returned 0 [0062.991] lstrlenA (lpString="*.pdf") returned 5 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.djvu") returned 0 [0062.991] lstrlenA (lpString="*.djvu") returned 6 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.htm") returned 0 [0062.991] lstrlenA (lpString="*.htm") returned 5 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.html") returned 0 [0062.991] lstrlenA (lpString="*.html") returned 6 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mdb") returned 0 [0062.991] lstrlenA (lpString="*.mdb") returned 5 [0062.991] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cer") returned 0 [0062.992] lstrlenA (lpString="*.cer") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.p12") returned 0 [0062.992] lstrlenA (lpString="*.p12") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pfx") returned 0 [0062.992] lstrlenA (lpString="*.pfx") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.kwm") returned 0 [0062.992] lstrlenA (lpString="*.kwm") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pwm") returned 0 [0062.992] lstrlenA (lpString="*.pwm") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.1cd") returned 0 [0062.992] lstrlenA (lpString="*.1cd") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.md") returned 0 [0062.992] lstrlenA (lpString="*.md") returned 4 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mdf") returned 0 [0062.992] lstrlenA (lpString="*.mdf") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dbf") returned 0 [0062.992] lstrlenA (lpString="*.dbf") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.odt") returned 0 [0062.992] lstrlenA (lpString="*.odt") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vob") returned 0 [0062.992] lstrlenA (lpString="*.vob") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ifo") returned 0 [0062.992] lstrlenA (lpString="*.ifo") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.lnk") returned 0 [0062.992] lstrlenA (lpString="*.lnk") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.torrent") returned 0 [0062.992] lstrlenA (lpString="*.torrent") returned 9 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mov") returned 0 [0062.992] lstrlenA (lpString="*.mov") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.m2v") returned 0 [0062.992] lstrlenA (lpString="*.m2v") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.3gp") returned 0 [0062.992] lstrlenA (lpString="*.3gp") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpeg") returned 0 [0062.992] lstrlenA (lpString="*.mpeg") returned 6 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpg") returned 0 [0062.993] lstrlenA (lpString="*.mpg") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flv") returned 0 [0062.993] lstrlenA (lpString="*.flv") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.avi") returned 0 [0062.993] lstrlenA (lpString="*.avi") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp4") returned 0 [0062.993] lstrlenA (lpString="*.mp4") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wmv") returned 0 [0062.993] lstrlenA (lpString="*.wmv") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.divx") returned 0 [0062.993] lstrlenA (lpString="*.divx") returned 6 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mkv") returned 0 [0062.993] lstrlenA (lpString="*.mkv") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp3") returned 0 [0062.993] lstrlenA (lpString="*.mp3") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wav") returned 0 [0062.993] lstrlenA (lpString="*.wav") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flac") returned 0 [0062.993] lstrlenA (lpString="*.flac") returned 6 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ape") returned 0 [0062.993] lstrlenA (lpString="*.ape") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wma") returned 0 [0062.993] lstrlenA (lpString="*.wma") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ac3") returned 0 [0062.993] lstrlenA (lpString="*.ac3") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.doc") returned 0 [0062.993] lstrlenA (lpString="*.doc") returned 5 [0062.993] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0062.993] lstrcmpA (lpString1=".", lpString2="bg-BG") returned -1 [0062.993] lstrcmpA (lpString1="..", lpString2="bg-BG") returned -1 [0062.993] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG2") returned="BCD.LOG2" [0062.993] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="bg-BG" | out: lpString1="C:\\Boot\\bg-BG") returned="C:\\Boot\\bg-BG" [0062.993] lstrlenA (lpString="C:\\Boot\\bg-BG") returned 13 [0062.994] FindFirstFileA (in: lpFileName="C:\\Boot\\bg-BG\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x58, cFileName=".", cAlternateFileName="")) returned 0x759b50 [0062.994] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.994] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x58, cFileName="..", cAlternateFileName="")) returned 1 [0062.994] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.994] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.994] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x740000, dwReserved1=0x58, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.994] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0062.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0062.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0062.994] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0062.994] PathFindFileNameA (pszPath="C:\\Boot\\bg-BG\\*.*") returned="*.*" [0062.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\bg-BG\\" | out: lpString1="C:\\Boot\\bg-BG\\") returned="C:\\Boot\\bg-BG\\" [0062.994] PathAddBackslashA (in: pszPath="C:\\Boot\\bg-BG\\" | out: pszPath="C:\\Boot\\bg-BG\\") returned="" [0062.994] lstrcatA (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\bg-BG\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\bg-BG\\HOW TO DECRYPT FILES.txt" [0062.994] GetFileAttributesA (lpFileName="C:\\Boot\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\bg-bg\\how to decrypt files.txt")) returned 0xffffffff [0062.994] CreateFileA (lpFileName="C:\\Boot\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\bg-bg\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0062.995] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0062.995] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0062.997] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.998] CloseHandle (hObject=0x208) returned 1 [0062.998] lstrcatA (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned="C:\\Boot\\bg-BG\\bootmgr.exe.mui" [0062.998] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0062.998] lstrlenA (lpString="*.zip") returned 5 [0062.998] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0062.998] lstrlenA (lpString="*.rar") returned 5 [0062.998] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0062.998] lstrlenA (lpString="*.7z") returned 4 [0062.998] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0062.998] lstrlenA (lpString="*.tar") returned 5 [0062.998] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0062.998] lstrlenA (lpString="*.gzip") returned 6 [0062.998] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0062.998] lstrlenA (lpString="*.jpg") returned 5 [0062.998] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0062.998] lstrlenA (lpString="*.jpeg") returned 6 [0062.998] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0062.998] lstrlenA (lpString="*.psd") returned 5 [0062.998] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0062.998] lstrlenA (lpString="*.cdr") returned 5 [0062.998] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0062.998] lstrlenA (lpString="*.dwg") returned 5 [0062.998] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0062.998] lstrlenA (lpString="*.max") returned 5 [0062.999] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0062.999] lstrlenA (lpString="*.bmp") returned 5 [0062.999] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0062.999] lstrlenA (lpString="*.gif") returned 5 [0062.999] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0062.999] lstrlenA (lpString="*.png") returned 5 [0062.999] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0062.999] lstrlenA (lpString="*.doc") returned 5 [0062.999] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0062.999] lstrlenA (lpString="*.docx") returned 6 [0062.999] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0062.999] lstrlenA (lpString="*.xls") returned 5 [0062.999] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0062.999] lstrlenA (lpString="*.xlsx") returned 6 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.000] lstrlenA (lpString="*.ppt") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.000] lstrlenA (lpString="*.pptx") returned 6 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.000] lstrlenA (lpString="*.txt") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.000] lstrlenA (lpString="*.pdf") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.000] lstrlenA (lpString="*.djvu") returned 6 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.000] lstrlenA (lpString="*.htm") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.000] lstrlenA (lpString="*.html") returned 6 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.000] lstrlenA (lpString="*.mdb") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.000] lstrlenA (lpString="*.cer") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.000] lstrlenA (lpString="*.p12") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.000] lstrlenA (lpString="*.pfx") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.000] lstrlenA (lpString="*.kwm") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.000] lstrlenA (lpString="*.pwm") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.000] lstrlenA (lpString="*.1cd") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.000] lstrlenA (lpString="*.md") returned 4 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.000] lstrlenA (lpString="*.mdf") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.000] lstrlenA (lpString="*.dbf") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.001] lstrlenA (lpString="*.odt") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.001] lstrlenA (lpString="*.vob") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.001] lstrlenA (lpString="*.ifo") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.001] lstrlenA (lpString="*.lnk") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.001] lstrlenA (lpString="*.torrent") returned 9 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.001] lstrlenA (lpString="*.mov") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.001] lstrlenA (lpString="*.m2v") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.001] lstrlenA (lpString="*.3gp") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.001] lstrlenA (lpString="*.mpeg") returned 6 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.001] lstrlenA (lpString="*.mpg") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.001] lstrlenA (lpString="*.flv") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.001] lstrlenA (lpString="*.avi") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.001] lstrlenA (lpString="*.mp4") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.001] lstrlenA (lpString="*.wmv") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.001] lstrlenA (lpString="*.divx") returned 6 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.001] lstrlenA (lpString="*.mkv") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.001] lstrlenA (lpString="*.mp3") returned 5 [0063.001] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.002] lstrlenA (lpString="*.wav") returned 5 [0063.002] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.002] lstrlenA (lpString="*.flac") returned 6 [0063.002] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.002] lstrlenA (lpString="*.ape") returned 5 [0063.002] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.002] lstrlenA (lpString="*.wma") returned 5 [0063.002] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.002] lstrlenA (lpString="*.ac3") returned 5 [0063.002] PathMatchSpecA (pszFile="C:\\Boot\\bg-BG\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.002] lstrlenA (lpString="*.doc") returned 5 [0063.002] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x740000, dwReserved1=0x58, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.002] FindClose (in: hFindFile=0x759b50 | out: hFindFile=0x759b50) returned 1 [0063.002] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0063.002] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.002] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootspaces.dll") returned 1 [0063.002] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootspaces.dll") returned 1 [0063.002] lstrcmpiA (lpString1="", lpString2="bootspaces.dll") returned -1 [0063.002] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0063.002] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0063.002] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0063.002] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0063.002] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="bootspaces.dll" | out: lpString1="C:\\Boot\\bootspaces.dll") returned="C:\\Boot\\bootspaces.dll" [0063.002] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.zip") returned 0 [0063.003] lstrlenA (lpString="*.zip") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.rar") returned 0 [0063.003] lstrlenA (lpString="*.rar") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.7z") returned 0 [0063.003] lstrlenA (lpString="*.7z") returned 4 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.tar") returned 0 [0063.003] lstrlenA (lpString="*.tar") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.gzip") returned 0 [0063.003] lstrlenA (lpString="*.gzip") returned 6 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.jpg") returned 0 [0063.003] lstrlenA (lpString="*.jpg") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.jpeg") returned 0 [0063.003] lstrlenA (lpString="*.jpeg") returned 6 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.psd") returned 0 [0063.003] lstrlenA (lpString="*.psd") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.cdr") returned 0 [0063.003] lstrlenA (lpString="*.cdr") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.dwg") returned 0 [0063.003] lstrlenA (lpString="*.dwg") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.max") returned 0 [0063.003] lstrlenA (lpString="*.max") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.bmp") returned 0 [0063.003] lstrlenA (lpString="*.bmp") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.gif") returned 0 [0063.003] lstrlenA (lpString="*.gif") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.png") returned 0 [0063.003] lstrlenA (lpString="*.png") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.doc") returned 0 [0063.003] lstrlenA (lpString="*.doc") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.docx") returned 0 [0063.003] lstrlenA (lpString="*.docx") returned 6 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.xls") returned 0 [0063.003] lstrlenA (lpString="*.xls") returned 5 [0063.003] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.xlsx") returned 0 [0063.003] lstrlenA (lpString="*.xlsx") returned 6 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.ppt") returned 0 [0063.004] lstrlenA (lpString="*.ppt") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.pptx") returned 0 [0063.004] lstrlenA (lpString="*.pptx") returned 6 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.txt") returned 0 [0063.004] lstrlenA (lpString="*.txt") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.pdf") returned 0 [0063.004] lstrlenA (lpString="*.pdf") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.djvu") returned 0 [0063.004] lstrlenA (lpString="*.djvu") returned 6 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.htm") returned 0 [0063.004] lstrlenA (lpString="*.htm") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.html") returned 0 [0063.004] lstrlenA (lpString="*.html") returned 6 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mdb") returned 0 [0063.004] lstrlenA (lpString="*.mdb") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.cer") returned 0 [0063.004] lstrlenA (lpString="*.cer") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.p12") returned 0 [0063.004] lstrlenA (lpString="*.p12") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.pfx") returned 0 [0063.004] lstrlenA (lpString="*.pfx") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.kwm") returned 0 [0063.004] lstrlenA (lpString="*.kwm") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.pwm") returned 0 [0063.004] lstrlenA (lpString="*.pwm") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.1cd") returned 0 [0063.004] lstrlenA (lpString="*.1cd") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.md") returned 0 [0063.004] lstrlenA (lpString="*.md") returned 4 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mdf") returned 0 [0063.004] lstrlenA (lpString="*.mdf") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.dbf") returned 0 [0063.004] lstrlenA (lpString="*.dbf") returned 5 [0063.004] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.odt") returned 0 [0063.005] lstrlenA (lpString="*.odt") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.vob") returned 0 [0063.005] lstrlenA (lpString="*.vob") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.ifo") returned 0 [0063.005] lstrlenA (lpString="*.ifo") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.lnk") returned 0 [0063.005] lstrlenA (lpString="*.lnk") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.torrent") returned 0 [0063.005] lstrlenA (lpString="*.torrent") returned 9 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mov") returned 0 [0063.005] lstrlenA (lpString="*.mov") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.m2v") returned 0 [0063.005] lstrlenA (lpString="*.m2v") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.3gp") returned 0 [0063.005] lstrlenA (lpString="*.3gp") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mpeg") returned 0 [0063.005] lstrlenA (lpString="*.mpeg") returned 6 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mpg") returned 0 [0063.005] lstrlenA (lpString="*.mpg") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.flv") returned 0 [0063.005] lstrlenA (lpString="*.flv") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.avi") returned 0 [0063.005] lstrlenA (lpString="*.avi") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mp4") returned 0 [0063.005] lstrlenA (lpString="*.mp4") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.wmv") returned 0 [0063.005] lstrlenA (lpString="*.wmv") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.divx") returned 0 [0063.005] lstrlenA (lpString="*.divx") returned 6 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mkv") returned 0 [0063.005] lstrlenA (lpString="*.mkv") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.mp3") returned 0 [0063.005] lstrlenA (lpString="*.mp3") returned 5 [0063.005] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.wav") returned 0 [0063.006] lstrlenA (lpString="*.wav") returned 5 [0063.006] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.flac") returned 0 [0063.006] lstrlenA (lpString="*.flac") returned 6 [0063.006] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.ape") returned 0 [0063.006] lstrlenA (lpString="*.ape") returned 5 [0063.006] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.wma") returned 0 [0063.006] lstrlenA (lpString="*.wma") returned 5 [0063.006] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.ac3") returned 0 [0063.006] lstrlenA (lpString="*.ac3") returned 5 [0063.006] PathMatchSpecA (pszFile="C:\\Boot\\bootspaces.dll", pszSpec="*.doc") returned 0 [0063.006] lstrlenA (lpString="*.doc") returned 5 [0063.006] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0063.006] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.006] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOOTSTAT.DAT") returned 1 [0063.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTSTAT.DAT") returned 1 [0063.006] lstrcmpiA (lpString1="", lpString2="BOOTSTAT.DAT") returned -1 [0063.006] PathFindFileNameA (pszPath="C:\\Boot\\bootspaces.dll") returned="bootspaces.dll" [0063.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0063.006] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0063.006] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0063.006] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0063.006] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0063.006] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.zip") returned 0 [0063.006] lstrlenA (lpString="*.zip") returned 5 [0063.006] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.rar") returned 0 [0063.006] lstrlenA (lpString="*.rar") returned 5 [0063.006] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.7z") returned 0 [0063.006] lstrlenA (lpString="*.7z") returned 4 [0063.006] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.tar") returned 0 [0063.006] lstrlenA (lpString="*.tar") returned 5 [0063.006] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.gzip") returned 0 [0063.006] lstrlenA (lpString="*.gzip") returned 6 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jpg") returned 0 [0063.007] lstrlenA (lpString="*.jpg") returned 5 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jpeg") returned 0 [0063.007] lstrlenA (lpString="*.jpeg") returned 6 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.psd") returned 0 [0063.007] lstrlenA (lpString="*.psd") returned 5 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.cdr") returned 0 [0063.007] lstrlenA (lpString="*.cdr") returned 5 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.dwg") returned 0 [0063.007] lstrlenA (lpString="*.dwg") returned 5 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.max") returned 0 [0063.007] lstrlenA (lpString="*.max") returned 5 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.bmp") returned 0 [0063.007] lstrlenA (lpString="*.bmp") returned 5 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.gif") returned 0 [0063.007] lstrlenA (lpString="*.gif") returned 5 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.png") returned 0 [0063.007] lstrlenA (lpString="*.png") returned 5 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.doc") returned 0 [0063.007] lstrlenA (lpString="*.doc") returned 5 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.docx") returned 0 [0063.007] lstrlenA (lpString="*.docx") returned 6 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.xls") returned 0 [0063.007] lstrlenA (lpString="*.xls") returned 5 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.xlsx") returned 0 [0063.007] lstrlenA (lpString="*.xlsx") returned 6 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ppt") returned 0 [0063.007] lstrlenA (lpString="*.ppt") returned 5 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pptx") returned 0 [0063.007] lstrlenA (lpString="*.pptx") returned 6 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.txt") returned 0 [0063.007] lstrlenA (lpString="*.txt") returned 5 [0063.007] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pdf") returned 0 [0063.007] lstrlenA (lpString="*.pdf") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.djvu") returned 0 [0063.008] lstrlenA (lpString="*.djvu") returned 6 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.htm") returned 0 [0063.008] lstrlenA (lpString="*.htm") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.html") returned 0 [0063.008] lstrlenA (lpString="*.html") returned 6 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mdb") returned 0 [0063.008] lstrlenA (lpString="*.mdb") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.cer") returned 0 [0063.008] lstrlenA (lpString="*.cer") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.p12") returned 0 [0063.008] lstrlenA (lpString="*.p12") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pfx") returned 0 [0063.008] lstrlenA (lpString="*.pfx") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.kwm") returned 0 [0063.008] lstrlenA (lpString="*.kwm") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pwm") returned 0 [0063.008] lstrlenA (lpString="*.pwm") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.1cd") returned 0 [0063.008] lstrlenA (lpString="*.1cd") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.md") returned 0 [0063.008] lstrlenA (lpString="*.md") returned 4 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mdf") returned 0 [0063.008] lstrlenA (lpString="*.mdf") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.dbf") returned 0 [0063.008] lstrlenA (lpString="*.dbf") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.odt") returned 0 [0063.008] lstrlenA (lpString="*.odt") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.vob") returned 0 [0063.008] lstrlenA (lpString="*.vob") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ifo") returned 0 [0063.008] lstrlenA (lpString="*.ifo") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.lnk") returned 0 [0063.008] lstrlenA (lpString="*.lnk") returned 5 [0063.008] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.torrent") returned 0 [0063.009] lstrlenA (lpString="*.torrent") returned 9 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mov") returned 0 [0063.009] lstrlenA (lpString="*.mov") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.m2v") returned 0 [0063.009] lstrlenA (lpString="*.m2v") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.3gp") returned 0 [0063.009] lstrlenA (lpString="*.3gp") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mpeg") returned 0 [0063.009] lstrlenA (lpString="*.mpeg") returned 6 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mpg") returned 0 [0063.009] lstrlenA (lpString="*.mpg") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.flv") returned 0 [0063.009] lstrlenA (lpString="*.flv") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.avi") returned 0 [0063.009] lstrlenA (lpString="*.avi") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mp4") returned 0 [0063.009] lstrlenA (lpString="*.mp4") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wmv") returned 0 [0063.009] lstrlenA (lpString="*.wmv") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.divx") returned 0 [0063.009] lstrlenA (lpString="*.divx") returned 6 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mkv") returned 0 [0063.009] lstrlenA (lpString="*.mkv") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mp3") returned 0 [0063.009] lstrlenA (lpString="*.mp3") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wav") returned 0 [0063.009] lstrlenA (lpString="*.wav") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.flac") returned 0 [0063.009] lstrlenA (lpString="*.flac") returned 6 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ape") returned 0 [0063.009] lstrlenA (lpString="*.ape") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wma") returned 0 [0063.009] lstrlenA (lpString="*.wma") returned 5 [0063.009] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ac3") returned 0 [0063.009] lstrlenA (lpString="*.ac3") returned 5 [0063.010] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.doc") returned 0 [0063.010] lstrlenA (lpString="*.doc") returned 5 [0063.010] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0063.010] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootvhd.dll") returned 1 [0063.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootvhd.dll") returned 1 [0063.010] lstrcmpiA (lpString1="", lpString2="bootvhd.dll") returned -1 [0063.010] PathFindFileNameA (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned="BOOTSTAT.DAT" [0063.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0063.010] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0063.010] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0063.010] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0063.010] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="bootvhd.dll" | out: lpString1="C:\\Boot\\bootvhd.dll") returned="C:\\Boot\\bootvhd.dll" [0063.010] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.zip") returned 0 [0063.010] lstrlenA (lpString="*.zip") returned 5 [0063.010] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.rar") returned 0 [0063.010] lstrlenA (lpString="*.rar") returned 5 [0063.010] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.7z") returned 0 [0063.010] lstrlenA (lpString="*.7z") returned 4 [0063.010] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.tar") returned 0 [0063.010] lstrlenA (lpString="*.tar") returned 5 [0063.010] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.gzip") returned 0 [0063.010] lstrlenA (lpString="*.gzip") returned 6 [0063.010] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.jpg") returned 0 [0063.010] lstrlenA (lpString="*.jpg") returned 5 [0063.010] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.jpeg") returned 0 [0063.010] lstrlenA (lpString="*.jpeg") returned 6 [0063.010] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.psd") returned 0 [0063.010] lstrlenA (lpString="*.psd") returned 5 [0063.010] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.cdr") returned 0 [0063.011] lstrlenA (lpString="*.cdr") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.dwg") returned 0 [0063.011] lstrlenA (lpString="*.dwg") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.max") returned 0 [0063.011] lstrlenA (lpString="*.max") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.bmp") returned 0 [0063.011] lstrlenA (lpString="*.bmp") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.gif") returned 0 [0063.011] lstrlenA (lpString="*.gif") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.png") returned 0 [0063.011] lstrlenA (lpString="*.png") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.doc") returned 0 [0063.011] lstrlenA (lpString="*.doc") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.docx") returned 0 [0063.011] lstrlenA (lpString="*.docx") returned 6 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.xls") returned 0 [0063.011] lstrlenA (lpString="*.xls") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.xlsx") returned 0 [0063.011] lstrlenA (lpString="*.xlsx") returned 6 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.ppt") returned 0 [0063.011] lstrlenA (lpString="*.ppt") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.pptx") returned 0 [0063.011] lstrlenA (lpString="*.pptx") returned 6 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.txt") returned 0 [0063.011] lstrlenA (lpString="*.txt") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.pdf") returned 0 [0063.011] lstrlenA (lpString="*.pdf") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.djvu") returned 0 [0063.011] lstrlenA (lpString="*.djvu") returned 6 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.htm") returned 0 [0063.011] lstrlenA (lpString="*.htm") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.html") returned 0 [0063.011] lstrlenA (lpString="*.html") returned 6 [0063.011] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mdb") returned 0 [0063.011] lstrlenA (lpString="*.mdb") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.cer") returned 0 [0063.012] lstrlenA (lpString="*.cer") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.p12") returned 0 [0063.012] lstrlenA (lpString="*.p12") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.pfx") returned 0 [0063.012] lstrlenA (lpString="*.pfx") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.kwm") returned 0 [0063.012] lstrlenA (lpString="*.kwm") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.pwm") returned 0 [0063.012] lstrlenA (lpString="*.pwm") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.1cd") returned 0 [0063.012] lstrlenA (lpString="*.1cd") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.md") returned 0 [0063.012] lstrlenA (lpString="*.md") returned 4 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mdf") returned 0 [0063.012] lstrlenA (lpString="*.mdf") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.dbf") returned 0 [0063.012] lstrlenA (lpString="*.dbf") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.odt") returned 0 [0063.012] lstrlenA (lpString="*.odt") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.vob") returned 0 [0063.012] lstrlenA (lpString="*.vob") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.ifo") returned 0 [0063.012] lstrlenA (lpString="*.ifo") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.lnk") returned 0 [0063.012] lstrlenA (lpString="*.lnk") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.torrent") returned 0 [0063.012] lstrlenA (lpString="*.torrent") returned 9 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mov") returned 0 [0063.012] lstrlenA (lpString="*.mov") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.m2v") returned 0 [0063.012] lstrlenA (lpString="*.m2v") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.3gp") returned 0 [0063.012] lstrlenA (lpString="*.3gp") returned 5 [0063.012] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mpeg") returned 0 [0063.013] lstrlenA (lpString="*.mpeg") returned 6 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mpg") returned 0 [0063.013] lstrlenA (lpString="*.mpg") returned 5 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.flv") returned 0 [0063.013] lstrlenA (lpString="*.flv") returned 5 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.avi") returned 0 [0063.013] lstrlenA (lpString="*.avi") returned 5 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mp4") returned 0 [0063.013] lstrlenA (lpString="*.mp4") returned 5 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.wmv") returned 0 [0063.013] lstrlenA (lpString="*.wmv") returned 5 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.divx") returned 0 [0063.013] lstrlenA (lpString="*.divx") returned 6 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mkv") returned 0 [0063.013] lstrlenA (lpString="*.mkv") returned 5 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.mp3") returned 0 [0063.013] lstrlenA (lpString="*.mp3") returned 5 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.wav") returned 0 [0063.013] lstrlenA (lpString="*.wav") returned 5 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.flac") returned 0 [0063.013] lstrlenA (lpString="*.flac") returned 6 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.ape") returned 0 [0063.013] lstrlenA (lpString="*.ape") returned 5 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.wma") returned 0 [0063.013] lstrlenA (lpString="*.wma") returned 5 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.ac3") returned 0 [0063.013] lstrlenA (lpString="*.ac3") returned 5 [0063.013] PathMatchSpecA (pszFile="C:\\Boot\\bootvhd.dll", pszSpec="*.doc") returned 0 [0063.013] lstrlenA (lpString="*.doc") returned 5 [0063.013] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0063.013] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0063.013] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0063.013] PathFindFileNameA (pszPath="C:\\Boot\\bootvhd.dll") returned="bootvhd.dll" [0063.014] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ" [0063.014] lstrlenA (lpString="C:\\Boot\\cs-CZ") returned 13 [0063.014] FindFirstFileA (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x58, cFileName=".", cAlternateFileName="")) returned 0x759f50 [0063.015] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.015] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x58, cFileName="..", cAlternateFileName="")) returned 1 [0063.015] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.015] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.015] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x740000, dwReserved1=0x58, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.015] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.015] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.015] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.015] PathFindFileNameA (pszPath="C:\\Boot\\cs-CZ\\*.*") returned="*.*" [0063.015] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\cs-CZ\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\" [0063.015] PathAddBackslashA (in: pszPath="C:\\Boot\\cs-CZ\\" | out: pszPath="C:\\Boot\\cs-CZ\\") returned="" [0063.015] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0063.015] GetFileAttributesA (lpFileName="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff [0063.015] CreateFileA (lpFileName="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.018] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.018] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.019] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.019] CloseHandle (hObject=0x208) returned 1 [0063.019] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.020] lstrlenA (lpString="*.zip") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.020] lstrlenA (lpString="*.rar") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.020] lstrlenA (lpString="*.7z") returned 4 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.020] lstrlenA (lpString="*.tar") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.020] lstrlenA (lpString="*.gzip") returned 6 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.020] lstrlenA (lpString="*.jpg") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.020] lstrlenA (lpString="*.jpeg") returned 6 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.020] lstrlenA (lpString="*.psd") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.020] lstrlenA (lpString="*.cdr") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.020] lstrlenA (lpString="*.dwg") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.020] lstrlenA (lpString="*.max") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.020] lstrlenA (lpString="*.bmp") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.020] lstrlenA (lpString="*.gif") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.020] lstrlenA (lpString="*.png") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.020] lstrlenA (lpString="*.doc") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.020] lstrlenA (lpString="*.docx") returned 6 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.020] lstrlenA (lpString="*.xls") returned 5 [0063.020] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.021] lstrlenA (lpString="*.xlsx") returned 6 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.021] lstrlenA (lpString="*.ppt") returned 5 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.021] lstrlenA (lpString="*.pptx") returned 6 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.021] lstrlenA (lpString="*.txt") returned 5 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.021] lstrlenA (lpString="*.pdf") returned 5 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.021] lstrlenA (lpString="*.djvu") returned 6 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.021] lstrlenA (lpString="*.htm") returned 5 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.021] lstrlenA (lpString="*.html") returned 6 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.021] lstrlenA (lpString="*.mdb") returned 5 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.021] lstrlenA (lpString="*.cer") returned 5 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.021] lstrlenA (lpString="*.p12") returned 5 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.021] lstrlenA (lpString="*.pfx") returned 5 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.021] lstrlenA (lpString="*.kwm") returned 5 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.021] lstrlenA (lpString="*.pwm") returned 5 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.021] lstrlenA (lpString="*.1cd") returned 5 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.021] lstrlenA (lpString="*.md") returned 4 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.021] lstrlenA (lpString="*.mdf") returned 5 [0063.021] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.022] lstrlenA (lpString="*.dbf") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.022] lstrlenA (lpString="*.odt") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.022] lstrlenA (lpString="*.vob") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.022] lstrlenA (lpString="*.ifo") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.022] lstrlenA (lpString="*.lnk") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.022] lstrlenA (lpString="*.torrent") returned 9 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.022] lstrlenA (lpString="*.mov") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.022] lstrlenA (lpString="*.m2v") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.022] lstrlenA (lpString="*.3gp") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.022] lstrlenA (lpString="*.mpeg") returned 6 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.022] lstrlenA (lpString="*.mpg") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.022] lstrlenA (lpString="*.flv") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.022] lstrlenA (lpString="*.avi") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.022] lstrlenA (lpString="*.mp4") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.022] lstrlenA (lpString="*.wmv") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.022] lstrlenA (lpString="*.divx") returned 6 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.022] lstrlenA (lpString="*.mkv") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.023] lstrlenA (lpString="*.mp3") returned 5 [0063.023] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.023] lstrlenA (lpString="*.wav") returned 5 [0063.023] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.023] lstrlenA (lpString="*.flac") returned 6 [0063.023] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.023] lstrlenA (lpString="*.ape") returned 5 [0063.023] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.023] lstrlenA (lpString="*.wma") returned 5 [0063.023] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.023] lstrlenA (lpString="*.ac3") returned 5 [0063.023] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.023] lstrlenA (lpString="*.doc") returned 5 [0063.023] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.023] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.023] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.023] PathFindFileNameA (pszPath="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\cs-CZ\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\" [0063.023] PathAddBackslashA (in: pszPath="C:\\Boot\\cs-CZ\\" | out: pszPath="C:\\Boot\\cs-CZ\\") returned="" [0063.023] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0063.023] GetFileAttributesA (lpFileName="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\cs-cz\\how to decrypt files.txt")) returned 0x20 [0063.023] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned="C:\\Boot\\cs-CZ\\memtest.exe.mui" [0063.023] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.023] lstrlenA (lpString="*.zip") returned 5 [0063.023] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.023] lstrlenA (lpString="*.rar") returned 5 [0063.023] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.023] lstrlenA (lpString="*.7z") returned 4 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.024] lstrlenA (lpString="*.tar") returned 5 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.024] lstrlenA (lpString="*.gzip") returned 6 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.024] lstrlenA (lpString="*.jpg") returned 5 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.024] lstrlenA (lpString="*.jpeg") returned 6 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.024] lstrlenA (lpString="*.psd") returned 5 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.024] lstrlenA (lpString="*.cdr") returned 5 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.024] lstrlenA (lpString="*.dwg") returned 5 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.024] lstrlenA (lpString="*.max") returned 5 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.024] lstrlenA (lpString="*.bmp") returned 5 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.024] lstrlenA (lpString="*.gif") returned 5 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.024] lstrlenA (lpString="*.png") returned 5 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.024] lstrlenA (lpString="*.doc") returned 5 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.024] lstrlenA (lpString="*.docx") returned 6 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.024] lstrlenA (lpString="*.xls") returned 5 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.024] lstrlenA (lpString="*.xlsx") returned 6 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.024] lstrlenA (lpString="*.ppt") returned 5 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.024] lstrlenA (lpString="*.pptx") returned 6 [0063.024] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.025] lstrlenA (lpString="*.txt") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.025] lstrlenA (lpString="*.pdf") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.025] lstrlenA (lpString="*.djvu") returned 6 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.025] lstrlenA (lpString="*.htm") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.025] lstrlenA (lpString="*.html") returned 6 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.025] lstrlenA (lpString="*.mdb") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.025] lstrlenA (lpString="*.cer") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.025] lstrlenA (lpString="*.p12") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.025] lstrlenA (lpString="*.pfx") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.025] lstrlenA (lpString="*.kwm") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.025] lstrlenA (lpString="*.pwm") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.025] lstrlenA (lpString="*.1cd") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.025] lstrlenA (lpString="*.md") returned 4 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.025] lstrlenA (lpString="*.mdf") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.025] lstrlenA (lpString="*.dbf") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.025] lstrlenA (lpString="*.odt") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.025] lstrlenA (lpString="*.vob") returned 5 [0063.025] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.026] lstrlenA (lpString="*.ifo") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.026] lstrlenA (lpString="*.lnk") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.026] lstrlenA (lpString="*.torrent") returned 9 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.026] lstrlenA (lpString="*.mov") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.026] lstrlenA (lpString="*.m2v") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.026] lstrlenA (lpString="*.3gp") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.026] lstrlenA (lpString="*.mpeg") returned 6 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.026] lstrlenA (lpString="*.mpg") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.026] lstrlenA (lpString="*.flv") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.026] lstrlenA (lpString="*.avi") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.026] lstrlenA (lpString="*.mp4") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.026] lstrlenA (lpString="*.wmv") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.026] lstrlenA (lpString="*.divx") returned 6 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.026] lstrlenA (lpString="*.mkv") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.026] lstrlenA (lpString="*.mp3") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.026] lstrlenA (lpString="*.wav") returned 5 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.026] lstrlenA (lpString="*.flac") returned 6 [0063.026] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.027] lstrlenA (lpString="*.ape") returned 5 [0063.027] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.027] lstrlenA (lpString="*.wma") returned 5 [0063.027] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.027] lstrlenA (lpString="*.ac3") returned 5 [0063.027] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.027] lstrlenA (lpString="*.doc") returned 5 [0063.027] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.027] FindClose (in: hFindFile=0x759f50 | out: hFindFile=0x759f50) returned 1 [0063.027] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0063.027] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0063.027] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0063.027] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.027] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK" [0063.027] lstrlenA (lpString="C:\\Boot\\da-DK") returned 13 [0063.027] FindFirstFileA (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759f50 [0063.029] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.029] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.029] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.029] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.029] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.029] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.029] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.029] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.029] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.029] PathFindFileNameA (pszPath="C:\\Boot\\da-DK\\*.*") returned="*.*" [0063.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\da-DK\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\" [0063.029] PathAddBackslashA (in: pszPath="C:\\Boot\\da-DK\\" | out: pszPath="C:\\Boot\\da-DK\\") returned="" [0063.029] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" [0063.029] GetFileAttributesA (lpFileName="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\da-dk\\how to decrypt files.txt")) returned 0xffffffff [0063.029] CreateFileA (lpFileName="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\da-dk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.031] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.031] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.032] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.033] CloseHandle (hObject=0x208) returned 1 [0063.033] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui" [0063.033] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.033] lstrlenA (lpString="*.zip") returned 5 [0063.033] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.033] lstrlenA (lpString="*.rar") returned 5 [0063.033] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.033] lstrlenA (lpString="*.7z") returned 4 [0063.033] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.033] lstrlenA (lpString="*.tar") returned 5 [0063.033] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.033] lstrlenA (lpString="*.gzip") returned 6 [0063.033] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.033] lstrlenA (lpString="*.jpg") returned 5 [0063.033] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.033] lstrlenA (lpString="*.jpeg") returned 6 [0063.033] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.033] lstrlenA (lpString="*.psd") returned 5 [0063.033] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.033] lstrlenA (lpString="*.cdr") returned 5 [0063.033] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.033] lstrlenA (lpString="*.dwg") returned 5 [0063.033] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.033] lstrlenA (lpString="*.max") returned 5 [0063.033] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.033] lstrlenA (lpString="*.bmp") returned 5 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.034] lstrlenA (lpString="*.gif") returned 5 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.034] lstrlenA (lpString="*.png") returned 5 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.034] lstrlenA (lpString="*.doc") returned 5 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.034] lstrlenA (lpString="*.docx") returned 6 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.034] lstrlenA (lpString="*.xls") returned 5 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.034] lstrlenA (lpString="*.xlsx") returned 6 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.034] lstrlenA (lpString="*.ppt") returned 5 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.034] lstrlenA (lpString="*.pptx") returned 6 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.034] lstrlenA (lpString="*.txt") returned 5 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.034] lstrlenA (lpString="*.pdf") returned 5 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.034] lstrlenA (lpString="*.djvu") returned 6 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.034] lstrlenA (lpString="*.htm") returned 5 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.034] lstrlenA (lpString="*.html") returned 6 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.034] lstrlenA (lpString="*.mdb") returned 5 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.034] lstrlenA (lpString="*.cer") returned 5 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.034] lstrlenA (lpString="*.p12") returned 5 [0063.034] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.034] lstrlenA (lpString="*.pfx") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.035] lstrlenA (lpString="*.kwm") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.035] lstrlenA (lpString="*.pwm") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.035] lstrlenA (lpString="*.1cd") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.035] lstrlenA (lpString="*.md") returned 4 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.035] lstrlenA (lpString="*.mdf") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.035] lstrlenA (lpString="*.dbf") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.035] lstrlenA (lpString="*.odt") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.035] lstrlenA (lpString="*.vob") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.035] lstrlenA (lpString="*.ifo") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.035] lstrlenA (lpString="*.lnk") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.035] lstrlenA (lpString="*.torrent") returned 9 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.035] lstrlenA (lpString="*.mov") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.035] lstrlenA (lpString="*.m2v") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.035] lstrlenA (lpString="*.3gp") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.035] lstrlenA (lpString="*.mpeg") returned 6 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.035] lstrlenA (lpString="*.mpg") returned 5 [0063.035] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.035] lstrlenA (lpString="*.flv") returned 5 [0063.036] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.036] lstrlenA (lpString="*.avi") returned 5 [0063.036] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.036] lstrlenA (lpString="*.mp4") returned 5 [0063.036] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.036] lstrlenA (lpString="*.wmv") returned 5 [0063.036] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.036] lstrlenA (lpString="*.divx") returned 6 [0063.036] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.036] lstrlenA (lpString="*.mkv") returned 5 [0063.036] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.036] lstrlenA (lpString="*.mp3") returned 5 [0063.036] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.036] lstrlenA (lpString="*.wav") returned 5 [0063.036] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.036] lstrlenA (lpString="*.flac") returned 6 [0063.036] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.036] lstrlenA (lpString="*.ape") returned 5 [0063.036] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.036] lstrlenA (lpString="*.wma") returned 5 [0063.036] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.036] lstrlenA (lpString="*.ac3") returned 5 [0063.036] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.036] lstrlenA (lpString="*.doc") returned 5 [0063.036] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.036] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.036] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.036] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.036] PathFindFileNameA (pszPath="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\da-DK\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\" [0063.036] PathAddBackslashA (in: pszPath="C:\\Boot\\da-DK\\" | out: pszPath="C:\\Boot\\da-DK\\") returned="" [0063.036] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" [0063.036] GetFileAttributesA (lpFileName="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\da-dk\\how to decrypt files.txt")) returned 0x20 [0063.037] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\memtest.exe.mui") returned="C:\\Boot\\da-DK\\memtest.exe.mui" [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.037] lstrlenA (lpString="*.zip") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.037] lstrlenA (lpString="*.rar") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.037] lstrlenA (lpString="*.7z") returned 4 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.037] lstrlenA (lpString="*.tar") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.037] lstrlenA (lpString="*.gzip") returned 6 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.037] lstrlenA (lpString="*.jpg") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.037] lstrlenA (lpString="*.jpeg") returned 6 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.037] lstrlenA (lpString="*.psd") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.037] lstrlenA (lpString="*.cdr") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.037] lstrlenA (lpString="*.dwg") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.037] lstrlenA (lpString="*.max") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.037] lstrlenA (lpString="*.bmp") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.037] lstrlenA (lpString="*.gif") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.037] lstrlenA (lpString="*.png") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.037] lstrlenA (lpString="*.doc") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.038] lstrlenA (lpString="*.docx") returned 6 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.038] lstrlenA (lpString="*.xls") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.038] lstrlenA (lpString="*.xlsx") returned 6 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.038] lstrlenA (lpString="*.ppt") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.038] lstrlenA (lpString="*.pptx") returned 6 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.038] lstrlenA (lpString="*.txt") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.038] lstrlenA (lpString="*.pdf") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.038] lstrlenA (lpString="*.djvu") returned 6 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.038] lstrlenA (lpString="*.htm") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.038] lstrlenA (lpString="*.html") returned 6 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.038] lstrlenA (lpString="*.mdb") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.038] lstrlenA (lpString="*.cer") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.038] lstrlenA (lpString="*.p12") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.038] lstrlenA (lpString="*.pfx") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.038] lstrlenA (lpString="*.kwm") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.038] lstrlenA (lpString="*.pwm") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.038] lstrlenA (lpString="*.1cd") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.038] lstrlenA (lpString="*.md") returned 4 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.038] lstrlenA (lpString="*.mdf") returned 5 [0063.038] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.039] lstrlenA (lpString="*.dbf") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.039] lstrlenA (lpString="*.odt") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.039] lstrlenA (lpString="*.vob") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.039] lstrlenA (lpString="*.ifo") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.039] lstrlenA (lpString="*.lnk") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.039] lstrlenA (lpString="*.torrent") returned 9 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.039] lstrlenA (lpString="*.mov") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.039] lstrlenA (lpString="*.m2v") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.039] lstrlenA (lpString="*.3gp") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.039] lstrlenA (lpString="*.mpeg") returned 6 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.039] lstrlenA (lpString="*.mpg") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.039] lstrlenA (lpString="*.flv") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.039] lstrlenA (lpString="*.avi") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.039] lstrlenA (lpString="*.mp4") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.039] lstrlenA (lpString="*.wmv") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.039] lstrlenA (lpString="*.divx") returned 6 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.039] lstrlenA (lpString="*.mkv") returned 5 [0063.039] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.039] lstrlenA (lpString="*.mp3") returned 5 [0063.040] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.040] lstrlenA (lpString="*.wav") returned 5 [0063.040] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.040] lstrlenA (lpString="*.flac") returned 6 [0063.040] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.040] lstrlenA (lpString="*.ape") returned 5 [0063.040] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.040] lstrlenA (lpString="*.wma") returned 5 [0063.040] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.040] lstrlenA (lpString="*.ac3") returned 5 [0063.040] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.040] lstrlenA (lpString="*.doc") returned 5 [0063.040] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.040] FindClose (in: hFindFile=0x759f50 | out: hFindFile=0x759f50) returned 1 [0063.040] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0063.040] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0063.040] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0063.040] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.040] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE" [0063.040] lstrlenA (lpString="C:\\Boot\\de-DE") returned 13 [0063.040] FindFirstFileA (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759dd0 [0063.041] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.041] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.041] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.041] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.041] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.041] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.041] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.041] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.041] PathFindFileNameA (pszPath="C:\\Boot\\de-DE\\*.*") returned="*.*" [0063.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\de-DE\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\" [0063.041] PathAddBackslashA (in: pszPath="C:\\Boot\\de-DE\\" | out: pszPath="C:\\Boot\\de-DE\\") returned="" [0063.041] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" [0063.041] GetFileAttributesA (lpFileName="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\de-de\\how to decrypt files.txt")) returned 0xffffffff [0063.041] CreateFileA (lpFileName="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\de-de\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.058] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.058] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.059] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.060] CloseHandle (hObject=0x208) returned 1 [0063.060] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui" [0063.060] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.060] lstrlenA (lpString="*.zip") returned 5 [0063.060] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.060] lstrlenA (lpString="*.rar") returned 5 [0063.060] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.060] lstrlenA (lpString="*.7z") returned 4 [0063.060] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.060] lstrlenA (lpString="*.tar") returned 5 [0063.060] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.060] lstrlenA (lpString="*.gzip") returned 6 [0063.060] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.060] lstrlenA (lpString="*.jpg") returned 5 [0063.060] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.060] lstrlenA (lpString="*.jpeg") returned 6 [0063.060] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.061] lstrlenA (lpString="*.psd") returned 5 [0063.061] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.061] lstrlenA (lpString="*.cdr") returned 5 [0063.061] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.061] lstrlenA (lpString="*.dwg") returned 5 [0063.061] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.061] lstrlenA (lpString="*.max") returned 5 [0063.061] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.061] lstrlenA (lpString="*.bmp") returned 5 [0063.061] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.061] lstrlenA (lpString="*.gif") returned 5 [0063.061] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.061] lstrlenA (lpString="*.png") returned 5 [0063.061] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.061] lstrlenA (lpString="*.doc") returned 5 [0063.061] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.063] lstrlenA (lpString="*.docx") returned 6 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.063] lstrlenA (lpString="*.xls") returned 5 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.063] lstrlenA (lpString="*.xlsx") returned 6 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.063] lstrlenA (lpString="*.ppt") returned 5 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.063] lstrlenA (lpString="*.pptx") returned 6 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.063] lstrlenA (lpString="*.txt") returned 5 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.063] lstrlenA (lpString="*.pdf") returned 5 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.063] lstrlenA (lpString="*.djvu") returned 6 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.063] lstrlenA (lpString="*.htm") returned 5 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.063] lstrlenA (lpString="*.html") returned 6 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.063] lstrlenA (lpString="*.mdb") returned 5 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.063] lstrlenA (lpString="*.cer") returned 5 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.063] lstrlenA (lpString="*.p12") returned 5 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.063] lstrlenA (lpString="*.pfx") returned 5 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.063] lstrlenA (lpString="*.kwm") returned 5 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.063] lstrlenA (lpString="*.pwm") returned 5 [0063.063] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.064] lstrlenA (lpString="*.1cd") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.064] lstrlenA (lpString="*.md") returned 4 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.064] lstrlenA (lpString="*.mdf") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.064] lstrlenA (lpString="*.dbf") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.064] lstrlenA (lpString="*.odt") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.064] lstrlenA (lpString="*.vob") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.064] lstrlenA (lpString="*.ifo") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.064] lstrlenA (lpString="*.lnk") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.064] lstrlenA (lpString="*.torrent") returned 9 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.064] lstrlenA (lpString="*.mov") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.064] lstrlenA (lpString="*.m2v") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.064] lstrlenA (lpString="*.3gp") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.064] lstrlenA (lpString="*.mpeg") returned 6 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.064] lstrlenA (lpString="*.mpg") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.064] lstrlenA (lpString="*.flv") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.065] lstrlenA (lpString="*.avi") returned 5 [0063.065] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.065] lstrlenA (lpString="*.mp4") returned 5 [0063.065] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.065] lstrlenA (lpString="*.wmv") returned 5 [0063.065] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.065] lstrlenA (lpString="*.divx") returned 6 [0063.065] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.065] lstrlenA (lpString="*.mkv") returned 5 [0063.065] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.065] lstrlenA (lpString="*.mp3") returned 5 [0063.065] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.065] lstrlenA (lpString="*.wav") returned 5 [0063.065] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.065] lstrlenA (lpString="*.flac") returned 6 [0063.065] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.065] lstrlenA (lpString="*.ape") returned 5 [0063.065] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.065] lstrlenA (lpString="*.wma") returned 5 [0063.065] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.065] lstrlenA (lpString="*.ac3") returned 5 [0063.065] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.065] lstrlenA (lpString="*.doc") returned 5 [0063.065] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.065] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.066] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.066] PathFindFileNameA (pszPath="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\de-DE\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\" [0063.066] PathAddBackslashA (in: pszPath="C:\\Boot\\de-DE\\" | out: pszPath="C:\\Boot\\de-DE\\") returned="" [0063.066] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" [0063.066] GetFileAttributesA (lpFileName="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\de-de\\how to decrypt files.txt")) returned 0x20 [0063.066] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\memtest.exe.mui") returned="C:\\Boot\\de-DE\\memtest.exe.mui" [0063.066] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.066] lstrlenA (lpString="*.zip") returned 5 [0063.066] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.066] lstrlenA (lpString="*.rar") returned 5 [0063.066] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.066] lstrlenA (lpString="*.7z") returned 4 [0063.066] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.066] lstrlenA (lpString="*.tar") returned 5 [0063.066] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.066] lstrlenA (lpString="*.gzip") returned 6 [0063.066] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.066] lstrlenA (lpString="*.jpg") returned 5 [0063.066] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.066] lstrlenA (lpString="*.jpeg") returned 6 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.067] lstrlenA (lpString="*.psd") returned 5 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.067] lstrlenA (lpString="*.cdr") returned 5 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.067] lstrlenA (lpString="*.dwg") returned 5 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.067] lstrlenA (lpString="*.max") returned 5 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.067] lstrlenA (lpString="*.bmp") returned 5 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.067] lstrlenA (lpString="*.gif") returned 5 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.067] lstrlenA (lpString="*.png") returned 5 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.067] lstrlenA (lpString="*.doc") returned 5 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.067] lstrlenA (lpString="*.docx") returned 6 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.067] lstrlenA (lpString="*.xls") returned 5 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.067] lstrlenA (lpString="*.xlsx") returned 6 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.067] lstrlenA (lpString="*.ppt") returned 5 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.067] lstrlenA (lpString="*.pptx") returned 6 [0063.067] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.067] lstrlenA (lpString="*.txt") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.068] lstrlenA (lpString="*.pdf") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.068] lstrlenA (lpString="*.djvu") returned 6 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.068] lstrlenA (lpString="*.htm") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.068] lstrlenA (lpString="*.html") returned 6 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.068] lstrlenA (lpString="*.mdb") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.068] lstrlenA (lpString="*.cer") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.068] lstrlenA (lpString="*.p12") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.068] lstrlenA (lpString="*.pfx") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.068] lstrlenA (lpString="*.kwm") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.068] lstrlenA (lpString="*.pwm") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.068] lstrlenA (lpString="*.1cd") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.068] lstrlenA (lpString="*.md") returned 4 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.068] lstrlenA (lpString="*.mdf") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.068] lstrlenA (lpString="*.dbf") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.069] lstrlenA (lpString="*.odt") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.069] lstrlenA (lpString="*.vob") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.069] lstrlenA (lpString="*.ifo") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.069] lstrlenA (lpString="*.lnk") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.069] lstrlenA (lpString="*.torrent") returned 9 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.069] lstrlenA (lpString="*.mov") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.069] lstrlenA (lpString="*.m2v") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.069] lstrlenA (lpString="*.3gp") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.069] lstrlenA (lpString="*.mpeg") returned 6 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.069] lstrlenA (lpString="*.mpg") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.069] lstrlenA (lpString="*.flv") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.069] lstrlenA (lpString="*.avi") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.069] lstrlenA (lpString="*.mp4") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.069] lstrlenA (lpString="*.wmv") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.069] lstrlenA (lpString="*.divx") returned 6 [0063.070] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.070] lstrlenA (lpString="*.mkv") returned 5 [0063.070] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.070] lstrlenA (lpString="*.mp3") returned 5 [0063.070] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.070] lstrlenA (lpString="*.wav") returned 5 [0063.070] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.070] lstrlenA (lpString="*.flac") returned 6 [0063.070] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.070] lstrlenA (lpString="*.ape") returned 5 [0063.070] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.070] lstrlenA (lpString="*.wma") returned 5 [0063.070] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.070] lstrlenA (lpString="*.ac3") returned 5 [0063.070] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.070] lstrlenA (lpString="*.doc") returned 5 [0063.070] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.070] FindClose (in: hFindFile=0x759dd0 | out: hFindFile=0x759dd0) returned 1 [0063.070] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0063.070] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1 [0063.070] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1 [0063.070] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.070] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR" [0063.071] lstrlenA (lpString="C:\\Boot\\el-GR") returned 13 [0063.071] FindFirstFileA (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0063.072] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.072] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.072] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.072] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.072] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.072] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.072] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.072] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.072] PathFindFileNameA (pszPath="C:\\Boot\\el-GR\\*.*") returned="*.*" [0063.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\el-GR\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\" [0063.072] PathAddBackslashA (in: pszPath="C:\\Boot\\el-GR\\" | out: pszPath="C:\\Boot\\el-GR\\") returned="" [0063.072] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" [0063.072] GetFileAttributesA (lpFileName="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\el-gr\\how to decrypt files.txt")) returned 0xffffffff [0063.072] CreateFileA (lpFileName="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\el-gr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.076] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.076] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.078] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.078] CloseHandle (hObject=0x208) returned 1 [0063.078] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui" [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.079] lstrlenA (lpString="*.zip") returned 5 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.079] lstrlenA (lpString="*.rar") returned 5 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.079] lstrlenA (lpString="*.7z") returned 4 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.079] lstrlenA (lpString="*.tar") returned 5 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.079] lstrlenA (lpString="*.gzip") returned 6 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.079] lstrlenA (lpString="*.jpg") returned 5 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.079] lstrlenA (lpString="*.jpeg") returned 6 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.079] lstrlenA (lpString="*.psd") returned 5 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.079] lstrlenA (lpString="*.cdr") returned 5 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.079] lstrlenA (lpString="*.dwg") returned 5 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.079] lstrlenA (lpString="*.max") returned 5 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.079] lstrlenA (lpString="*.bmp") returned 5 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.079] lstrlenA (lpString="*.gif") returned 5 [0063.079] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.079] lstrlenA (lpString="*.png") returned 5 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.080] lstrlenA (lpString="*.doc") returned 5 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.080] lstrlenA (lpString="*.docx") returned 6 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.080] lstrlenA (lpString="*.xls") returned 5 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.080] lstrlenA (lpString="*.xlsx") returned 6 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.080] lstrlenA (lpString="*.ppt") returned 5 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.080] lstrlenA (lpString="*.pptx") returned 6 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.080] lstrlenA (lpString="*.txt") returned 5 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.080] lstrlenA (lpString="*.pdf") returned 5 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.080] lstrlenA (lpString="*.djvu") returned 6 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.080] lstrlenA (lpString="*.htm") returned 5 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.080] lstrlenA (lpString="*.html") returned 6 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.080] lstrlenA (lpString="*.mdb") returned 5 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.080] lstrlenA (lpString="*.cer") returned 5 [0063.080] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.080] lstrlenA (lpString="*.p12") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.081] lstrlenA (lpString="*.pfx") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.081] lstrlenA (lpString="*.kwm") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.081] lstrlenA (lpString="*.pwm") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.081] lstrlenA (lpString="*.1cd") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.081] lstrlenA (lpString="*.md") returned 4 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.081] lstrlenA (lpString="*.mdf") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.081] lstrlenA (lpString="*.dbf") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.081] lstrlenA (lpString="*.odt") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.081] lstrlenA (lpString="*.vob") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.081] lstrlenA (lpString="*.ifo") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.081] lstrlenA (lpString="*.lnk") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.081] lstrlenA (lpString="*.torrent") returned 9 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.081] lstrlenA (lpString="*.mov") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.081] lstrlenA (lpString="*.m2v") returned 5 [0063.081] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.081] lstrlenA (lpString="*.3gp") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.082] lstrlenA (lpString="*.mpeg") returned 6 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.082] lstrlenA (lpString="*.mpg") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.082] lstrlenA (lpString="*.flv") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.082] lstrlenA (lpString="*.avi") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.082] lstrlenA (lpString="*.mp4") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.082] lstrlenA (lpString="*.wmv") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.082] lstrlenA (lpString="*.divx") returned 6 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.082] lstrlenA (lpString="*.mkv") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.082] lstrlenA (lpString="*.mp3") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.082] lstrlenA (lpString="*.wav") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.082] lstrlenA (lpString="*.flac") returned 6 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.082] lstrlenA (lpString="*.ape") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.082] lstrlenA (lpString="*.wma") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.082] lstrlenA (lpString="*.ac3") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.082] lstrlenA (lpString="*.doc") returned 5 [0063.083] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.083] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.083] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.083] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.083] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.083] PathFindFileNameA (pszPath="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.083] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\el-GR\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\" [0063.083] PathAddBackslashA (in: pszPath="C:\\Boot\\el-GR\\" | out: pszPath="C:\\Boot\\el-GR\\") returned="" [0063.083] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" [0063.083] GetFileAttributesA (lpFileName="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\el-gr\\how to decrypt files.txt")) returned 0x20 [0063.083] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\memtest.exe.mui") returned="C:\\Boot\\el-GR\\memtest.exe.mui" [0063.083] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.083] lstrlenA (lpString="*.zip") returned 5 [0063.083] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.083] lstrlenA (lpString="*.rar") returned 5 [0063.083] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.083] lstrlenA (lpString="*.7z") returned 4 [0063.083] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.083] lstrlenA (lpString="*.tar") returned 5 [0063.083] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.083] lstrlenA (lpString="*.gzip") returned 6 [0063.083] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.084] lstrlenA (lpString="*.jpg") returned 5 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.084] lstrlenA (lpString="*.jpeg") returned 6 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.084] lstrlenA (lpString="*.psd") returned 5 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.084] lstrlenA (lpString="*.cdr") returned 5 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.084] lstrlenA (lpString="*.dwg") returned 5 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.084] lstrlenA (lpString="*.max") returned 5 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.084] lstrlenA (lpString="*.bmp") returned 5 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.084] lstrlenA (lpString="*.gif") returned 5 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.084] lstrlenA (lpString="*.png") returned 5 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.084] lstrlenA (lpString="*.doc") returned 5 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.084] lstrlenA (lpString="*.docx") returned 6 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.084] lstrlenA (lpString="*.xls") returned 5 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.084] lstrlenA (lpString="*.xlsx") returned 6 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.084] lstrlenA (lpString="*.ppt") returned 5 [0063.084] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.085] lstrlenA (lpString="*.pptx") returned 6 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.085] lstrlenA (lpString="*.txt") returned 5 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.085] lstrlenA (lpString="*.pdf") returned 5 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.085] lstrlenA (lpString="*.djvu") returned 6 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.085] lstrlenA (lpString="*.htm") returned 5 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.085] lstrlenA (lpString="*.html") returned 6 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.085] lstrlenA (lpString="*.mdb") returned 5 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.085] lstrlenA (lpString="*.cer") returned 5 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.085] lstrlenA (lpString="*.p12") returned 5 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.085] lstrlenA (lpString="*.pfx") returned 5 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.085] lstrlenA (lpString="*.kwm") returned 5 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.085] lstrlenA (lpString="*.pwm") returned 5 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.085] lstrlenA (lpString="*.1cd") returned 5 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.085] lstrlenA (lpString="*.md") returned 4 [0063.085] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.086] lstrlenA (lpString="*.mdf") returned 5 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.086] lstrlenA (lpString="*.dbf") returned 5 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.086] lstrlenA (lpString="*.odt") returned 5 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.086] lstrlenA (lpString="*.vob") returned 5 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.086] lstrlenA (lpString="*.ifo") returned 5 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.086] lstrlenA (lpString="*.lnk") returned 5 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.086] lstrlenA (lpString="*.torrent") returned 9 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.086] lstrlenA (lpString="*.mov") returned 5 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.086] lstrlenA (lpString="*.m2v") returned 5 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.086] lstrlenA (lpString="*.3gp") returned 5 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.086] lstrlenA (lpString="*.mpeg") returned 6 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.086] lstrlenA (lpString="*.mpg") returned 5 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.086] lstrlenA (lpString="*.flv") returned 5 [0063.086] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.086] lstrlenA (lpString="*.avi") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.087] lstrlenA (lpString="*.mp4") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.087] lstrlenA (lpString="*.wmv") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.087] lstrlenA (lpString="*.divx") returned 6 [0063.087] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.087] lstrlenA (lpString="*.mkv") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.087] lstrlenA (lpString="*.mp3") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.087] lstrlenA (lpString="*.wav") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.087] lstrlenA (lpString="*.flac") returned 6 [0063.087] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.087] lstrlenA (lpString="*.ape") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.087] lstrlenA (lpString="*.wma") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.087] lstrlenA (lpString="*.ac3") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.087] lstrlenA (lpString="*.doc") returned 5 [0063.087] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.087] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0063.088] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0063.088] lstrcmpA (lpString1=".", lpString2="en-GB") returned -1 [0063.088] lstrcmpA (lpString1="..", lpString2="en-GB") returned -1 [0063.088] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.088] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="en-GB" | out: lpString1="C:\\Boot\\en-GB") returned="C:\\Boot\\en-GB" [0063.088] lstrlenA (lpString="C:\\Boot\\en-GB") returned 13 [0063.088] FindFirstFileA (in: lpFileName="C:\\Boot\\en-GB\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0063.089] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.089] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.089] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.089] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.089] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.089] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.089] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.089] PathFindFileNameA (pszPath="C:\\Boot\\en-GB\\*.*") returned="*.*" [0063.089] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-GB\\" | out: lpString1="C:\\Boot\\en-GB\\") returned="C:\\Boot\\en-GB\\" [0063.089] PathAddBackslashA (in: pszPath="C:\\Boot\\en-GB\\" | out: pszPath="C:\\Boot\\en-GB\\") returned="" [0063.089] lstrcatA (in: lpString1="C:\\Boot\\en-GB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\en-GB\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\en-GB\\HOW TO DECRYPT FILES.txt" [0063.089] GetFileAttributesA (lpFileName="C:\\Boot\\en-GB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-gb\\how to decrypt files.txt")) returned 0xffffffff [0063.090] CreateFileA (lpFileName="C:\\Boot\\en-GB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-gb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.090] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.090] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.091] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.091] CloseHandle (hObject=0x208) returned 1 [0063.092] lstrcatA (in: lpString1="C:\\Boot\\en-GB\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned="C:\\Boot\\en-GB\\bootmgr.exe.mui" [0063.092] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.092] lstrlenA (lpString="*.zip") returned 5 [0063.092] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.092] lstrlenA (lpString="*.rar") returned 5 [0063.092] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.092] lstrlenA (lpString="*.7z") returned 4 [0063.092] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.092] lstrlenA (lpString="*.tar") returned 5 [0063.092] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.092] lstrlenA (lpString="*.gzip") returned 6 [0063.092] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.092] lstrlenA (lpString="*.jpg") returned 5 [0063.092] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.092] lstrlenA (lpString="*.jpeg") returned 6 [0063.136] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.136] lstrlenA (lpString="*.psd") returned 5 [0063.136] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.136] lstrlenA (lpString="*.cdr") returned 5 [0063.136] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.136] lstrlenA (lpString="*.dwg") returned 5 [0063.136] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.136] lstrlenA (lpString="*.max") returned 5 [0063.136] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.136] lstrlenA (lpString="*.bmp") returned 5 [0063.136] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.136] lstrlenA (lpString="*.gif") returned 5 [0063.136] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.136] lstrlenA (lpString="*.png") returned 5 [0063.136] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.136] lstrlenA (lpString="*.doc") returned 5 [0063.136] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.136] lstrlenA (lpString="*.docx") returned 6 [0063.136] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.136] lstrlenA (lpString="*.xls") returned 5 [0063.136] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.137] lstrlenA (lpString="*.xlsx") returned 6 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.137] lstrlenA (lpString="*.ppt") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.137] lstrlenA (lpString="*.pptx") returned 6 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.137] lstrlenA (lpString="*.txt") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.137] lstrlenA (lpString="*.pdf") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.137] lstrlenA (lpString="*.djvu") returned 6 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.137] lstrlenA (lpString="*.htm") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.137] lstrlenA (lpString="*.html") returned 6 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.137] lstrlenA (lpString="*.mdb") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.137] lstrlenA (lpString="*.cer") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.137] lstrlenA (lpString="*.p12") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.137] lstrlenA (lpString="*.pfx") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.137] lstrlenA (lpString="*.kwm") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.137] lstrlenA (lpString="*.pwm") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.137] lstrlenA (lpString="*.1cd") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.137] lstrlenA (lpString="*.md") returned 4 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.137] lstrlenA (lpString="*.mdf") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.137] lstrlenA (lpString="*.dbf") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.137] lstrlenA (lpString="*.odt") returned 5 [0063.137] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.138] lstrlenA (lpString="*.vob") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.138] lstrlenA (lpString="*.ifo") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.138] lstrlenA (lpString="*.lnk") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.138] lstrlenA (lpString="*.torrent") returned 9 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.138] lstrlenA (lpString="*.mov") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.138] lstrlenA (lpString="*.m2v") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.138] lstrlenA (lpString="*.3gp") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.138] lstrlenA (lpString="*.mpeg") returned 6 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.138] lstrlenA (lpString="*.mpg") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.138] lstrlenA (lpString="*.flv") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.138] lstrlenA (lpString="*.avi") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.138] lstrlenA (lpString="*.mp4") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.138] lstrlenA (lpString="*.wmv") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.138] lstrlenA (lpString="*.divx") returned 6 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.138] lstrlenA (lpString="*.mkv") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.138] lstrlenA (lpString="*.mp3") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.138] lstrlenA (lpString="*.wav") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.138] lstrlenA (lpString="*.flac") returned 6 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.138] lstrlenA (lpString="*.ape") returned 5 [0063.138] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.139] lstrlenA (lpString="*.wma") returned 5 [0063.139] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.139] lstrlenA (lpString="*.ac3") returned 5 [0063.139] PathMatchSpecA (pszFile="C:\\Boot\\en-GB\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.139] lstrlenA (lpString="*.doc") returned 5 [0063.139] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.139] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0063.139] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="en-US", cAlternateFileName="")) returned 1 [0063.139] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0063.139] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0063.139] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.139] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US" [0063.139] lstrlenA (lpString="C:\\Boot\\en-US") returned 13 [0063.139] FindFirstFileA (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0063.140] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.140] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0063.140] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.140] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.140] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.140] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.140] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.140] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\*.*") returned="*.*" [0063.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0063.140] PathAddBackslashA (in: pszPath="C:\\Boot\\en-US\\" | out: pszPath="C:\\Boot\\en-US\\") returned="" [0063.140] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" [0063.140] GetFileAttributesA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0063.140] CreateFileA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.142] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.142] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.143] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.147] CloseHandle (hObject=0x208) returned 1 [0063.147] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui" [0063.147] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.147] lstrlenA (lpString="*.zip") returned 5 [0063.147] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.147] lstrlenA (lpString="*.rar") returned 5 [0063.147] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.147] lstrlenA (lpString="*.7z") returned 4 [0063.147] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.147] lstrlenA (lpString="*.tar") returned 5 [0063.147] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.147] lstrlenA (lpString="*.gzip") returned 6 [0063.147] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.147] lstrlenA (lpString="*.jpg") returned 5 [0063.147] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.147] lstrlenA (lpString="*.jpeg") returned 6 [0063.147] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.147] lstrlenA (lpString="*.psd") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.148] lstrlenA (lpString="*.cdr") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.148] lstrlenA (lpString="*.dwg") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.148] lstrlenA (lpString="*.max") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.148] lstrlenA (lpString="*.bmp") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.148] lstrlenA (lpString="*.gif") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.148] lstrlenA (lpString="*.png") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.148] lstrlenA (lpString="*.doc") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.148] lstrlenA (lpString="*.docx") returned 6 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.148] lstrlenA (lpString="*.xls") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.148] lstrlenA (lpString="*.xlsx") returned 6 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.148] lstrlenA (lpString="*.ppt") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.148] lstrlenA (lpString="*.pptx") returned 6 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.148] lstrlenA (lpString="*.txt") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.148] lstrlenA (lpString="*.pdf") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.148] lstrlenA (lpString="*.djvu") returned 6 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.148] lstrlenA (lpString="*.htm") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.148] lstrlenA (lpString="*.html") returned 6 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.148] lstrlenA (lpString="*.mdb") returned 5 [0063.148] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.148] lstrlenA (lpString="*.cer") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.149] lstrlenA (lpString="*.p12") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.149] lstrlenA (lpString="*.pfx") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.149] lstrlenA (lpString="*.kwm") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.149] lstrlenA (lpString="*.pwm") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.149] lstrlenA (lpString="*.1cd") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.149] lstrlenA (lpString="*.md") returned 4 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.149] lstrlenA (lpString="*.mdf") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.149] lstrlenA (lpString="*.dbf") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.149] lstrlenA (lpString="*.odt") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.149] lstrlenA (lpString="*.vob") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.149] lstrlenA (lpString="*.ifo") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.149] lstrlenA (lpString="*.lnk") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.149] lstrlenA (lpString="*.torrent") returned 9 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.149] lstrlenA (lpString="*.mov") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.149] lstrlenA (lpString="*.m2v") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.149] lstrlenA (lpString="*.3gp") returned 5 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.149] lstrlenA (lpString="*.mpeg") returned 6 [0063.149] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.150] lstrlenA (lpString="*.mpg") returned 5 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.150] lstrlenA (lpString="*.flv") returned 5 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.150] lstrlenA (lpString="*.avi") returned 5 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.150] lstrlenA (lpString="*.mp4") returned 5 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.150] lstrlenA (lpString="*.wmv") returned 5 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.150] lstrlenA (lpString="*.divx") returned 6 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.150] lstrlenA (lpString="*.mkv") returned 5 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.150] lstrlenA (lpString="*.mp3") returned 5 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.150] lstrlenA (lpString="*.wav") returned 5 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.150] lstrlenA (lpString="*.flac") returned 6 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.150] lstrlenA (lpString="*.ape") returned 5 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.150] lstrlenA (lpString="*.wma") returned 5 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.150] lstrlenA (lpString="*.ac3") returned 5 [0063.150] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.150] lstrlenA (lpString="*.doc") returned 5 [0063.150] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.150] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.150] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.150] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.150] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0063.150] PathAddBackslashA (in: pszPath="C:\\Boot\\en-US\\" | out: pszPath="C:\\Boot\\en-US\\") returned="" [0063.150] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" [0063.151] GetFileAttributesA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt")) returned 0x20 [0063.151] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui" [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.151] lstrlenA (lpString="*.zip") returned 5 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.151] lstrlenA (lpString="*.rar") returned 5 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.151] lstrlenA (lpString="*.7z") returned 4 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.151] lstrlenA (lpString="*.tar") returned 5 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.151] lstrlenA (lpString="*.gzip") returned 6 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.151] lstrlenA (lpString="*.jpg") returned 5 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.151] lstrlenA (lpString="*.jpeg") returned 6 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.151] lstrlenA (lpString="*.psd") returned 5 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.151] lstrlenA (lpString="*.cdr") returned 5 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.151] lstrlenA (lpString="*.dwg") returned 5 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.151] lstrlenA (lpString="*.max") returned 5 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.151] lstrlenA (lpString="*.bmp") returned 5 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.151] lstrlenA (lpString="*.gif") returned 5 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.151] lstrlenA (lpString="*.png") returned 5 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.151] lstrlenA (lpString="*.doc") returned 5 [0063.151] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.152] lstrlenA (lpString="*.docx") returned 6 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.152] lstrlenA (lpString="*.xls") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.152] lstrlenA (lpString="*.xlsx") returned 6 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.152] lstrlenA (lpString="*.ppt") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.152] lstrlenA (lpString="*.pptx") returned 6 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.152] lstrlenA (lpString="*.txt") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.152] lstrlenA (lpString="*.pdf") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.152] lstrlenA (lpString="*.djvu") returned 6 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.152] lstrlenA (lpString="*.htm") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.152] lstrlenA (lpString="*.html") returned 6 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.152] lstrlenA (lpString="*.mdb") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.152] lstrlenA (lpString="*.cer") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.152] lstrlenA (lpString="*.p12") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.152] lstrlenA (lpString="*.pfx") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.152] lstrlenA (lpString="*.kwm") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.152] lstrlenA (lpString="*.pwm") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.152] lstrlenA (lpString="*.1cd") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.152] lstrlenA (lpString="*.md") returned 4 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.152] lstrlenA (lpString="*.mdf") returned 5 [0063.152] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.153] lstrlenA (lpString="*.dbf") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.153] lstrlenA (lpString="*.odt") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.153] lstrlenA (lpString="*.vob") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.153] lstrlenA (lpString="*.ifo") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.153] lstrlenA (lpString="*.lnk") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.153] lstrlenA (lpString="*.torrent") returned 9 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.153] lstrlenA (lpString="*.mov") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.153] lstrlenA (lpString="*.m2v") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.153] lstrlenA (lpString="*.3gp") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.153] lstrlenA (lpString="*.mpeg") returned 6 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.153] lstrlenA (lpString="*.mpg") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.153] lstrlenA (lpString="*.flv") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.153] lstrlenA (lpString="*.avi") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.153] lstrlenA (lpString="*.mp4") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.153] lstrlenA (lpString="*.wmv") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.153] lstrlenA (lpString="*.divx") returned 6 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.153] lstrlenA (lpString="*.mkv") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.153] lstrlenA (lpString="*.mp3") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.153] lstrlenA (lpString="*.wav") returned 5 [0063.153] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.154] lstrlenA (lpString="*.flac") returned 6 [0063.154] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.154] lstrlenA (lpString="*.ape") returned 5 [0063.154] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.154] lstrlenA (lpString="*.wma") returned 5 [0063.154] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.154] lstrlenA (lpString="*.ac3") returned 5 [0063.154] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.154] lstrlenA (lpString="*.doc") returned 5 [0063.154] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.154] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0063.154] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0063.154] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1 [0063.154] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1 [0063.154] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.154] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES" [0063.154] lstrlenA (lpString="C:\\Boot\\es-ES") returned 13 [0063.154] FindFirstFileA (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0063.155] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.155] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.156] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.156] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.156] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.156] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.156] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.156] PathFindFileNameA (pszPath="C:\\Boot\\es-ES\\*.*") returned="*.*" [0063.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\es-ES\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\" [0063.156] PathAddBackslashA (in: pszPath="C:\\Boot\\es-ES\\" | out: pszPath="C:\\Boot\\es-ES\\") returned="" [0063.156] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" [0063.156] GetFileAttributesA (lpFileName="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-es\\how to decrypt files.txt")) returned 0xffffffff [0063.156] CreateFileA (lpFileName="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.158] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.158] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.159] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.159] CloseHandle (hObject=0x208) returned 1 [0063.159] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui" [0063.159] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.159] lstrlenA (lpString="*.zip") returned 5 [0063.159] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.159] lstrlenA (lpString="*.rar") returned 5 [0063.159] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.159] lstrlenA (lpString="*.7z") returned 4 [0063.159] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.159] lstrlenA (lpString="*.tar") returned 5 [0063.159] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.159] lstrlenA (lpString="*.gzip") returned 6 [0063.159] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.159] lstrlenA (lpString="*.jpg") returned 5 [0063.159] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.159] lstrlenA (lpString="*.jpeg") returned 6 [0063.159] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.159] lstrlenA (lpString="*.psd") returned 5 [0063.159] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.160] lstrlenA (lpString="*.cdr") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.160] lstrlenA (lpString="*.dwg") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.160] lstrlenA (lpString="*.max") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.160] lstrlenA (lpString="*.bmp") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.160] lstrlenA (lpString="*.gif") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.160] lstrlenA (lpString="*.png") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.160] lstrlenA (lpString="*.doc") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.160] lstrlenA (lpString="*.docx") returned 6 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.160] lstrlenA (lpString="*.xls") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.160] lstrlenA (lpString="*.xlsx") returned 6 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.160] lstrlenA (lpString="*.ppt") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.160] lstrlenA (lpString="*.pptx") returned 6 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.160] lstrlenA (lpString="*.txt") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.160] lstrlenA (lpString="*.pdf") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.160] lstrlenA (lpString="*.djvu") returned 6 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.160] lstrlenA (lpString="*.htm") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.160] lstrlenA (lpString="*.html") returned 6 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.160] lstrlenA (lpString="*.mdb") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.160] lstrlenA (lpString="*.cer") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.161] lstrlenA (lpString="*.p12") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.161] lstrlenA (lpString="*.pfx") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.161] lstrlenA (lpString="*.kwm") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.161] lstrlenA (lpString="*.pwm") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.161] lstrlenA (lpString="*.1cd") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.161] lstrlenA (lpString="*.md") returned 4 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.161] lstrlenA (lpString="*.mdf") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.161] lstrlenA (lpString="*.dbf") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.161] lstrlenA (lpString="*.odt") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.161] lstrlenA (lpString="*.vob") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.161] lstrlenA (lpString="*.ifo") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.161] lstrlenA (lpString="*.lnk") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.161] lstrlenA (lpString="*.torrent") returned 9 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.161] lstrlenA (lpString="*.mov") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.161] lstrlenA (lpString="*.m2v") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.161] lstrlenA (lpString="*.3gp") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.161] lstrlenA (lpString="*.mpeg") returned 6 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.161] lstrlenA (lpString="*.mpg") returned 5 [0063.161] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.161] lstrlenA (lpString="*.flv") returned 5 [0063.162] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.162] lstrlenA (lpString="*.avi") returned 5 [0063.162] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.162] lstrlenA (lpString="*.mp4") returned 5 [0063.162] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.162] lstrlenA (lpString="*.wmv") returned 5 [0063.162] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.162] lstrlenA (lpString="*.divx") returned 6 [0063.162] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.162] lstrlenA (lpString="*.mkv") returned 5 [0063.162] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.162] lstrlenA (lpString="*.mp3") returned 5 [0063.162] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.162] lstrlenA (lpString="*.wav") returned 5 [0063.162] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.162] lstrlenA (lpString="*.flac") returned 6 [0063.162] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.162] lstrlenA (lpString="*.ape") returned 5 [0063.162] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.162] lstrlenA (lpString="*.wma") returned 5 [0063.162] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.162] lstrlenA (lpString="*.ac3") returned 5 [0063.162] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.162] lstrlenA (lpString="*.doc") returned 5 [0063.162] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.162] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.162] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.162] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.162] PathFindFileNameA (pszPath="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\es-ES\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\" [0063.162] PathAddBackslashA (in: pszPath="C:\\Boot\\es-ES\\" | out: pszPath="C:\\Boot\\es-ES\\") returned="" [0063.162] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" [0063.162] GetFileAttributesA (lpFileName="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-es\\how to decrypt files.txt")) returned 0x20 [0063.163] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\memtest.exe.mui") returned="C:\\Boot\\es-ES\\memtest.exe.mui" [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.163] lstrlenA (lpString="*.zip") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.163] lstrlenA (lpString="*.rar") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.163] lstrlenA (lpString="*.7z") returned 4 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.163] lstrlenA (lpString="*.tar") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.163] lstrlenA (lpString="*.gzip") returned 6 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.163] lstrlenA (lpString="*.jpg") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.163] lstrlenA (lpString="*.jpeg") returned 6 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.163] lstrlenA (lpString="*.psd") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.163] lstrlenA (lpString="*.cdr") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.163] lstrlenA (lpString="*.dwg") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.163] lstrlenA (lpString="*.max") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.163] lstrlenA (lpString="*.bmp") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.163] lstrlenA (lpString="*.gif") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.163] lstrlenA (lpString="*.png") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.163] lstrlenA (lpString="*.doc") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.163] lstrlenA (lpString="*.docx") returned 6 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.163] lstrlenA (lpString="*.xls") returned 5 [0063.163] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.163] lstrlenA (lpString="*.xlsx") returned 6 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.164] lstrlenA (lpString="*.ppt") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.164] lstrlenA (lpString="*.pptx") returned 6 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.164] lstrlenA (lpString="*.txt") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.164] lstrlenA (lpString="*.pdf") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.164] lstrlenA (lpString="*.djvu") returned 6 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.164] lstrlenA (lpString="*.htm") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.164] lstrlenA (lpString="*.html") returned 6 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.164] lstrlenA (lpString="*.mdb") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.164] lstrlenA (lpString="*.cer") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.164] lstrlenA (lpString="*.p12") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.164] lstrlenA (lpString="*.pfx") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.164] lstrlenA (lpString="*.kwm") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.164] lstrlenA (lpString="*.pwm") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.164] lstrlenA (lpString="*.1cd") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.164] lstrlenA (lpString="*.md") returned 4 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.164] lstrlenA (lpString="*.mdf") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.164] lstrlenA (lpString="*.dbf") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.164] lstrlenA (lpString="*.odt") returned 5 [0063.164] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.164] lstrlenA (lpString="*.vob") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.165] lstrlenA (lpString="*.ifo") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.165] lstrlenA (lpString="*.lnk") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.165] lstrlenA (lpString="*.torrent") returned 9 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.165] lstrlenA (lpString="*.mov") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.165] lstrlenA (lpString="*.m2v") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.165] lstrlenA (lpString="*.3gp") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.165] lstrlenA (lpString="*.mpeg") returned 6 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.165] lstrlenA (lpString="*.mpg") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.165] lstrlenA (lpString="*.flv") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.165] lstrlenA (lpString="*.avi") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.165] lstrlenA (lpString="*.mp4") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.165] lstrlenA (lpString="*.wmv") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.165] lstrlenA (lpString="*.divx") returned 6 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.165] lstrlenA (lpString="*.mkv") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.165] lstrlenA (lpString="*.mp3") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.165] lstrlenA (lpString="*.wav") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.165] lstrlenA (lpString="*.flac") returned 6 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.165] lstrlenA (lpString="*.ape") returned 5 [0063.165] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.165] lstrlenA (lpString="*.wma") returned 5 [0063.166] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.166] lstrlenA (lpString="*.ac3") returned 5 [0063.166] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.166] lstrlenA (lpString="*.doc") returned 5 [0063.166] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.166] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0063.166] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0063.166] lstrcmpA (lpString1=".", lpString2="es-MX") returned -1 [0063.166] lstrcmpA (lpString1="..", lpString2="es-MX") returned -1 [0063.166] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.166] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="es-MX" | out: lpString1="C:\\Boot\\es-MX") returned="C:\\Boot\\es-MX" [0063.166] lstrlenA (lpString="C:\\Boot\\es-MX") returned 13 [0063.166] FindFirstFileA (in: lpFileName="C:\\Boot\\es-MX\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759b50 [0063.167] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.167] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.167] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.167] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.167] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.167] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.167] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.167] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.167] PathFindFileNameA (pszPath="C:\\Boot\\es-MX\\*.*") returned="*.*" [0063.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\es-MX\\" | out: lpString1="C:\\Boot\\es-MX\\") returned="C:\\Boot\\es-MX\\" [0063.167] PathAddBackslashA (in: pszPath="C:\\Boot\\es-MX\\" | out: pszPath="C:\\Boot\\es-MX\\") returned="" [0063.167] lstrcatA (in: lpString1="C:\\Boot\\es-MX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\es-MX\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\es-MX\\HOW TO DECRYPT FILES.txt" [0063.167] GetFileAttributesA (lpFileName="C:\\Boot\\es-MX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-mx\\how to decrypt files.txt")) returned 0xffffffff [0063.167] CreateFileA (lpFileName="C:\\Boot\\es-MX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-mx\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.167] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.167] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.169] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.169] CloseHandle (hObject=0x208) returned 1 [0063.169] lstrcatA (in: lpString1="C:\\Boot\\es-MX\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned="C:\\Boot\\es-MX\\bootmgr.exe.mui" [0063.169] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.169] lstrlenA (lpString="*.zip") returned 5 [0063.169] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.169] lstrlenA (lpString="*.rar") returned 5 [0063.169] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.169] lstrlenA (lpString="*.7z") returned 4 [0063.169] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.169] lstrlenA (lpString="*.tar") returned 5 [0063.169] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.169] lstrlenA (lpString="*.gzip") returned 6 [0063.169] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.169] lstrlenA (lpString="*.jpg") returned 5 [0063.169] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.169] lstrlenA (lpString="*.jpeg") returned 6 [0063.169] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.169] lstrlenA (lpString="*.psd") returned 5 [0063.169] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.169] lstrlenA (lpString="*.cdr") returned 5 [0063.169] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.170] lstrlenA (lpString="*.dwg") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.170] lstrlenA (lpString="*.max") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.170] lstrlenA (lpString="*.bmp") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.170] lstrlenA (lpString="*.gif") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.170] lstrlenA (lpString="*.png") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.170] lstrlenA (lpString="*.doc") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.170] lstrlenA (lpString="*.docx") returned 6 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.170] lstrlenA (lpString="*.xls") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.170] lstrlenA (lpString="*.xlsx") returned 6 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.170] lstrlenA (lpString="*.ppt") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.170] lstrlenA (lpString="*.pptx") returned 6 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.170] lstrlenA (lpString="*.txt") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.170] lstrlenA (lpString="*.pdf") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.170] lstrlenA (lpString="*.djvu") returned 6 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.170] lstrlenA (lpString="*.htm") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.170] lstrlenA (lpString="*.html") returned 6 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.170] lstrlenA (lpString="*.mdb") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.170] lstrlenA (lpString="*.cer") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.170] lstrlenA (lpString="*.p12") returned 5 [0063.170] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.170] lstrlenA (lpString="*.pfx") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.171] lstrlenA (lpString="*.kwm") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.171] lstrlenA (lpString="*.pwm") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.171] lstrlenA (lpString="*.1cd") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.171] lstrlenA (lpString="*.md") returned 4 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.171] lstrlenA (lpString="*.mdf") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.171] lstrlenA (lpString="*.dbf") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.171] lstrlenA (lpString="*.odt") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.171] lstrlenA (lpString="*.vob") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.171] lstrlenA (lpString="*.ifo") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.171] lstrlenA (lpString="*.lnk") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.171] lstrlenA (lpString="*.torrent") returned 9 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.171] lstrlenA (lpString="*.mov") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.171] lstrlenA (lpString="*.m2v") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.171] lstrlenA (lpString="*.3gp") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.171] lstrlenA (lpString="*.mpeg") returned 6 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.171] lstrlenA (lpString="*.mpg") returned 5 [0063.171] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.171] lstrlenA (lpString="*.flv") returned 5 [0063.185] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.185] lstrlenA (lpString="*.avi") returned 5 [0063.186] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.186] lstrlenA (lpString="*.mp4") returned 5 [0063.186] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.187] lstrlenA (lpString="*.wmv") returned 5 [0063.187] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.187] lstrlenA (lpString="*.divx") returned 6 [0063.187] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.188] lstrlenA (lpString="*.mkv") returned 5 [0063.188] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.188] lstrlenA (lpString="*.mp3") returned 5 [0063.188] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.188] lstrlenA (lpString="*.wav") returned 5 [0063.188] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.190] lstrlenA (lpString="*.flac") returned 6 [0063.190] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.190] lstrlenA (lpString="*.ape") returned 5 [0063.190] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.190] lstrlenA (lpString="*.wma") returned 5 [0063.190] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.190] lstrlenA (lpString="*.ac3") returned 5 [0063.190] PathMatchSpecA (pszFile="C:\\Boot\\es-MX\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.193] lstrlenA (lpString="*.doc") returned 5 [0063.193] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.193] FindClose (in: hFindFile=0x759b50 | out: hFindFile=0x759b50) returned 1 [0063.193] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0063.193] lstrcmpA (lpString1=".", lpString2="et-EE") returned -1 [0063.193] lstrcmpA (lpString1="..", lpString2="et-EE") returned -1 [0063.194] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.194] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="et-EE" | out: lpString1="C:\\Boot\\et-EE") returned="C:\\Boot\\et-EE" [0063.194] lstrlenA (lpString="C:\\Boot\\et-EE") returned 13 [0063.194] FindFirstFileA (in: lpFileName="C:\\Boot\\et-EE\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759e50 [0063.194] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.194] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0063.194] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.194] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.194] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.194] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.194] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.194] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.194] PathFindFileNameA (pszPath="C:\\Boot\\et-EE\\*.*") returned="*.*" [0063.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\et-EE\\" | out: lpString1="C:\\Boot\\et-EE\\") returned="C:\\Boot\\et-EE\\" [0063.194] PathAddBackslashA (in: pszPath="C:\\Boot\\et-EE\\" | out: pszPath="C:\\Boot\\et-EE\\") returned="" [0063.194] lstrcatA (in: lpString1="C:\\Boot\\et-EE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\et-EE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\et-EE\\HOW TO DECRYPT FILES.txt" [0063.194] GetFileAttributesA (lpFileName="C:\\Boot\\et-EE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\et-ee\\how to decrypt files.txt")) returned 0xffffffff [0063.194] CreateFileA (lpFileName="C:\\Boot\\et-EE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\et-ee\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.195] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.195] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.196] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.196] CloseHandle (hObject=0x208) returned 1 [0063.196] lstrcatA (in: lpString1="C:\\Boot\\et-EE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned="C:\\Boot\\et-EE\\bootmgr.exe.mui" [0063.196] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.196] lstrlenA (lpString="*.zip") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.197] lstrlenA (lpString="*.rar") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.197] lstrlenA (lpString="*.7z") returned 4 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.197] lstrlenA (lpString="*.tar") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.197] lstrlenA (lpString="*.gzip") returned 6 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.197] lstrlenA (lpString="*.jpg") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.197] lstrlenA (lpString="*.jpeg") returned 6 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.197] lstrlenA (lpString="*.psd") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.197] lstrlenA (lpString="*.cdr") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.197] lstrlenA (lpString="*.dwg") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.197] lstrlenA (lpString="*.max") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.197] lstrlenA (lpString="*.bmp") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.197] lstrlenA (lpString="*.gif") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.197] lstrlenA (lpString="*.png") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.197] lstrlenA (lpString="*.doc") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.197] lstrlenA (lpString="*.docx") returned 6 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.197] lstrlenA (lpString="*.xls") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.197] lstrlenA (lpString="*.xlsx") returned 6 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.197] lstrlenA (lpString="*.ppt") returned 5 [0063.197] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.198] lstrlenA (lpString="*.pptx") returned 6 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.198] lstrlenA (lpString="*.txt") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.198] lstrlenA (lpString="*.pdf") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.198] lstrlenA (lpString="*.djvu") returned 6 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.198] lstrlenA (lpString="*.htm") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.198] lstrlenA (lpString="*.html") returned 6 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.198] lstrlenA (lpString="*.mdb") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.198] lstrlenA (lpString="*.cer") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.198] lstrlenA (lpString="*.p12") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.198] lstrlenA (lpString="*.pfx") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.198] lstrlenA (lpString="*.kwm") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.198] lstrlenA (lpString="*.pwm") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.198] lstrlenA (lpString="*.1cd") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.198] lstrlenA (lpString="*.md") returned 4 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.198] lstrlenA (lpString="*.mdf") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.198] lstrlenA (lpString="*.dbf") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.198] lstrlenA (lpString="*.odt") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.198] lstrlenA (lpString="*.vob") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.198] lstrlenA (lpString="*.ifo") returned 5 [0063.198] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.199] lstrlenA (lpString="*.lnk") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.199] lstrlenA (lpString="*.torrent") returned 9 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.199] lstrlenA (lpString="*.mov") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.199] lstrlenA (lpString="*.m2v") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.199] lstrlenA (lpString="*.3gp") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.199] lstrlenA (lpString="*.mpeg") returned 6 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.199] lstrlenA (lpString="*.mpg") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.199] lstrlenA (lpString="*.flv") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.199] lstrlenA (lpString="*.avi") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.199] lstrlenA (lpString="*.mp4") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.199] lstrlenA (lpString="*.wmv") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.199] lstrlenA (lpString="*.divx") returned 6 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.199] lstrlenA (lpString="*.mkv") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.199] lstrlenA (lpString="*.mp3") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.199] lstrlenA (lpString="*.wav") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.199] lstrlenA (lpString="*.flac") returned 6 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.199] lstrlenA (lpString="*.ape") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.199] lstrlenA (lpString="*.wma") returned 5 [0063.199] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.199] lstrlenA (lpString="*.ac3") returned 5 [0063.200] PathMatchSpecA (pszFile="C:\\Boot\\et-EE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.200] lstrlenA (lpString="*.doc") returned 5 [0063.200] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.200] FindClose (in: hFindFile=0x759e50 | out: hFindFile=0x759e50) returned 1 [0063.200] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0063.200] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1 [0063.200] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1 [0063.200] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.200] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI" [0063.200] lstrlenA (lpString="C:\\Boot\\fi-FI") returned 13 [0063.200] FindFirstFileA (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0063.201] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.201] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0063.201] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.201] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.201] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.201] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.201] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.201] PathFindFileNameA (pszPath="C:\\Boot\\fi-FI\\*.*") returned="*.*" [0063.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fi-FI\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\" [0063.201] PathAddBackslashA (in: pszPath="C:\\Boot\\fi-FI\\" | out: pszPath="C:\\Boot\\fi-FI\\") returned="" [0063.201] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" [0063.201] GetFileAttributesA (lpFileName="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fi-fi\\how to decrypt files.txt")) returned 0xffffffff [0063.201] CreateFileA (lpFileName="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fi-fi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.203] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.203] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.204] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.204] CloseHandle (hObject=0x208) returned 1 [0063.205] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.205] lstrlenA (lpString="*.zip") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.205] lstrlenA (lpString="*.rar") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.205] lstrlenA (lpString="*.7z") returned 4 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.205] lstrlenA (lpString="*.tar") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.205] lstrlenA (lpString="*.gzip") returned 6 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.205] lstrlenA (lpString="*.jpg") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.205] lstrlenA (lpString="*.jpeg") returned 6 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.205] lstrlenA (lpString="*.psd") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.205] lstrlenA (lpString="*.cdr") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.205] lstrlenA (lpString="*.dwg") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.205] lstrlenA (lpString="*.max") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.205] lstrlenA (lpString="*.bmp") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.205] lstrlenA (lpString="*.gif") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.205] lstrlenA (lpString="*.png") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.205] lstrlenA (lpString="*.doc") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.205] lstrlenA (lpString="*.docx") returned 6 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.205] lstrlenA (lpString="*.xls") returned 5 [0063.205] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.206] lstrlenA (lpString="*.xlsx") returned 6 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.206] lstrlenA (lpString="*.ppt") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.206] lstrlenA (lpString="*.pptx") returned 6 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.206] lstrlenA (lpString="*.txt") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.206] lstrlenA (lpString="*.pdf") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.206] lstrlenA (lpString="*.djvu") returned 6 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.206] lstrlenA (lpString="*.htm") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.206] lstrlenA (lpString="*.html") returned 6 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.206] lstrlenA (lpString="*.mdb") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.206] lstrlenA (lpString="*.cer") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.206] lstrlenA (lpString="*.p12") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.206] lstrlenA (lpString="*.pfx") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.206] lstrlenA (lpString="*.kwm") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.206] lstrlenA (lpString="*.pwm") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.206] lstrlenA (lpString="*.1cd") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.206] lstrlenA (lpString="*.md") returned 4 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.206] lstrlenA (lpString="*.mdf") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.206] lstrlenA (lpString="*.dbf") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.206] lstrlenA (lpString="*.odt") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.207] lstrlenA (lpString="*.vob") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.207] lstrlenA (lpString="*.ifo") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.207] lstrlenA (lpString="*.lnk") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.207] lstrlenA (lpString="*.torrent") returned 9 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.207] lstrlenA (lpString="*.mov") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.207] lstrlenA (lpString="*.m2v") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.207] lstrlenA (lpString="*.3gp") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.207] lstrlenA (lpString="*.mpeg") returned 6 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.207] lstrlenA (lpString="*.mpg") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.207] lstrlenA (lpString="*.flv") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.207] lstrlenA (lpString="*.avi") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.207] lstrlenA (lpString="*.mp4") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.207] lstrlenA (lpString="*.wmv") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.207] lstrlenA (lpString="*.divx") returned 6 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.207] lstrlenA (lpString="*.mkv") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.207] lstrlenA (lpString="*.mp3") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.207] lstrlenA (lpString="*.wav") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.207] lstrlenA (lpString="*.flac") returned 6 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.207] lstrlenA (lpString="*.ape") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.207] lstrlenA (lpString="*.wma") returned 5 [0063.208] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.208] lstrlenA (lpString="*.ac3") returned 5 [0063.208] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.208] lstrlenA (lpString="*.doc") returned 5 [0063.208] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.208] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.208] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.208] PathFindFileNameA (pszPath="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fi-FI\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\" [0063.208] PathAddBackslashA (in: pszPath="C:\\Boot\\fi-FI\\" | out: pszPath="C:\\Boot\\fi-FI\\") returned="" [0063.208] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" [0063.208] GetFileAttributesA (lpFileName="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fi-fi\\how to decrypt files.txt")) returned 0x20 [0063.208] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\memtest.exe.mui") returned="C:\\Boot\\fi-FI\\memtest.exe.mui" [0063.208] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.208] lstrlenA (lpString="*.zip") returned 5 [0063.208] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.208] lstrlenA (lpString="*.rar") returned 5 [0063.208] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.208] lstrlenA (lpString="*.7z") returned 4 [0063.208] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.208] lstrlenA (lpString="*.tar") returned 5 [0063.208] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.208] lstrlenA (lpString="*.gzip") returned 6 [0063.208] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.208] lstrlenA (lpString="*.jpg") returned 5 [0063.208] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.208] lstrlenA (lpString="*.jpeg") returned 6 [0063.208] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.208] lstrlenA (lpString="*.psd") returned 5 [0063.208] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.208] lstrlenA (lpString="*.cdr") returned 5 [0063.208] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.209] lstrlenA (lpString="*.dwg") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.209] lstrlenA (lpString="*.max") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.209] lstrlenA (lpString="*.bmp") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.209] lstrlenA (lpString="*.gif") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.209] lstrlenA (lpString="*.png") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.209] lstrlenA (lpString="*.doc") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.209] lstrlenA (lpString="*.docx") returned 6 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.209] lstrlenA (lpString="*.xls") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.209] lstrlenA (lpString="*.xlsx") returned 6 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.209] lstrlenA (lpString="*.ppt") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.209] lstrlenA (lpString="*.pptx") returned 6 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.209] lstrlenA (lpString="*.txt") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.209] lstrlenA (lpString="*.pdf") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.209] lstrlenA (lpString="*.djvu") returned 6 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.209] lstrlenA (lpString="*.htm") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.209] lstrlenA (lpString="*.html") returned 6 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.209] lstrlenA (lpString="*.mdb") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.209] lstrlenA (lpString="*.cer") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.209] lstrlenA (lpString="*.p12") returned 5 [0063.209] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.210] lstrlenA (lpString="*.pfx") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.210] lstrlenA (lpString="*.kwm") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.210] lstrlenA (lpString="*.pwm") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.210] lstrlenA (lpString="*.1cd") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.210] lstrlenA (lpString="*.md") returned 4 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.210] lstrlenA (lpString="*.mdf") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.210] lstrlenA (lpString="*.dbf") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.210] lstrlenA (lpString="*.odt") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.210] lstrlenA (lpString="*.vob") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.210] lstrlenA (lpString="*.ifo") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.210] lstrlenA (lpString="*.lnk") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.210] lstrlenA (lpString="*.torrent") returned 9 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.210] lstrlenA (lpString="*.mov") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.210] lstrlenA (lpString="*.m2v") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.210] lstrlenA (lpString="*.3gp") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.210] lstrlenA (lpString="*.mpeg") returned 6 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.210] lstrlenA (lpString="*.mpg") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.210] lstrlenA (lpString="*.flv") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.210] lstrlenA (lpString="*.avi") returned 5 [0063.210] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.211] lstrlenA (lpString="*.mp4") returned 5 [0063.211] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.211] lstrlenA (lpString="*.wmv") returned 5 [0063.211] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.211] lstrlenA (lpString="*.divx") returned 6 [0063.211] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.211] lstrlenA (lpString="*.mkv") returned 5 [0063.211] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.211] lstrlenA (lpString="*.mp3") returned 5 [0063.211] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.211] lstrlenA (lpString="*.wav") returned 5 [0063.211] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.211] lstrlenA (lpString="*.flac") returned 6 [0063.211] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.211] lstrlenA (lpString="*.ape") returned 5 [0063.211] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.211] lstrlenA (lpString="*.wma") returned 5 [0063.211] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.211] lstrlenA (lpString="*.ac3") returned 5 [0063.211] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.211] lstrlenA (lpString="*.doc") returned 5 [0063.211] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.211] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0063.211] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0063.211] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1 [0063.211] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1 [0063.211] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.211] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts" [0063.211] lstrlenA (lpString="C:\\Boot\\Fonts") returned 13 [0063.211] FindFirstFileA (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0063.215] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.215] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.215] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.215] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.215] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0063.215] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.215] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chs_boot.ttf") returned 1 [0063.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chs_boot.ttf") returned 1 [0063.215] lstrcmpiA (lpString1="", lpString2="chs_boot.ttf") returned -1 [0063.215] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\*.*") returned="*.*" [0063.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.215] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.215] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.216] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0xffffffff [0063.216] CreateFileA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.216] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.216] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.217] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.217] CloseHandle (hObject=0x208) returned 1 [0063.217] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf" [0063.217] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.zip") returned 0 [0063.217] lstrlenA (lpString="*.zip") returned 5 [0063.217] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.rar") returned 0 [0063.217] lstrlenA (lpString="*.rar") returned 5 [0063.217] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.7z") returned 0 [0063.217] lstrlenA (lpString="*.7z") returned 4 [0063.217] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.tar") returned 0 [0063.218] lstrlenA (lpString="*.tar") returned 5 [0063.218] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gzip") returned 0 [0063.218] lstrlenA (lpString="*.gzip") returned 6 [0063.218] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpg") returned 0 [0063.218] lstrlenA (lpString="*.jpg") returned 5 [0063.218] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.218] lstrlenA (lpString="*.jpeg") returned 6 [0063.218] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.psd") returned 0 [0063.218] lstrlenA (lpString="*.psd") returned 5 [0063.218] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cdr") returned 0 [0063.218] lstrlenA (lpString="*.cdr") returned 5 [0063.218] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dwg") returned 0 [0063.218] lstrlenA (lpString="*.dwg") returned 5 [0063.218] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.max") returned 0 [0063.218] lstrlenA (lpString="*.max") returned 5 [0063.218] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.bmp") returned 0 [0063.218] lstrlenA (lpString="*.bmp") returned 5 [0063.218] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gif") returned 0 [0063.218] lstrlenA (lpString="*.gif") returned 5 [0063.218] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.png") returned 0 [0063.218] lstrlenA (lpString="*.png") returned 5 [0063.218] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.doc") returned 0 [0063.218] lstrlenA (lpString="*.doc") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.docx") returned 0 [0063.219] lstrlenA (lpString="*.docx") returned 6 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xls") returned 0 [0063.219] lstrlenA (lpString="*.xls") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.219] lstrlenA (lpString="*.xlsx") returned 6 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ppt") returned 0 [0063.219] lstrlenA (lpString="*.ppt") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pptx") returned 0 [0063.219] lstrlenA (lpString="*.pptx") returned 6 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.txt") returned 0 [0063.219] lstrlenA (lpString="*.txt") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pdf") returned 0 [0063.219] lstrlenA (lpString="*.pdf") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.djvu") returned 0 [0063.219] lstrlenA (lpString="*.djvu") returned 6 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.htm") returned 0 [0063.219] lstrlenA (lpString="*.htm") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.html") returned 0 [0063.219] lstrlenA (lpString="*.html") returned 6 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mdb") returned 0 [0063.219] lstrlenA (lpString="*.mdb") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cer") returned 0 [0063.219] lstrlenA (lpString="*.cer") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.p12") returned 0 [0063.219] lstrlenA (lpString="*.p12") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pfx") returned 0 [0063.219] lstrlenA (lpString="*.pfx") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.kwm") returned 0 [0063.219] lstrlenA (lpString="*.kwm") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pwm") returned 0 [0063.219] lstrlenA (lpString="*.pwm") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.1cd") returned 0 [0063.219] lstrlenA (lpString="*.1cd") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.md") returned 0 [0063.219] lstrlenA (lpString="*.md") returned 4 [0063.219] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mdf") returned 0 [0063.220] lstrlenA (lpString="*.mdf") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dbf") returned 0 [0063.220] lstrlenA (lpString="*.dbf") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.odt") returned 0 [0063.220] lstrlenA (lpString="*.odt") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vob") returned 0 [0063.220] lstrlenA (lpString="*.vob") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ifo") returned 0 [0063.220] lstrlenA (lpString="*.ifo") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.lnk") returned 0 [0063.220] lstrlenA (lpString="*.lnk") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.torrent") returned 0 [0063.220] lstrlenA (lpString="*.torrent") returned 9 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mov") returned 0 [0063.220] lstrlenA (lpString="*.mov") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.m2v") returned 0 [0063.220] lstrlenA (lpString="*.m2v") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.3gp") returned 0 [0063.220] lstrlenA (lpString="*.3gp") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.220] lstrlenA (lpString="*.mpeg") returned 6 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpg") returned 0 [0063.220] lstrlenA (lpString="*.mpg") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flv") returned 0 [0063.220] lstrlenA (lpString="*.flv") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.avi") returned 0 [0063.220] lstrlenA (lpString="*.avi") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp4") returned 0 [0063.220] lstrlenA (lpString="*.mp4") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wmv") returned 0 [0063.220] lstrlenA (lpString="*.wmv") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.divx") returned 0 [0063.220] lstrlenA (lpString="*.divx") returned 6 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mkv") returned 0 [0063.220] lstrlenA (lpString="*.mkv") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp3") returned 0 [0063.221] lstrlenA (lpString="*.mp3") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wav") returned 0 [0063.221] lstrlenA (lpString="*.wav") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flac") returned 0 [0063.221] lstrlenA (lpString="*.flac") returned 6 [0063.221] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ape") returned 0 [0063.221] lstrlenA (lpString="*.ape") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wma") returned 0 [0063.221] lstrlenA (lpString="*.wma") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ac3") returned 0 [0063.221] lstrlenA (lpString="*.ac3") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.doc") returned 0 [0063.221] lstrlenA (lpString="*.doc") returned 5 [0063.221] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x1, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0063.221] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.221] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cht_boot.ttf") returned 1 [0063.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cht_boot.ttf") returned 1 [0063.221] lstrcmpiA (lpString1="", lpString2="cht_boot.ttf") returned -1 [0063.221] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\chs_boot.ttf") returned="chs_boot.ttf" [0063.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.221] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.221] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.221] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.221] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf" [0063.221] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.zip") returned 0 [0063.221] lstrlenA (lpString="*.zip") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.rar") returned 0 [0063.221] lstrlenA (lpString="*.rar") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.7z") returned 0 [0063.221] lstrlenA (lpString="*.7z") returned 4 [0063.221] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.tar") returned 0 [0063.221] lstrlenA (lpString="*.tar") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gzip") returned 0 [0063.222] lstrlenA (lpString="*.gzip") returned 6 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpg") returned 0 [0063.222] lstrlenA (lpString="*.jpg") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.222] lstrlenA (lpString="*.jpeg") returned 6 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.psd") returned 0 [0063.222] lstrlenA (lpString="*.psd") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cdr") returned 0 [0063.222] lstrlenA (lpString="*.cdr") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dwg") returned 0 [0063.222] lstrlenA (lpString="*.dwg") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.max") returned 0 [0063.222] lstrlenA (lpString="*.max") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.bmp") returned 0 [0063.222] lstrlenA (lpString="*.bmp") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gif") returned 0 [0063.222] lstrlenA (lpString="*.gif") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.png") returned 0 [0063.222] lstrlenA (lpString="*.png") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.doc") returned 0 [0063.222] lstrlenA (lpString="*.doc") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.docx") returned 0 [0063.222] lstrlenA (lpString="*.docx") returned 6 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xls") returned 0 [0063.222] lstrlenA (lpString="*.xls") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.222] lstrlenA (lpString="*.xlsx") returned 6 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ppt") returned 0 [0063.222] lstrlenA (lpString="*.ppt") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pptx") returned 0 [0063.222] lstrlenA (lpString="*.pptx") returned 6 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.txt") returned 0 [0063.222] lstrlenA (lpString="*.txt") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pdf") returned 0 [0063.222] lstrlenA (lpString="*.pdf") returned 5 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.djvu") returned 0 [0063.222] lstrlenA (lpString="*.djvu") returned 6 [0063.222] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.htm") returned 0 [0063.223] lstrlenA (lpString="*.htm") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.html") returned 0 [0063.223] lstrlenA (lpString="*.html") returned 6 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mdb") returned 0 [0063.223] lstrlenA (lpString="*.mdb") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cer") returned 0 [0063.223] lstrlenA (lpString="*.cer") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.p12") returned 0 [0063.223] lstrlenA (lpString="*.p12") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pfx") returned 0 [0063.223] lstrlenA (lpString="*.pfx") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.kwm") returned 0 [0063.223] lstrlenA (lpString="*.kwm") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pwm") returned 0 [0063.223] lstrlenA (lpString="*.pwm") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.1cd") returned 0 [0063.223] lstrlenA (lpString="*.1cd") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.md") returned 0 [0063.223] lstrlenA (lpString="*.md") returned 4 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mdf") returned 0 [0063.223] lstrlenA (lpString="*.mdf") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dbf") returned 0 [0063.223] lstrlenA (lpString="*.dbf") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.odt") returned 0 [0063.223] lstrlenA (lpString="*.odt") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vob") returned 0 [0063.223] lstrlenA (lpString="*.vob") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ifo") returned 0 [0063.223] lstrlenA (lpString="*.ifo") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.lnk") returned 0 [0063.223] lstrlenA (lpString="*.lnk") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.torrent") returned 0 [0063.223] lstrlenA (lpString="*.torrent") returned 9 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mov") returned 0 [0063.223] lstrlenA (lpString="*.mov") returned 5 [0063.223] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.m2v") returned 0 [0063.223] lstrlenA (lpString="*.m2v") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.3gp") returned 0 [0063.224] lstrlenA (lpString="*.3gp") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.224] lstrlenA (lpString="*.mpeg") returned 6 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpg") returned 0 [0063.224] lstrlenA (lpString="*.mpg") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flv") returned 0 [0063.224] lstrlenA (lpString="*.flv") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.avi") returned 0 [0063.224] lstrlenA (lpString="*.avi") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp4") returned 0 [0063.224] lstrlenA (lpString="*.mp4") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wmv") returned 0 [0063.224] lstrlenA (lpString="*.wmv") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.divx") returned 0 [0063.224] lstrlenA (lpString="*.divx") returned 6 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mkv") returned 0 [0063.224] lstrlenA (lpString="*.mkv") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp3") returned 0 [0063.224] lstrlenA (lpString="*.mp3") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wav") returned 0 [0063.224] lstrlenA (lpString="*.wav") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flac") returned 0 [0063.224] lstrlenA (lpString="*.flac") returned 6 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ape") returned 0 [0063.224] lstrlenA (lpString="*.ape") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wma") returned 0 [0063.224] lstrlenA (lpString="*.wma") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ac3") returned 0 [0063.224] lstrlenA (lpString="*.ac3") returned 5 [0063.224] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.doc") returned 0 [0063.224] lstrlenA (lpString="*.doc") returned 5 [0063.224] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0063.224] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.224] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jpn_boot.ttf") returned -1 [0063.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jpn_boot.ttf") returned -1 [0063.224] lstrcmpiA (lpString1="", lpString2="jpn_boot.ttf") returned -1 [0063.224] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\cht_boot.ttf") returned="cht_boot.ttf" [0063.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.225] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.225] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.225] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.225] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf" [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.zip") returned 0 [0063.225] lstrlenA (lpString="*.zip") returned 5 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.rar") returned 0 [0063.225] lstrlenA (lpString="*.rar") returned 5 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.7z") returned 0 [0063.225] lstrlenA (lpString="*.7z") returned 4 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.tar") returned 0 [0063.225] lstrlenA (lpString="*.tar") returned 5 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gzip") returned 0 [0063.225] lstrlenA (lpString="*.gzip") returned 6 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpg") returned 0 [0063.225] lstrlenA (lpString="*.jpg") returned 5 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.225] lstrlenA (lpString="*.jpeg") returned 6 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.psd") returned 0 [0063.225] lstrlenA (lpString="*.psd") returned 5 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cdr") returned 0 [0063.225] lstrlenA (lpString="*.cdr") returned 5 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dwg") returned 0 [0063.225] lstrlenA (lpString="*.dwg") returned 5 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.max") returned 0 [0063.225] lstrlenA (lpString="*.max") returned 5 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.bmp") returned 0 [0063.225] lstrlenA (lpString="*.bmp") returned 5 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gif") returned 0 [0063.225] lstrlenA (lpString="*.gif") returned 5 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.png") returned 0 [0063.225] lstrlenA (lpString="*.png") returned 5 [0063.225] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.doc") returned 0 [0063.226] lstrlenA (lpString="*.doc") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.docx") returned 0 [0063.226] lstrlenA (lpString="*.docx") returned 6 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xls") returned 0 [0063.226] lstrlenA (lpString="*.xls") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.226] lstrlenA (lpString="*.xlsx") returned 6 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ppt") returned 0 [0063.226] lstrlenA (lpString="*.ppt") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pptx") returned 0 [0063.226] lstrlenA (lpString="*.pptx") returned 6 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.txt") returned 0 [0063.226] lstrlenA (lpString="*.txt") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pdf") returned 0 [0063.226] lstrlenA (lpString="*.pdf") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.djvu") returned 0 [0063.226] lstrlenA (lpString="*.djvu") returned 6 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.htm") returned 0 [0063.226] lstrlenA (lpString="*.htm") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.html") returned 0 [0063.226] lstrlenA (lpString="*.html") returned 6 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mdb") returned 0 [0063.226] lstrlenA (lpString="*.mdb") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cer") returned 0 [0063.226] lstrlenA (lpString="*.cer") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.p12") returned 0 [0063.226] lstrlenA (lpString="*.p12") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pfx") returned 0 [0063.226] lstrlenA (lpString="*.pfx") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.kwm") returned 0 [0063.226] lstrlenA (lpString="*.kwm") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pwm") returned 0 [0063.226] lstrlenA (lpString="*.pwm") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.1cd") returned 0 [0063.226] lstrlenA (lpString="*.1cd") returned 5 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.md") returned 0 [0063.226] lstrlenA (lpString="*.md") returned 4 [0063.226] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mdf") returned 0 [0063.227] lstrlenA (lpString="*.mdf") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dbf") returned 0 [0063.227] lstrlenA (lpString="*.dbf") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.odt") returned 0 [0063.227] lstrlenA (lpString="*.odt") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vob") returned 0 [0063.227] lstrlenA (lpString="*.vob") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ifo") returned 0 [0063.227] lstrlenA (lpString="*.ifo") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.lnk") returned 0 [0063.227] lstrlenA (lpString="*.lnk") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.torrent") returned 0 [0063.227] lstrlenA (lpString="*.torrent") returned 9 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mov") returned 0 [0063.227] lstrlenA (lpString="*.mov") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.m2v") returned 0 [0063.227] lstrlenA (lpString="*.m2v") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.3gp") returned 0 [0063.227] lstrlenA (lpString="*.3gp") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.227] lstrlenA (lpString="*.mpeg") returned 6 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpg") returned 0 [0063.227] lstrlenA (lpString="*.mpg") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flv") returned 0 [0063.227] lstrlenA (lpString="*.flv") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.avi") returned 0 [0063.227] lstrlenA (lpString="*.avi") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp4") returned 0 [0063.227] lstrlenA (lpString="*.mp4") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wmv") returned 0 [0063.227] lstrlenA (lpString="*.wmv") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.divx") returned 0 [0063.227] lstrlenA (lpString="*.divx") returned 6 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mkv") returned 0 [0063.227] lstrlenA (lpString="*.mkv") returned 5 [0063.227] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp3") returned 0 [0063.227] lstrlenA (lpString="*.mp3") returned 5 [0063.228] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wav") returned 0 [0063.228] lstrlenA (lpString="*.wav") returned 5 [0063.228] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flac") returned 0 [0063.228] lstrlenA (lpString="*.flac") returned 6 [0063.228] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ape") returned 0 [0063.228] lstrlenA (lpString="*.ape") returned 5 [0063.228] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wma") returned 0 [0063.228] lstrlenA (lpString="*.wma") returned 5 [0063.228] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ac3") returned 0 [0063.228] lstrlenA (lpString="*.ac3") returned 5 [0063.228] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.doc") returned 0 [0063.228] lstrlenA (lpString="*.doc") returned 5 [0063.228] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0063.228] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.228] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="kor_boot.ttf") returned -1 [0063.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor_boot.ttf") returned -1 [0063.228] lstrcmpiA (lpString1="", lpString2="kor_boot.ttf") returned -1 [0063.228] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="jpn_boot.ttf" [0063.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.228] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.228] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.228] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.228] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf" [0063.228] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.zip") returned 0 [0063.228] lstrlenA (lpString="*.zip") returned 5 [0063.228] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.rar") returned 0 [0063.228] lstrlenA (lpString="*.rar") returned 5 [0063.228] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.7z") returned 0 [0063.228] lstrlenA (lpString="*.7z") returned 4 [0063.228] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.tar") returned 0 [0063.228] lstrlenA (lpString="*.tar") returned 5 [0063.228] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gzip") returned 0 [0063.228] lstrlenA (lpString="*.gzip") returned 6 [0063.228] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpg") returned 0 [0063.228] lstrlenA (lpString="*.jpg") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.229] lstrlenA (lpString="*.jpeg") returned 6 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.psd") returned 0 [0063.229] lstrlenA (lpString="*.psd") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cdr") returned 0 [0063.229] lstrlenA (lpString="*.cdr") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dwg") returned 0 [0063.229] lstrlenA (lpString="*.dwg") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.max") returned 0 [0063.229] lstrlenA (lpString="*.max") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.bmp") returned 0 [0063.229] lstrlenA (lpString="*.bmp") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gif") returned 0 [0063.229] lstrlenA (lpString="*.gif") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.png") returned 0 [0063.229] lstrlenA (lpString="*.png") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.doc") returned 0 [0063.229] lstrlenA (lpString="*.doc") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.docx") returned 0 [0063.229] lstrlenA (lpString="*.docx") returned 6 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xls") returned 0 [0063.229] lstrlenA (lpString="*.xls") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.229] lstrlenA (lpString="*.xlsx") returned 6 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ppt") returned 0 [0063.229] lstrlenA (lpString="*.ppt") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pptx") returned 0 [0063.229] lstrlenA (lpString="*.pptx") returned 6 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.txt") returned 0 [0063.229] lstrlenA (lpString="*.txt") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pdf") returned 0 [0063.229] lstrlenA (lpString="*.pdf") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.djvu") returned 0 [0063.229] lstrlenA (lpString="*.djvu") returned 6 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.htm") returned 0 [0063.229] lstrlenA (lpString="*.htm") returned 5 [0063.229] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.html") returned 0 [0063.230] lstrlenA (lpString="*.html") returned 6 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mdb") returned 0 [0063.230] lstrlenA (lpString="*.mdb") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cer") returned 0 [0063.230] lstrlenA (lpString="*.cer") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.p12") returned 0 [0063.230] lstrlenA (lpString="*.p12") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pfx") returned 0 [0063.230] lstrlenA (lpString="*.pfx") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.kwm") returned 0 [0063.230] lstrlenA (lpString="*.kwm") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pwm") returned 0 [0063.230] lstrlenA (lpString="*.pwm") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.1cd") returned 0 [0063.230] lstrlenA (lpString="*.1cd") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.md") returned 0 [0063.230] lstrlenA (lpString="*.md") returned 4 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mdf") returned 0 [0063.230] lstrlenA (lpString="*.mdf") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dbf") returned 0 [0063.230] lstrlenA (lpString="*.dbf") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.odt") returned 0 [0063.230] lstrlenA (lpString="*.odt") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vob") returned 0 [0063.230] lstrlenA (lpString="*.vob") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ifo") returned 0 [0063.230] lstrlenA (lpString="*.ifo") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.lnk") returned 0 [0063.230] lstrlenA (lpString="*.lnk") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.torrent") returned 0 [0063.230] lstrlenA (lpString="*.torrent") returned 9 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mov") returned 0 [0063.230] lstrlenA (lpString="*.mov") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.m2v") returned 0 [0063.230] lstrlenA (lpString="*.m2v") returned 5 [0063.230] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.3gp") returned 0 [0063.230] lstrlenA (lpString="*.3gp") returned 5 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.231] lstrlenA (lpString="*.mpeg") returned 6 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpg") returned 0 [0063.231] lstrlenA (lpString="*.mpg") returned 5 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flv") returned 0 [0063.231] lstrlenA (lpString="*.flv") returned 5 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.avi") returned 0 [0063.231] lstrlenA (lpString="*.avi") returned 5 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp4") returned 0 [0063.231] lstrlenA (lpString="*.mp4") returned 5 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wmv") returned 0 [0063.231] lstrlenA (lpString="*.wmv") returned 5 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.divx") returned 0 [0063.231] lstrlenA (lpString="*.divx") returned 6 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mkv") returned 0 [0063.231] lstrlenA (lpString="*.mkv") returned 5 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp3") returned 0 [0063.231] lstrlenA (lpString="*.mp3") returned 5 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wav") returned 0 [0063.231] lstrlenA (lpString="*.wav") returned 5 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flac") returned 0 [0063.231] lstrlenA (lpString="*.flac") returned 6 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ape") returned 0 [0063.231] lstrlenA (lpString="*.ape") returned 5 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wma") returned 0 [0063.231] lstrlenA (lpString="*.wma") returned 5 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ac3") returned 0 [0063.231] lstrlenA (lpString="*.ac3") returned 5 [0063.231] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.doc") returned 0 [0063.231] lstrlenA (lpString="*.doc") returned 5 [0063.231] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0063.231] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.231] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="malgunn_boot.ttf") returned -1 [0063.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="malgunn_boot.ttf") returned -1 [0063.231] lstrcmpiA (lpString1="", lpString2="malgunn_boot.ttf") returned -1 [0063.231] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\kor_boot.ttf") returned="kor_boot.ttf" [0063.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.232] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.232] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.232] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.232] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgunn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned="C:\\Boot\\Fonts\\malgunn_boot.ttf" [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.zip") returned 0 [0063.232] lstrlenA (lpString="*.zip") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.rar") returned 0 [0063.232] lstrlenA (lpString="*.rar") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.7z") returned 0 [0063.232] lstrlenA (lpString="*.7z") returned 4 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.tar") returned 0 [0063.232] lstrlenA (lpString="*.tar") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.gzip") returned 0 [0063.232] lstrlenA (lpString="*.gzip") returned 6 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.jpg") returned 0 [0063.232] lstrlenA (lpString="*.jpg") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.232] lstrlenA (lpString="*.jpeg") returned 6 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.psd") returned 0 [0063.232] lstrlenA (lpString="*.psd") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.cdr") returned 0 [0063.232] lstrlenA (lpString="*.cdr") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.dwg") returned 0 [0063.232] lstrlenA (lpString="*.dwg") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.max") returned 0 [0063.232] lstrlenA (lpString="*.max") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.bmp") returned 0 [0063.232] lstrlenA (lpString="*.bmp") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.gif") returned 0 [0063.232] lstrlenA (lpString="*.gif") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.png") returned 0 [0063.232] lstrlenA (lpString="*.png") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.doc") returned 0 [0063.232] lstrlenA (lpString="*.doc") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.docx") returned 0 [0063.233] lstrlenA (lpString="*.docx") returned 6 [0063.233] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.xls") returned 0 [0063.233] lstrlenA (lpString="*.xls") returned 5 [0063.233] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.233] lstrlenA (lpString="*.xlsx") returned 6 [0063.233] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.ppt") returned 0 [0063.233] lstrlenA (lpString="*.ppt") returned 5 [0063.233] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.pptx") returned 0 [0063.233] lstrlenA (lpString="*.pptx") returned 6 [0063.233] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.txt") returned 0 [0063.233] lstrlenA (lpString="*.txt") returned 5 [0063.233] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.pdf") returned 0 [0063.233] lstrlenA (lpString="*.pdf") returned 5 [0063.233] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.djvu") returned 0 [0063.233] lstrlenA (lpString="*.djvu") returned 6 [0063.233] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.htm") returned 0 [0063.233] lstrlenA (lpString="*.htm") returned 5 [0063.241] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.html") returned 0 [0063.241] lstrlenA (lpString="*.html") returned 6 [0063.241] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mdb") returned 0 [0063.241] lstrlenA (lpString="*.mdb") returned 5 [0063.241] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.cer") returned 0 [0063.241] lstrlenA (lpString="*.cer") returned 5 [0063.241] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.p12") returned 0 [0063.241] lstrlenA (lpString="*.p12") returned 5 [0063.241] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.pfx") returned 0 [0063.241] lstrlenA (lpString="*.pfx") returned 5 [0063.241] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.kwm") returned 0 [0063.241] lstrlenA (lpString="*.kwm") returned 5 [0063.241] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.pwm") returned 0 [0063.241] lstrlenA (lpString="*.pwm") returned 5 [0063.241] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.1cd") returned 0 [0063.241] lstrlenA (lpString="*.1cd") returned 5 [0063.241] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.md") returned 0 [0063.241] lstrlenA (lpString="*.md") returned 4 [0063.241] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mdf") returned 0 [0063.241] lstrlenA (lpString="*.mdf") returned 5 [0063.241] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.dbf") returned 0 [0063.241] lstrlenA (lpString="*.dbf") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.odt") returned 0 [0063.242] lstrlenA (lpString="*.odt") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.vob") returned 0 [0063.242] lstrlenA (lpString="*.vob") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.ifo") returned 0 [0063.242] lstrlenA (lpString="*.ifo") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.lnk") returned 0 [0063.242] lstrlenA (lpString="*.lnk") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.torrent") returned 0 [0063.242] lstrlenA (lpString="*.torrent") returned 9 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mov") returned 0 [0063.242] lstrlenA (lpString="*.mov") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.m2v") returned 0 [0063.242] lstrlenA (lpString="*.m2v") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.3gp") returned 0 [0063.242] lstrlenA (lpString="*.3gp") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.242] lstrlenA (lpString="*.mpeg") returned 6 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mpg") returned 0 [0063.242] lstrlenA (lpString="*.mpg") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.flv") returned 0 [0063.242] lstrlenA (lpString="*.flv") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.avi") returned 0 [0063.242] lstrlenA (lpString="*.avi") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mp4") returned 0 [0063.242] lstrlenA (lpString="*.mp4") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.wmv") returned 0 [0063.242] lstrlenA (lpString="*.wmv") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.divx") returned 0 [0063.242] lstrlenA (lpString="*.divx") returned 6 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mkv") returned 0 [0063.242] lstrlenA (lpString="*.mkv") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.mp3") returned 0 [0063.242] lstrlenA (lpString="*.mp3") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.wav") returned 0 [0063.242] lstrlenA (lpString="*.wav") returned 5 [0063.242] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.flac") returned 0 [0063.243] lstrlenA (lpString="*.flac") returned 6 [0063.243] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.ape") returned 0 [0063.243] lstrlenA (lpString="*.ape") returned 5 [0063.243] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.wma") returned 0 [0063.243] lstrlenA (lpString="*.wma") returned 5 [0063.243] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.ac3") returned 0 [0063.243] lstrlenA (lpString="*.ac3") returned 5 [0063.243] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgunn_boot.ttf", pszSpec="*.doc") returned 0 [0063.243] lstrlenA (lpString="*.doc") returned 5 [0063.243] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0063.243] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.243] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="malgun_boot.ttf") returned -1 [0063.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="malgun_boot.ttf") returned -1 [0063.243] lstrcmpiA (lpString1="", lpString2="malgun_boot.ttf") returned -1 [0063.243] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned="malgunn_boot.ttf" [0063.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.243] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.243] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.243] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.243] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgun_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgun_boot.ttf") returned="C:\\Boot\\Fonts\\malgun_boot.ttf" [0063.243] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.zip") returned 0 [0063.243] lstrlenA (lpString="*.zip") returned 5 [0063.243] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.rar") returned 0 [0063.243] lstrlenA (lpString="*.rar") returned 5 [0063.243] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.7z") returned 0 [0063.243] lstrlenA (lpString="*.7z") returned 4 [0063.243] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.tar") returned 0 [0063.243] lstrlenA (lpString="*.tar") returned 5 [0063.243] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.gzip") returned 0 [0063.243] lstrlenA (lpString="*.gzip") returned 6 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.jpg") returned 0 [0063.244] lstrlenA (lpString="*.jpg") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.244] lstrlenA (lpString="*.jpeg") returned 6 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.psd") returned 0 [0063.244] lstrlenA (lpString="*.psd") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.cdr") returned 0 [0063.244] lstrlenA (lpString="*.cdr") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.dwg") returned 0 [0063.244] lstrlenA (lpString="*.dwg") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.max") returned 0 [0063.244] lstrlenA (lpString="*.max") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.bmp") returned 0 [0063.244] lstrlenA (lpString="*.bmp") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.gif") returned 0 [0063.244] lstrlenA (lpString="*.gif") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.png") returned 0 [0063.244] lstrlenA (lpString="*.png") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.doc") returned 0 [0063.244] lstrlenA (lpString="*.doc") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.docx") returned 0 [0063.244] lstrlenA (lpString="*.docx") returned 6 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.xls") returned 0 [0063.244] lstrlenA (lpString="*.xls") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.244] lstrlenA (lpString="*.xlsx") returned 6 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.ppt") returned 0 [0063.244] lstrlenA (lpString="*.ppt") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.pptx") returned 0 [0063.244] lstrlenA (lpString="*.pptx") returned 6 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.txt") returned 0 [0063.244] lstrlenA (lpString="*.txt") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.pdf") returned 0 [0063.244] lstrlenA (lpString="*.pdf") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.djvu") returned 0 [0063.244] lstrlenA (lpString="*.djvu") returned 6 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.htm") returned 0 [0063.245] lstrlenA (lpString="*.htm") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.html") returned 0 [0063.245] lstrlenA (lpString="*.html") returned 6 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mdb") returned 0 [0063.245] lstrlenA (lpString="*.mdb") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.cer") returned 0 [0063.245] lstrlenA (lpString="*.cer") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.p12") returned 0 [0063.245] lstrlenA (lpString="*.p12") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.pfx") returned 0 [0063.245] lstrlenA (lpString="*.pfx") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.kwm") returned 0 [0063.245] lstrlenA (lpString="*.kwm") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.pwm") returned 0 [0063.245] lstrlenA (lpString="*.pwm") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.1cd") returned 0 [0063.245] lstrlenA (lpString="*.1cd") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.md") returned 0 [0063.245] lstrlenA (lpString="*.md") returned 4 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mdf") returned 0 [0063.245] lstrlenA (lpString="*.mdf") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.dbf") returned 0 [0063.245] lstrlenA (lpString="*.dbf") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.odt") returned 0 [0063.245] lstrlenA (lpString="*.odt") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.vob") returned 0 [0063.245] lstrlenA (lpString="*.vob") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.ifo") returned 0 [0063.245] lstrlenA (lpString="*.ifo") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.lnk") returned 0 [0063.245] lstrlenA (lpString="*.lnk") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.torrent") returned 0 [0063.245] lstrlenA (lpString="*.torrent") returned 9 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mov") returned 0 [0063.245] lstrlenA (lpString="*.mov") returned 5 [0063.245] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.m2v") returned 0 [0063.246] lstrlenA (lpString="*.m2v") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.3gp") returned 0 [0063.246] lstrlenA (lpString="*.3gp") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.246] lstrlenA (lpString="*.mpeg") returned 6 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mpg") returned 0 [0063.246] lstrlenA (lpString="*.mpg") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.flv") returned 0 [0063.246] lstrlenA (lpString="*.flv") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.avi") returned 0 [0063.246] lstrlenA (lpString="*.avi") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mp4") returned 0 [0063.246] lstrlenA (lpString="*.mp4") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.wmv") returned 0 [0063.246] lstrlenA (lpString="*.wmv") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.divx") returned 0 [0063.246] lstrlenA (lpString="*.divx") returned 6 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mkv") returned 0 [0063.246] lstrlenA (lpString="*.mkv") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.mp3") returned 0 [0063.246] lstrlenA (lpString="*.mp3") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.wav") returned 0 [0063.246] lstrlenA (lpString="*.wav") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.flac") returned 0 [0063.246] lstrlenA (lpString="*.flac") returned 6 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.ape") returned 0 [0063.246] lstrlenA (lpString="*.ape") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.wma") returned 0 [0063.246] lstrlenA (lpString="*.wma") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.ac3") returned 0 [0063.246] lstrlenA (lpString="*.ac3") returned 5 [0063.246] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\malgun_boot.ttf", pszSpec="*.doc") returned 0 [0063.246] lstrlenA (lpString="*.doc") returned 5 [0063.246] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0063.246] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.246] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="meiryon_boot.ttf") returned -1 [0063.246] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="meiryon_boot.ttf") returned -1 [0063.247] lstrcmpiA (lpString1="", lpString2="meiryon_boot.ttf") returned -1 [0063.247] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\malgun_boot.ttf") returned="malgun_boot.ttf" [0063.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.247] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.247] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.247] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.247] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryon_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned="C:\\Boot\\Fonts\\meiryon_boot.ttf" [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.zip") returned 0 [0063.247] lstrlenA (lpString="*.zip") returned 5 [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.rar") returned 0 [0063.247] lstrlenA (lpString="*.rar") returned 5 [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.7z") returned 0 [0063.247] lstrlenA (lpString="*.7z") returned 4 [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.tar") returned 0 [0063.247] lstrlenA (lpString="*.tar") returned 5 [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.gzip") returned 0 [0063.247] lstrlenA (lpString="*.gzip") returned 6 [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.jpg") returned 0 [0063.247] lstrlenA (lpString="*.jpg") returned 5 [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.247] lstrlenA (lpString="*.jpeg") returned 6 [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.psd") returned 0 [0063.247] lstrlenA (lpString="*.psd") returned 5 [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.cdr") returned 0 [0063.247] lstrlenA (lpString="*.cdr") returned 5 [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.dwg") returned 0 [0063.247] lstrlenA (lpString="*.dwg") returned 5 [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.max") returned 0 [0063.247] lstrlenA (lpString="*.max") returned 5 [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.bmp") returned 0 [0063.247] lstrlenA (lpString="*.bmp") returned 5 [0063.247] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.gif") returned 0 [0063.247] lstrlenA (lpString="*.gif") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.png") returned 0 [0063.248] lstrlenA (lpString="*.png") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.doc") returned 0 [0063.248] lstrlenA (lpString="*.doc") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.docx") returned 0 [0063.248] lstrlenA (lpString="*.docx") returned 6 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.xls") returned 0 [0063.248] lstrlenA (lpString="*.xls") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.248] lstrlenA (lpString="*.xlsx") returned 6 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.ppt") returned 0 [0063.248] lstrlenA (lpString="*.ppt") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.pptx") returned 0 [0063.248] lstrlenA (lpString="*.pptx") returned 6 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.txt") returned 0 [0063.248] lstrlenA (lpString="*.txt") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.pdf") returned 0 [0063.248] lstrlenA (lpString="*.pdf") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.djvu") returned 0 [0063.248] lstrlenA (lpString="*.djvu") returned 6 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.htm") returned 0 [0063.248] lstrlenA (lpString="*.htm") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.html") returned 0 [0063.248] lstrlenA (lpString="*.html") returned 6 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mdb") returned 0 [0063.248] lstrlenA (lpString="*.mdb") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.cer") returned 0 [0063.248] lstrlenA (lpString="*.cer") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.p12") returned 0 [0063.248] lstrlenA (lpString="*.p12") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.pfx") returned 0 [0063.248] lstrlenA (lpString="*.pfx") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.kwm") returned 0 [0063.248] lstrlenA (lpString="*.kwm") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.pwm") returned 0 [0063.248] lstrlenA (lpString="*.pwm") returned 5 [0063.248] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.1cd") returned 0 [0063.249] lstrlenA (lpString="*.1cd") returned 5 [0063.249] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.md") returned 0 [0063.249] lstrlenA (lpString="*.md") returned 4 [0063.249] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mdf") returned 0 [0063.249] lstrlenA (lpString="*.mdf") returned 5 [0063.249] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.dbf") returned 0 [0063.249] lstrlenA (lpString="*.dbf") returned 5 [0063.249] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.odt") returned 0 [0063.249] lstrlenA (lpString="*.odt") returned 5 [0063.249] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.vob") returned 0 [0063.249] lstrlenA (lpString="*.vob") returned 5 [0063.249] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.ifo") returned 0 [0063.249] lstrlenA (lpString="*.ifo") returned 5 [0063.249] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.lnk") returned 0 [0063.249] lstrlenA (lpString="*.lnk") returned 5 [0063.249] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.torrent") returned 0 [0063.249] lstrlenA (lpString="*.torrent") returned 9 [0063.249] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mov") returned 0 [0063.249] lstrlenA (lpString="*.mov") returned 5 [0063.249] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.m2v") returned 0 [0063.249] lstrlenA (lpString="*.m2v") returned 5 [0063.249] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.3gp") returned 0 [0063.249] lstrlenA (lpString="*.3gp") returned 5 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.250] lstrlenA (lpString="*.mpeg") returned 6 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mpg") returned 0 [0063.250] lstrlenA (lpString="*.mpg") returned 5 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.flv") returned 0 [0063.250] lstrlenA (lpString="*.flv") returned 5 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.avi") returned 0 [0063.250] lstrlenA (lpString="*.avi") returned 5 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mp4") returned 0 [0063.250] lstrlenA (lpString="*.mp4") returned 5 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.wmv") returned 0 [0063.250] lstrlenA (lpString="*.wmv") returned 5 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.divx") returned 0 [0063.250] lstrlenA (lpString="*.divx") returned 6 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mkv") returned 0 [0063.250] lstrlenA (lpString="*.mkv") returned 5 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.mp3") returned 0 [0063.250] lstrlenA (lpString="*.mp3") returned 5 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.wav") returned 0 [0063.250] lstrlenA (lpString="*.wav") returned 5 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.flac") returned 0 [0063.250] lstrlenA (lpString="*.flac") returned 6 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.ape") returned 0 [0063.250] lstrlenA (lpString="*.ape") returned 5 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.wma") returned 0 [0063.250] lstrlenA (lpString="*.wma") returned 5 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.ac3") returned 0 [0063.250] lstrlenA (lpString="*.ac3") returned 5 [0063.250] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryon_boot.ttf", pszSpec="*.doc") returned 0 [0063.250] lstrlenA (lpString="*.doc") returned 5 [0063.250] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0063.250] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.250] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="meiryo_boot.ttf") returned -1 [0063.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="meiryo_boot.ttf") returned -1 [0063.250] lstrcmpiA (lpString1="", lpString2="meiryo_boot.ttf") returned -1 [0063.250] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned="meiryon_boot.ttf" [0063.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.251] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.251] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.251] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.251] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryo_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned="C:\\Boot\\Fonts\\meiryo_boot.ttf" [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.zip") returned 0 [0063.251] lstrlenA (lpString="*.zip") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.rar") returned 0 [0063.251] lstrlenA (lpString="*.rar") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.7z") returned 0 [0063.251] lstrlenA (lpString="*.7z") returned 4 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.tar") returned 0 [0063.251] lstrlenA (lpString="*.tar") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.gzip") returned 0 [0063.251] lstrlenA (lpString="*.gzip") returned 6 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.jpg") returned 0 [0063.251] lstrlenA (lpString="*.jpg") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.251] lstrlenA (lpString="*.jpeg") returned 6 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.psd") returned 0 [0063.251] lstrlenA (lpString="*.psd") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.cdr") returned 0 [0063.251] lstrlenA (lpString="*.cdr") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.dwg") returned 0 [0063.251] lstrlenA (lpString="*.dwg") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.max") returned 0 [0063.251] lstrlenA (lpString="*.max") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.bmp") returned 0 [0063.251] lstrlenA (lpString="*.bmp") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.gif") returned 0 [0063.251] lstrlenA (lpString="*.gif") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.png") returned 0 [0063.251] lstrlenA (lpString="*.png") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.doc") returned 0 [0063.252] lstrlenA (lpString="*.doc") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.docx") returned 0 [0063.252] lstrlenA (lpString="*.docx") returned 6 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.xls") returned 0 [0063.252] lstrlenA (lpString="*.xls") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.252] lstrlenA (lpString="*.xlsx") returned 6 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.ppt") returned 0 [0063.252] lstrlenA (lpString="*.ppt") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.pptx") returned 0 [0063.252] lstrlenA (lpString="*.pptx") returned 6 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.txt") returned 0 [0063.252] lstrlenA (lpString="*.txt") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.pdf") returned 0 [0063.252] lstrlenA (lpString="*.pdf") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.djvu") returned 0 [0063.252] lstrlenA (lpString="*.djvu") returned 6 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.htm") returned 0 [0063.252] lstrlenA (lpString="*.htm") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.html") returned 0 [0063.252] lstrlenA (lpString="*.html") returned 6 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mdb") returned 0 [0063.252] lstrlenA (lpString="*.mdb") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.cer") returned 0 [0063.252] lstrlenA (lpString="*.cer") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.p12") returned 0 [0063.252] lstrlenA (lpString="*.p12") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.pfx") returned 0 [0063.252] lstrlenA (lpString="*.pfx") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.kwm") returned 0 [0063.252] lstrlenA (lpString="*.kwm") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.pwm") returned 0 [0063.252] lstrlenA (lpString="*.pwm") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.1cd") returned 0 [0063.252] lstrlenA (lpString="*.1cd") returned 5 [0063.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.md") returned 0 [0063.252] lstrlenA (lpString="*.md") returned 4 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mdf") returned 0 [0063.253] lstrlenA (lpString="*.mdf") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.dbf") returned 0 [0063.253] lstrlenA (lpString="*.dbf") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.odt") returned 0 [0063.253] lstrlenA (lpString="*.odt") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.vob") returned 0 [0063.253] lstrlenA (lpString="*.vob") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.ifo") returned 0 [0063.253] lstrlenA (lpString="*.ifo") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.lnk") returned 0 [0063.253] lstrlenA (lpString="*.lnk") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.torrent") returned 0 [0063.253] lstrlenA (lpString="*.torrent") returned 9 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mov") returned 0 [0063.253] lstrlenA (lpString="*.mov") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.m2v") returned 0 [0063.253] lstrlenA (lpString="*.m2v") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.3gp") returned 0 [0063.253] lstrlenA (lpString="*.3gp") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.253] lstrlenA (lpString="*.mpeg") returned 6 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mpg") returned 0 [0063.253] lstrlenA (lpString="*.mpg") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.flv") returned 0 [0063.253] lstrlenA (lpString="*.flv") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.avi") returned 0 [0063.253] lstrlenA (lpString="*.avi") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mp4") returned 0 [0063.253] lstrlenA (lpString="*.mp4") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.wmv") returned 0 [0063.253] lstrlenA (lpString="*.wmv") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.divx") returned 0 [0063.253] lstrlenA (lpString="*.divx") returned 6 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mkv") returned 0 [0063.253] lstrlenA (lpString="*.mkv") returned 5 [0063.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.mp3") returned 0 [0063.254] lstrlenA (lpString="*.mp3") returned 5 [0063.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.wav") returned 0 [0063.254] lstrlenA (lpString="*.wav") returned 5 [0063.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.flac") returned 0 [0063.254] lstrlenA (lpString="*.flac") returned 6 [0063.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.ape") returned 0 [0063.254] lstrlenA (lpString="*.ape") returned 5 [0063.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.wma") returned 0 [0063.254] lstrlenA (lpString="*.wma") returned 5 [0063.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.ac3") returned 0 [0063.254] lstrlenA (lpString="*.ac3") returned 5 [0063.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\meiryo_boot.ttf", pszSpec="*.doc") returned 0 [0063.254] lstrlenA (lpString="*.doc") returned 5 [0063.254] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0063.254] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.254] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msjhn_boot.ttf") returned -1 [0063.254] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msjhn_boot.ttf") returned -1 [0063.254] lstrcmpiA (lpString1="", lpString2="msjhn_boot.ttf") returned -1 [0063.254] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned="meiryo_boot.ttf" [0063.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.254] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.254] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.254] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.254] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned="C:\\Boot\\Fonts\\msjhn_boot.ttf" [0063.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.zip") returned 0 [0063.254] lstrlenA (lpString="*.zip") returned 5 [0063.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.rar") returned 0 [0063.254] lstrlenA (lpString="*.rar") returned 5 [0063.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.7z") returned 0 [0063.254] lstrlenA (lpString="*.7z") returned 4 [0063.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.tar") returned 0 [0063.254] lstrlenA (lpString="*.tar") returned 5 [0063.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.gzip") returned 0 [0063.254] lstrlenA (lpString="*.gzip") returned 6 [0063.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.jpg") returned 0 [0063.255] lstrlenA (lpString="*.jpg") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.255] lstrlenA (lpString="*.jpeg") returned 6 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.psd") returned 0 [0063.255] lstrlenA (lpString="*.psd") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.cdr") returned 0 [0063.255] lstrlenA (lpString="*.cdr") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.dwg") returned 0 [0063.255] lstrlenA (lpString="*.dwg") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.max") returned 0 [0063.255] lstrlenA (lpString="*.max") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.bmp") returned 0 [0063.255] lstrlenA (lpString="*.bmp") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.gif") returned 0 [0063.255] lstrlenA (lpString="*.gif") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.png") returned 0 [0063.255] lstrlenA (lpString="*.png") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.doc") returned 0 [0063.255] lstrlenA (lpString="*.doc") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.docx") returned 0 [0063.255] lstrlenA (lpString="*.docx") returned 6 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.xls") returned 0 [0063.255] lstrlenA (lpString="*.xls") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.255] lstrlenA (lpString="*.xlsx") returned 6 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.ppt") returned 0 [0063.255] lstrlenA (lpString="*.ppt") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.pptx") returned 0 [0063.255] lstrlenA (lpString="*.pptx") returned 6 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.txt") returned 0 [0063.255] lstrlenA (lpString="*.txt") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.pdf") returned 0 [0063.255] lstrlenA (lpString="*.pdf") returned 5 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.djvu") returned 0 [0063.255] lstrlenA (lpString="*.djvu") returned 6 [0063.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.htm") returned 0 [0063.255] lstrlenA (lpString="*.htm") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.html") returned 0 [0063.256] lstrlenA (lpString="*.html") returned 6 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mdb") returned 0 [0063.256] lstrlenA (lpString="*.mdb") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.cer") returned 0 [0063.256] lstrlenA (lpString="*.cer") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.p12") returned 0 [0063.256] lstrlenA (lpString="*.p12") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.pfx") returned 0 [0063.256] lstrlenA (lpString="*.pfx") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.kwm") returned 0 [0063.256] lstrlenA (lpString="*.kwm") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.pwm") returned 0 [0063.256] lstrlenA (lpString="*.pwm") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.1cd") returned 0 [0063.256] lstrlenA (lpString="*.1cd") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.md") returned 0 [0063.256] lstrlenA (lpString="*.md") returned 4 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mdf") returned 0 [0063.256] lstrlenA (lpString="*.mdf") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.dbf") returned 0 [0063.256] lstrlenA (lpString="*.dbf") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.odt") returned 0 [0063.256] lstrlenA (lpString="*.odt") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.vob") returned 0 [0063.256] lstrlenA (lpString="*.vob") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.ifo") returned 0 [0063.256] lstrlenA (lpString="*.ifo") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.lnk") returned 0 [0063.256] lstrlenA (lpString="*.lnk") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.torrent") returned 0 [0063.256] lstrlenA (lpString="*.torrent") returned 9 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mov") returned 0 [0063.256] lstrlenA (lpString="*.mov") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.m2v") returned 0 [0063.256] lstrlenA (lpString="*.m2v") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.3gp") returned 0 [0063.256] lstrlenA (lpString="*.3gp") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.257] lstrlenA (lpString="*.mpeg") returned 6 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mpg") returned 0 [0063.257] lstrlenA (lpString="*.mpg") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.flv") returned 0 [0063.257] lstrlenA (lpString="*.flv") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.avi") returned 0 [0063.257] lstrlenA (lpString="*.avi") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mp4") returned 0 [0063.257] lstrlenA (lpString="*.mp4") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.wmv") returned 0 [0063.257] lstrlenA (lpString="*.wmv") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.divx") returned 0 [0063.257] lstrlenA (lpString="*.divx") returned 6 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mkv") returned 0 [0063.257] lstrlenA (lpString="*.mkv") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.mp3") returned 0 [0063.257] lstrlenA (lpString="*.mp3") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.wav") returned 0 [0063.257] lstrlenA (lpString="*.wav") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.flac") returned 0 [0063.257] lstrlenA (lpString="*.flac") returned 6 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.ape") returned 0 [0063.257] lstrlenA (lpString="*.ape") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.wma") returned 0 [0063.257] lstrlenA (lpString="*.wma") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.ac3") returned 0 [0063.257] lstrlenA (lpString="*.ac3") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjhn_boot.ttf", pszSpec="*.doc") returned 0 [0063.257] lstrlenA (lpString="*.doc") returned 5 [0063.257] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0063.257] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.257] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msjh_boot.ttf") returned -1 [0063.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msjh_boot.ttf") returned -1 [0063.257] lstrcmpiA (lpString1="", lpString2="msjh_boot.ttf") returned -1 [0063.257] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned="msjhn_boot.ttf" [0063.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.258] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.258] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.258] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.258] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjh_boot.ttf") returned="C:\\Boot\\Fonts\\msjh_boot.ttf" [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.zip") returned 0 [0063.258] lstrlenA (lpString="*.zip") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.rar") returned 0 [0063.258] lstrlenA (lpString="*.rar") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.7z") returned 0 [0063.258] lstrlenA (lpString="*.7z") returned 4 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.tar") returned 0 [0063.258] lstrlenA (lpString="*.tar") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.gzip") returned 0 [0063.258] lstrlenA (lpString="*.gzip") returned 6 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.jpg") returned 0 [0063.258] lstrlenA (lpString="*.jpg") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.258] lstrlenA (lpString="*.jpeg") returned 6 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.psd") returned 0 [0063.258] lstrlenA (lpString="*.psd") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.cdr") returned 0 [0063.258] lstrlenA (lpString="*.cdr") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.dwg") returned 0 [0063.258] lstrlenA (lpString="*.dwg") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.max") returned 0 [0063.258] lstrlenA (lpString="*.max") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.bmp") returned 0 [0063.258] lstrlenA (lpString="*.bmp") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.gif") returned 0 [0063.258] lstrlenA (lpString="*.gif") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.png") returned 0 [0063.258] lstrlenA (lpString="*.png") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.doc") returned 0 [0063.258] lstrlenA (lpString="*.doc") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.docx") returned 0 [0063.259] lstrlenA (lpString="*.docx") returned 6 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.xls") returned 0 [0063.259] lstrlenA (lpString="*.xls") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.259] lstrlenA (lpString="*.xlsx") returned 6 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.ppt") returned 0 [0063.259] lstrlenA (lpString="*.ppt") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.pptx") returned 0 [0063.259] lstrlenA (lpString="*.pptx") returned 6 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.txt") returned 0 [0063.259] lstrlenA (lpString="*.txt") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.pdf") returned 0 [0063.259] lstrlenA (lpString="*.pdf") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.djvu") returned 0 [0063.259] lstrlenA (lpString="*.djvu") returned 6 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.htm") returned 0 [0063.259] lstrlenA (lpString="*.htm") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.html") returned 0 [0063.259] lstrlenA (lpString="*.html") returned 6 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mdb") returned 0 [0063.259] lstrlenA (lpString="*.mdb") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.cer") returned 0 [0063.259] lstrlenA (lpString="*.cer") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.p12") returned 0 [0063.259] lstrlenA (lpString="*.p12") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.pfx") returned 0 [0063.259] lstrlenA (lpString="*.pfx") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.kwm") returned 0 [0063.259] lstrlenA (lpString="*.kwm") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.pwm") returned 0 [0063.259] lstrlenA (lpString="*.pwm") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.1cd") returned 0 [0063.259] lstrlenA (lpString="*.1cd") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.md") returned 0 [0063.259] lstrlenA (lpString="*.md") returned 4 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mdf") returned 0 [0063.259] lstrlenA (lpString="*.mdf") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.dbf") returned 0 [0063.260] lstrlenA (lpString="*.dbf") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.odt") returned 0 [0063.260] lstrlenA (lpString="*.odt") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.vob") returned 0 [0063.260] lstrlenA (lpString="*.vob") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.ifo") returned 0 [0063.260] lstrlenA (lpString="*.ifo") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.lnk") returned 0 [0063.260] lstrlenA (lpString="*.lnk") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.torrent") returned 0 [0063.260] lstrlenA (lpString="*.torrent") returned 9 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mov") returned 0 [0063.260] lstrlenA (lpString="*.mov") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.m2v") returned 0 [0063.260] lstrlenA (lpString="*.m2v") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.3gp") returned 0 [0063.260] lstrlenA (lpString="*.3gp") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.260] lstrlenA (lpString="*.mpeg") returned 6 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mpg") returned 0 [0063.260] lstrlenA (lpString="*.mpg") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.flv") returned 0 [0063.260] lstrlenA (lpString="*.flv") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.avi") returned 0 [0063.260] lstrlenA (lpString="*.avi") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mp4") returned 0 [0063.260] lstrlenA (lpString="*.mp4") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.wmv") returned 0 [0063.260] lstrlenA (lpString="*.wmv") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.divx") returned 0 [0063.260] lstrlenA (lpString="*.divx") returned 6 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mkv") returned 0 [0063.260] lstrlenA (lpString="*.mkv") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.mp3") returned 0 [0063.260] lstrlenA (lpString="*.mp3") returned 5 [0063.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.wav") returned 0 [0063.260] lstrlenA (lpString="*.wav") returned 5 [0063.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.flac") returned 0 [0063.261] lstrlenA (lpString="*.flac") returned 6 [0063.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.ape") returned 0 [0063.261] lstrlenA (lpString="*.ape") returned 5 [0063.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.wma") returned 0 [0063.261] lstrlenA (lpString="*.wma") returned 5 [0063.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.ac3") returned 0 [0063.261] lstrlenA (lpString="*.ac3") returned 5 [0063.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msjh_boot.ttf", pszSpec="*.doc") returned 0 [0063.261] lstrlenA (lpString="*.doc") returned 5 [0063.261] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0063.261] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.261] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msyhn_boot.ttf") returned -1 [0063.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msyhn_boot.ttf") returned -1 [0063.261] lstrcmpiA (lpString1="", lpString2="msyhn_boot.ttf") returned -1 [0063.261] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\msjh_boot.ttf") returned="msjh_boot.ttf" [0063.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.261] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.261] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.261] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.261] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned="C:\\Boot\\Fonts\\msyhn_boot.ttf" [0063.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.zip") returned 0 [0063.261] lstrlenA (lpString="*.zip") returned 5 [0063.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.rar") returned 0 [0063.261] lstrlenA (lpString="*.rar") returned 5 [0063.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.7z") returned 0 [0063.261] lstrlenA (lpString="*.7z") returned 4 [0063.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.tar") returned 0 [0063.261] lstrlenA (lpString="*.tar") returned 5 [0063.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.gzip") returned 0 [0063.261] lstrlenA (lpString="*.gzip") returned 6 [0063.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.jpg") returned 0 [0063.261] lstrlenA (lpString="*.jpg") returned 5 [0063.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.261] lstrlenA (lpString="*.jpeg") returned 6 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.psd") returned 0 [0063.262] lstrlenA (lpString="*.psd") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.cdr") returned 0 [0063.262] lstrlenA (lpString="*.cdr") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.dwg") returned 0 [0063.262] lstrlenA (lpString="*.dwg") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.max") returned 0 [0063.262] lstrlenA (lpString="*.max") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.bmp") returned 0 [0063.262] lstrlenA (lpString="*.bmp") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.gif") returned 0 [0063.262] lstrlenA (lpString="*.gif") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.png") returned 0 [0063.262] lstrlenA (lpString="*.png") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.doc") returned 0 [0063.262] lstrlenA (lpString="*.doc") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.docx") returned 0 [0063.262] lstrlenA (lpString="*.docx") returned 6 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.xls") returned 0 [0063.262] lstrlenA (lpString="*.xls") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.262] lstrlenA (lpString="*.xlsx") returned 6 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.ppt") returned 0 [0063.262] lstrlenA (lpString="*.ppt") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.pptx") returned 0 [0063.262] lstrlenA (lpString="*.pptx") returned 6 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.txt") returned 0 [0063.262] lstrlenA (lpString="*.txt") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.pdf") returned 0 [0063.262] lstrlenA (lpString="*.pdf") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.djvu") returned 0 [0063.262] lstrlenA (lpString="*.djvu") returned 6 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.htm") returned 0 [0063.262] lstrlenA (lpString="*.htm") returned 5 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.html") returned 0 [0063.262] lstrlenA (lpString="*.html") returned 6 [0063.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mdb") returned 0 [0063.263] lstrlenA (lpString="*.mdb") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.cer") returned 0 [0063.263] lstrlenA (lpString="*.cer") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.p12") returned 0 [0063.263] lstrlenA (lpString="*.p12") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.pfx") returned 0 [0063.263] lstrlenA (lpString="*.pfx") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.kwm") returned 0 [0063.263] lstrlenA (lpString="*.kwm") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.pwm") returned 0 [0063.263] lstrlenA (lpString="*.pwm") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.1cd") returned 0 [0063.263] lstrlenA (lpString="*.1cd") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.md") returned 0 [0063.263] lstrlenA (lpString="*.md") returned 4 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mdf") returned 0 [0063.263] lstrlenA (lpString="*.mdf") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.dbf") returned 0 [0063.263] lstrlenA (lpString="*.dbf") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.odt") returned 0 [0063.263] lstrlenA (lpString="*.odt") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.vob") returned 0 [0063.263] lstrlenA (lpString="*.vob") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.ifo") returned 0 [0063.263] lstrlenA (lpString="*.ifo") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.lnk") returned 0 [0063.263] lstrlenA (lpString="*.lnk") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.torrent") returned 0 [0063.263] lstrlenA (lpString="*.torrent") returned 9 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mov") returned 0 [0063.263] lstrlenA (lpString="*.mov") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.m2v") returned 0 [0063.263] lstrlenA (lpString="*.m2v") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.3gp") returned 0 [0063.263] lstrlenA (lpString="*.3gp") returned 5 [0063.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.263] lstrlenA (lpString="*.mpeg") returned 6 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mpg") returned 0 [0063.264] lstrlenA (lpString="*.mpg") returned 5 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.flv") returned 0 [0063.264] lstrlenA (lpString="*.flv") returned 5 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.avi") returned 0 [0063.264] lstrlenA (lpString="*.avi") returned 5 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mp4") returned 0 [0063.264] lstrlenA (lpString="*.mp4") returned 5 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.wmv") returned 0 [0063.264] lstrlenA (lpString="*.wmv") returned 5 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.divx") returned 0 [0063.264] lstrlenA (lpString="*.divx") returned 6 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mkv") returned 0 [0063.264] lstrlenA (lpString="*.mkv") returned 5 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.mp3") returned 0 [0063.264] lstrlenA (lpString="*.mp3") returned 5 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.wav") returned 0 [0063.264] lstrlenA (lpString="*.wav") returned 5 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.flac") returned 0 [0063.264] lstrlenA (lpString="*.flac") returned 6 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.ape") returned 0 [0063.264] lstrlenA (lpString="*.ape") returned 5 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.wma") returned 0 [0063.264] lstrlenA (lpString="*.wma") returned 5 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.ac3") returned 0 [0063.264] lstrlenA (lpString="*.ac3") returned 5 [0063.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyhn_boot.ttf", pszSpec="*.doc") returned 0 [0063.265] lstrlenA (lpString="*.doc") returned 5 [0063.265] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0063.265] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.265] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msyh_boot.ttf") returned -1 [0063.265] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msyh_boot.ttf") returned -1 [0063.265] lstrcmpiA (lpString1="", lpString2="msyh_boot.ttf") returned -1 [0063.265] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned="msyhn_boot.ttf" [0063.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.265] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.265] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.265] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.265] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyh_boot.ttf") returned="C:\\Boot\\Fonts\\msyh_boot.ttf" [0063.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.zip") returned 0 [0063.265] lstrlenA (lpString="*.zip") returned 5 [0063.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.rar") returned 0 [0063.265] lstrlenA (lpString="*.rar") returned 5 [0063.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.7z") returned 0 [0063.265] lstrlenA (lpString="*.7z") returned 4 [0063.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.tar") returned 0 [0063.266] lstrlenA (lpString="*.tar") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.gzip") returned 0 [0063.266] lstrlenA (lpString="*.gzip") returned 6 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.jpg") returned 0 [0063.266] lstrlenA (lpString="*.jpg") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.266] lstrlenA (lpString="*.jpeg") returned 6 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.psd") returned 0 [0063.266] lstrlenA (lpString="*.psd") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.cdr") returned 0 [0063.266] lstrlenA (lpString="*.cdr") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.dwg") returned 0 [0063.266] lstrlenA (lpString="*.dwg") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.max") returned 0 [0063.266] lstrlenA (lpString="*.max") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.bmp") returned 0 [0063.266] lstrlenA (lpString="*.bmp") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.gif") returned 0 [0063.266] lstrlenA (lpString="*.gif") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.png") returned 0 [0063.266] lstrlenA (lpString="*.png") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.doc") returned 0 [0063.266] lstrlenA (lpString="*.doc") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.docx") returned 0 [0063.266] lstrlenA (lpString="*.docx") returned 6 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.xls") returned 0 [0063.266] lstrlenA (lpString="*.xls") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.266] lstrlenA (lpString="*.xlsx") returned 6 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.ppt") returned 0 [0063.266] lstrlenA (lpString="*.ppt") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.pptx") returned 0 [0063.266] lstrlenA (lpString="*.pptx") returned 6 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.txt") returned 0 [0063.266] lstrlenA (lpString="*.txt") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.pdf") returned 0 [0063.266] lstrlenA (lpString="*.pdf") returned 5 [0063.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.djvu") returned 0 [0063.267] lstrlenA (lpString="*.djvu") returned 6 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.htm") returned 0 [0063.267] lstrlenA (lpString="*.htm") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.html") returned 0 [0063.267] lstrlenA (lpString="*.html") returned 6 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mdb") returned 0 [0063.267] lstrlenA (lpString="*.mdb") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.cer") returned 0 [0063.267] lstrlenA (lpString="*.cer") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.p12") returned 0 [0063.267] lstrlenA (lpString="*.p12") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.pfx") returned 0 [0063.267] lstrlenA (lpString="*.pfx") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.kwm") returned 0 [0063.267] lstrlenA (lpString="*.kwm") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.pwm") returned 0 [0063.267] lstrlenA (lpString="*.pwm") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.1cd") returned 0 [0063.267] lstrlenA (lpString="*.1cd") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.md") returned 0 [0063.267] lstrlenA (lpString="*.md") returned 4 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mdf") returned 0 [0063.267] lstrlenA (lpString="*.mdf") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.dbf") returned 0 [0063.267] lstrlenA (lpString="*.dbf") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.odt") returned 0 [0063.267] lstrlenA (lpString="*.odt") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.vob") returned 0 [0063.267] lstrlenA (lpString="*.vob") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.ifo") returned 0 [0063.267] lstrlenA (lpString="*.ifo") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.lnk") returned 0 [0063.267] lstrlenA (lpString="*.lnk") returned 5 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.torrent") returned 0 [0063.267] lstrlenA (lpString="*.torrent") returned 9 [0063.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mov") returned 0 [0063.267] lstrlenA (lpString="*.mov") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.m2v") returned 0 [0063.268] lstrlenA (lpString="*.m2v") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.3gp") returned 0 [0063.268] lstrlenA (lpString="*.3gp") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.268] lstrlenA (lpString="*.mpeg") returned 6 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mpg") returned 0 [0063.268] lstrlenA (lpString="*.mpg") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.flv") returned 0 [0063.268] lstrlenA (lpString="*.flv") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.avi") returned 0 [0063.268] lstrlenA (lpString="*.avi") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mp4") returned 0 [0063.268] lstrlenA (lpString="*.mp4") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.wmv") returned 0 [0063.268] lstrlenA (lpString="*.wmv") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.divx") returned 0 [0063.268] lstrlenA (lpString="*.divx") returned 6 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mkv") returned 0 [0063.268] lstrlenA (lpString="*.mkv") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.mp3") returned 0 [0063.268] lstrlenA (lpString="*.mp3") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.wav") returned 0 [0063.268] lstrlenA (lpString="*.wav") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.flac") returned 0 [0063.268] lstrlenA (lpString="*.flac") returned 6 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.ape") returned 0 [0063.268] lstrlenA (lpString="*.ape") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.wma") returned 0 [0063.268] lstrlenA (lpString="*.wma") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.ac3") returned 0 [0063.268] lstrlenA (lpString="*.ac3") returned 5 [0063.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\msyh_boot.ttf", pszSpec="*.doc") returned 0 [0063.268] lstrlenA (lpString="*.doc") returned 5 [0063.268] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0063.268] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="segmono_boot.ttf") returned -1 [0063.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="segmono_boot.ttf") returned -1 [0063.269] lstrcmpiA (lpString1="", lpString2="segmono_boot.ttf") returned -1 [0063.269] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\msyh_boot.ttf") returned="msyh_boot.ttf" [0063.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.269] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.269] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.269] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.269] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segmono_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segmono_boot.ttf") returned="C:\\Boot\\Fonts\\segmono_boot.ttf" [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.zip") returned 0 [0063.269] lstrlenA (lpString="*.zip") returned 5 [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.rar") returned 0 [0063.269] lstrlenA (lpString="*.rar") returned 5 [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.7z") returned 0 [0063.269] lstrlenA (lpString="*.7z") returned 4 [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.tar") returned 0 [0063.269] lstrlenA (lpString="*.tar") returned 5 [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.gzip") returned 0 [0063.269] lstrlenA (lpString="*.gzip") returned 6 [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.jpg") returned 0 [0063.269] lstrlenA (lpString="*.jpg") returned 5 [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.269] lstrlenA (lpString="*.jpeg") returned 6 [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.psd") returned 0 [0063.269] lstrlenA (lpString="*.psd") returned 5 [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.cdr") returned 0 [0063.269] lstrlenA (lpString="*.cdr") returned 5 [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.dwg") returned 0 [0063.269] lstrlenA (lpString="*.dwg") returned 5 [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.max") returned 0 [0063.269] lstrlenA (lpString="*.max") returned 5 [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.bmp") returned 0 [0063.269] lstrlenA (lpString="*.bmp") returned 5 [0063.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.gif") returned 0 [0063.269] lstrlenA (lpString="*.gif") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.png") returned 0 [0063.270] lstrlenA (lpString="*.png") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.doc") returned 0 [0063.270] lstrlenA (lpString="*.doc") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.docx") returned 0 [0063.270] lstrlenA (lpString="*.docx") returned 6 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.xls") returned 0 [0063.270] lstrlenA (lpString="*.xls") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.270] lstrlenA (lpString="*.xlsx") returned 6 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.ppt") returned 0 [0063.270] lstrlenA (lpString="*.ppt") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.pptx") returned 0 [0063.270] lstrlenA (lpString="*.pptx") returned 6 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.txt") returned 0 [0063.270] lstrlenA (lpString="*.txt") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.pdf") returned 0 [0063.270] lstrlenA (lpString="*.pdf") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.djvu") returned 0 [0063.270] lstrlenA (lpString="*.djvu") returned 6 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.htm") returned 0 [0063.270] lstrlenA (lpString="*.htm") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.html") returned 0 [0063.270] lstrlenA (lpString="*.html") returned 6 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mdb") returned 0 [0063.270] lstrlenA (lpString="*.mdb") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.cer") returned 0 [0063.270] lstrlenA (lpString="*.cer") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.p12") returned 0 [0063.270] lstrlenA (lpString="*.p12") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.pfx") returned 0 [0063.270] lstrlenA (lpString="*.pfx") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.kwm") returned 0 [0063.270] lstrlenA (lpString="*.kwm") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.pwm") returned 0 [0063.270] lstrlenA (lpString="*.pwm") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.1cd") returned 0 [0063.270] lstrlenA (lpString="*.1cd") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.md") returned 0 [0063.271] lstrlenA (lpString="*.md") returned 4 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mdf") returned 0 [0063.271] lstrlenA (lpString="*.mdf") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.dbf") returned 0 [0063.271] lstrlenA (lpString="*.dbf") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.odt") returned 0 [0063.271] lstrlenA (lpString="*.odt") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.vob") returned 0 [0063.271] lstrlenA (lpString="*.vob") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.ifo") returned 0 [0063.271] lstrlenA (lpString="*.ifo") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.lnk") returned 0 [0063.271] lstrlenA (lpString="*.lnk") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.torrent") returned 0 [0063.271] lstrlenA (lpString="*.torrent") returned 9 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mov") returned 0 [0063.271] lstrlenA (lpString="*.mov") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.m2v") returned 0 [0063.271] lstrlenA (lpString="*.m2v") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.3gp") returned 0 [0063.271] lstrlenA (lpString="*.3gp") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.271] lstrlenA (lpString="*.mpeg") returned 6 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mpg") returned 0 [0063.271] lstrlenA (lpString="*.mpg") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.flv") returned 0 [0063.271] lstrlenA (lpString="*.flv") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.avi") returned 0 [0063.271] lstrlenA (lpString="*.avi") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mp4") returned 0 [0063.271] lstrlenA (lpString="*.mp4") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.wmv") returned 0 [0063.271] lstrlenA (lpString="*.wmv") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.divx") returned 0 [0063.271] lstrlenA (lpString="*.divx") returned 6 [0063.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mkv") returned 0 [0063.272] lstrlenA (lpString="*.mkv") returned 5 [0063.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.mp3") returned 0 [0063.272] lstrlenA (lpString="*.mp3") returned 5 [0063.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.wav") returned 0 [0063.272] lstrlenA (lpString="*.wav") returned 5 [0063.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.flac") returned 0 [0063.272] lstrlenA (lpString="*.flac") returned 6 [0063.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.ape") returned 0 [0063.272] lstrlenA (lpString="*.ape") returned 5 [0063.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.wma") returned 0 [0063.272] lstrlenA (lpString="*.wma") returned 5 [0063.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.ac3") returned 0 [0063.272] lstrlenA (lpString="*.ac3") returned 5 [0063.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segmono_boot.ttf", pszSpec="*.doc") returned 0 [0063.272] lstrlenA (lpString="*.doc") returned 5 [0063.272] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0063.272] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="segoen_slboot.ttf") returned -1 [0063.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="segoen_slboot.ttf") returned -1 [0063.272] lstrcmpiA (lpString1="", lpString2="segoen_slboot.ttf") returned -1 [0063.272] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\segmono_boot.ttf") returned="segmono_boot.ttf" [0063.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.272] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.272] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.272] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.272] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoen_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned="C:\\Boot\\Fonts\\segoen_slboot.ttf" [0063.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.zip") returned 0 [0063.272] lstrlenA (lpString="*.zip") returned 5 [0063.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.rar") returned 0 [0063.272] lstrlenA (lpString="*.rar") returned 5 [0063.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.7z") returned 0 [0063.272] lstrlenA (lpString="*.7z") returned 4 [0063.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.tar") returned 0 [0063.272] lstrlenA (lpString="*.tar") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.gzip") returned 0 [0063.273] lstrlenA (lpString="*.gzip") returned 6 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.jpg") returned 0 [0063.273] lstrlenA (lpString="*.jpg") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.jpeg") returned 0 [0063.273] lstrlenA (lpString="*.jpeg") returned 6 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.psd") returned 0 [0063.273] lstrlenA (lpString="*.psd") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.cdr") returned 0 [0063.273] lstrlenA (lpString="*.cdr") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.dwg") returned 0 [0063.273] lstrlenA (lpString="*.dwg") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.max") returned 0 [0063.273] lstrlenA (lpString="*.max") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.bmp") returned 0 [0063.273] lstrlenA (lpString="*.bmp") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.gif") returned 0 [0063.273] lstrlenA (lpString="*.gif") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.png") returned 0 [0063.273] lstrlenA (lpString="*.png") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.doc") returned 0 [0063.273] lstrlenA (lpString="*.doc") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.docx") returned 0 [0063.273] lstrlenA (lpString="*.docx") returned 6 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.xls") returned 0 [0063.273] lstrlenA (lpString="*.xls") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.xlsx") returned 0 [0063.273] lstrlenA (lpString="*.xlsx") returned 6 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.ppt") returned 0 [0063.273] lstrlenA (lpString="*.ppt") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.pptx") returned 0 [0063.273] lstrlenA (lpString="*.pptx") returned 6 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.txt") returned 0 [0063.273] lstrlenA (lpString="*.txt") returned 5 [0063.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.pdf") returned 0 [0063.273] lstrlenA (lpString="*.pdf") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.djvu") returned 0 [0063.274] lstrlenA (lpString="*.djvu") returned 6 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.htm") returned 0 [0063.274] lstrlenA (lpString="*.htm") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.html") returned 0 [0063.274] lstrlenA (lpString="*.html") returned 6 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mdb") returned 0 [0063.274] lstrlenA (lpString="*.mdb") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.cer") returned 0 [0063.274] lstrlenA (lpString="*.cer") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.p12") returned 0 [0063.274] lstrlenA (lpString="*.p12") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.pfx") returned 0 [0063.274] lstrlenA (lpString="*.pfx") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.kwm") returned 0 [0063.274] lstrlenA (lpString="*.kwm") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.pwm") returned 0 [0063.274] lstrlenA (lpString="*.pwm") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.1cd") returned 0 [0063.274] lstrlenA (lpString="*.1cd") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.md") returned 0 [0063.274] lstrlenA (lpString="*.md") returned 4 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mdf") returned 0 [0063.274] lstrlenA (lpString="*.mdf") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.dbf") returned 0 [0063.274] lstrlenA (lpString="*.dbf") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.odt") returned 0 [0063.274] lstrlenA (lpString="*.odt") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.vob") returned 0 [0063.274] lstrlenA (lpString="*.vob") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.ifo") returned 0 [0063.274] lstrlenA (lpString="*.ifo") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.lnk") returned 0 [0063.274] lstrlenA (lpString="*.lnk") returned 5 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.torrent") returned 0 [0063.274] lstrlenA (lpString="*.torrent") returned 9 [0063.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mov") returned 0 [0063.274] lstrlenA (lpString="*.mov") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.m2v") returned 0 [0063.275] lstrlenA (lpString="*.m2v") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.3gp") returned 0 [0063.275] lstrlenA (lpString="*.3gp") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mpeg") returned 0 [0063.275] lstrlenA (lpString="*.mpeg") returned 6 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mpg") returned 0 [0063.275] lstrlenA (lpString="*.mpg") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.flv") returned 0 [0063.275] lstrlenA (lpString="*.flv") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.avi") returned 0 [0063.275] lstrlenA (lpString="*.avi") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mp4") returned 0 [0063.275] lstrlenA (lpString="*.mp4") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.wmv") returned 0 [0063.275] lstrlenA (lpString="*.wmv") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.divx") returned 0 [0063.275] lstrlenA (lpString="*.divx") returned 6 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mkv") returned 0 [0063.275] lstrlenA (lpString="*.mkv") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.mp3") returned 0 [0063.275] lstrlenA (lpString="*.mp3") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.wav") returned 0 [0063.275] lstrlenA (lpString="*.wav") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.flac") returned 0 [0063.275] lstrlenA (lpString="*.flac") returned 6 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.ape") returned 0 [0063.275] lstrlenA (lpString="*.ape") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.wma") returned 0 [0063.275] lstrlenA (lpString="*.wma") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.ac3") returned 0 [0063.275] lstrlenA (lpString="*.ac3") returned 5 [0063.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoen_slboot.ttf", pszSpec="*.doc") returned 0 [0063.275] lstrlenA (lpString="*.doc") returned 5 [0063.275] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0063.275] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="segoe_slboot.ttf") returned -1 [0063.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="segoe_slboot.ttf") returned -1 [0063.276] lstrcmpiA (lpString1="", lpString2="segoe_slboot.ttf") returned -1 [0063.276] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned="segoen_slboot.ttf" [0063.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.276] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.276] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.276] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.276] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoe_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned="C:\\Boot\\Fonts\\segoe_slboot.ttf" [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.zip") returned 0 [0063.276] lstrlenA (lpString="*.zip") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.rar") returned 0 [0063.276] lstrlenA (lpString="*.rar") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.7z") returned 0 [0063.276] lstrlenA (lpString="*.7z") returned 4 [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.tar") returned 0 [0063.276] lstrlenA (lpString="*.tar") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.gzip") returned 0 [0063.276] lstrlenA (lpString="*.gzip") returned 6 [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.jpg") returned 0 [0063.276] lstrlenA (lpString="*.jpg") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.jpeg") returned 0 [0063.276] lstrlenA (lpString="*.jpeg") returned 6 [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.psd") returned 0 [0063.276] lstrlenA (lpString="*.psd") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.cdr") returned 0 [0063.276] lstrlenA (lpString="*.cdr") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.dwg") returned 0 [0063.276] lstrlenA (lpString="*.dwg") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.max") returned 0 [0063.276] lstrlenA (lpString="*.max") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.bmp") returned 0 [0063.276] lstrlenA (lpString="*.bmp") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.gif") returned 0 [0063.276] lstrlenA (lpString="*.gif") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.png") returned 0 [0063.277] lstrlenA (lpString="*.png") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.doc") returned 0 [0063.277] lstrlenA (lpString="*.doc") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.docx") returned 0 [0063.277] lstrlenA (lpString="*.docx") returned 6 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.xls") returned 0 [0063.277] lstrlenA (lpString="*.xls") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.xlsx") returned 0 [0063.277] lstrlenA (lpString="*.xlsx") returned 6 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.ppt") returned 0 [0063.277] lstrlenA (lpString="*.ppt") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.pptx") returned 0 [0063.277] lstrlenA (lpString="*.pptx") returned 6 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.txt") returned 0 [0063.277] lstrlenA (lpString="*.txt") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.pdf") returned 0 [0063.277] lstrlenA (lpString="*.pdf") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.djvu") returned 0 [0063.277] lstrlenA (lpString="*.djvu") returned 6 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.htm") returned 0 [0063.277] lstrlenA (lpString="*.htm") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.html") returned 0 [0063.277] lstrlenA (lpString="*.html") returned 6 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mdb") returned 0 [0063.277] lstrlenA (lpString="*.mdb") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.cer") returned 0 [0063.277] lstrlenA (lpString="*.cer") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.p12") returned 0 [0063.277] lstrlenA (lpString="*.p12") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.pfx") returned 0 [0063.277] lstrlenA (lpString="*.pfx") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.kwm") returned 0 [0063.277] lstrlenA (lpString="*.kwm") returned 5 [0063.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.pwm") returned 0 [0063.277] lstrlenA (lpString="*.pwm") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.1cd") returned 0 [0063.278] lstrlenA (lpString="*.1cd") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.md") returned 0 [0063.278] lstrlenA (lpString="*.md") returned 4 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mdf") returned 0 [0063.278] lstrlenA (lpString="*.mdf") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.dbf") returned 0 [0063.278] lstrlenA (lpString="*.dbf") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.odt") returned 0 [0063.278] lstrlenA (lpString="*.odt") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.vob") returned 0 [0063.278] lstrlenA (lpString="*.vob") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.ifo") returned 0 [0063.278] lstrlenA (lpString="*.ifo") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.lnk") returned 0 [0063.278] lstrlenA (lpString="*.lnk") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.torrent") returned 0 [0063.278] lstrlenA (lpString="*.torrent") returned 9 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mov") returned 0 [0063.278] lstrlenA (lpString="*.mov") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.m2v") returned 0 [0063.278] lstrlenA (lpString="*.m2v") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.3gp") returned 0 [0063.278] lstrlenA (lpString="*.3gp") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mpeg") returned 0 [0063.278] lstrlenA (lpString="*.mpeg") returned 6 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mpg") returned 0 [0063.278] lstrlenA (lpString="*.mpg") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.flv") returned 0 [0063.278] lstrlenA (lpString="*.flv") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.avi") returned 0 [0063.278] lstrlenA (lpString="*.avi") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mp4") returned 0 [0063.278] lstrlenA (lpString="*.mp4") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.wmv") returned 0 [0063.278] lstrlenA (lpString="*.wmv") returned 5 [0063.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.divx") returned 0 [0063.279] lstrlenA (lpString="*.divx") returned 6 [0063.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mkv") returned 0 [0063.279] lstrlenA (lpString="*.mkv") returned 5 [0063.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.mp3") returned 0 [0063.279] lstrlenA (lpString="*.mp3") returned 5 [0063.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.wav") returned 0 [0063.279] lstrlenA (lpString="*.wav") returned 5 [0063.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.flac") returned 0 [0063.279] lstrlenA (lpString="*.flac") returned 6 [0063.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.ape") returned 0 [0063.279] lstrlenA (lpString="*.ape") returned 5 [0063.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.wma") returned 0 [0063.279] lstrlenA (lpString="*.wma") returned 5 [0063.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.ac3") returned 0 [0063.279] lstrlenA (lpString="*.ac3") returned 5 [0063.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\segoe_slboot.ttf", pszSpec="*.doc") returned 0 [0063.279] lstrlenA (lpString="*.doc") returned 5 [0063.279] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0063.279] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.279] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wgl4_boot.ttf") returned -1 [0063.279] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wgl4_boot.ttf") returned -1 [0063.279] lstrcmpiA (lpString1="", lpString2="wgl4_boot.ttf") returned -1 [0063.279] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned="segoe_slboot.ttf" [0063.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0063.279] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0063.279] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0063.279] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0063.279] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf" [0063.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.zip") returned 0 [0063.279] lstrlenA (lpString="*.zip") returned 5 [0063.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.rar") returned 0 [0063.279] lstrlenA (lpString="*.rar") returned 5 [0063.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.7z") returned 0 [0063.279] lstrlenA (lpString="*.7z") returned 4 [0063.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.tar") returned 0 [0063.280] lstrlenA (lpString="*.tar") returned 5 [0063.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.gzip") returned 0 [0063.280] lstrlenA (lpString="*.gzip") returned 6 [0063.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.jpg") returned 0 [0063.280] lstrlenA (lpString="*.jpg") returned 5 [0063.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.jpeg") returned 0 [0063.280] lstrlenA (lpString="*.jpeg") returned 6 [0063.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.psd") returned 0 [0063.280] lstrlenA (lpString="*.psd") returned 5 [0063.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.cdr") returned 0 [0063.280] lstrlenA (lpString="*.cdr") returned 5 [0063.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.dwg") returned 0 [0063.290] lstrlenA (lpString="*.dwg") returned 5 [0063.290] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.max") returned 0 [0063.290] lstrlenA (lpString="*.max") returned 5 [0063.290] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.bmp") returned 0 [0063.290] lstrlenA (lpString="*.bmp") returned 5 [0063.299] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.gif") returned 0 [0063.299] lstrlenA (lpString="*.gif") returned 5 [0063.299] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.png") returned 0 [0063.299] lstrlenA (lpString="*.png") returned 5 [0063.299] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.doc") returned 0 [0063.299] lstrlenA (lpString="*.doc") returned 5 [0063.299] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.docx") returned 0 [0063.299] lstrlenA (lpString="*.docx") returned 6 [0063.299] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xls") returned 0 [0063.299] lstrlenA (lpString="*.xls") returned 5 [0063.299] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xlsx") returned 0 [0063.299] lstrlenA (lpString="*.xlsx") returned 6 [0063.299] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ppt") returned 0 [0063.299] lstrlenA (lpString="*.ppt") returned 5 [0063.299] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pptx") returned 0 [0063.300] lstrlenA (lpString="*.pptx") returned 6 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.txt") returned 0 [0063.300] lstrlenA (lpString="*.txt") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pdf") returned 0 [0063.300] lstrlenA (lpString="*.pdf") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.djvu") returned 0 [0063.300] lstrlenA (lpString="*.djvu") returned 6 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.htm") returned 0 [0063.300] lstrlenA (lpString="*.htm") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.html") returned 0 [0063.300] lstrlenA (lpString="*.html") returned 6 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mdb") returned 0 [0063.300] lstrlenA (lpString="*.mdb") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.cer") returned 0 [0063.300] lstrlenA (lpString="*.cer") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.p12") returned 0 [0063.300] lstrlenA (lpString="*.p12") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pfx") returned 0 [0063.300] lstrlenA (lpString="*.pfx") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.kwm") returned 0 [0063.300] lstrlenA (lpString="*.kwm") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pwm") returned 0 [0063.300] lstrlenA (lpString="*.pwm") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.1cd") returned 0 [0063.300] lstrlenA (lpString="*.1cd") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.md") returned 0 [0063.300] lstrlenA (lpString="*.md") returned 4 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mdf") returned 0 [0063.300] lstrlenA (lpString="*.mdf") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.dbf") returned 0 [0063.300] lstrlenA (lpString="*.dbf") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.odt") returned 0 [0063.300] lstrlenA (lpString="*.odt") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.vob") returned 0 [0063.300] lstrlenA (lpString="*.vob") returned 5 [0063.300] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ifo") returned 0 [0063.301] lstrlenA (lpString="*.ifo") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.lnk") returned 0 [0063.301] lstrlenA (lpString="*.lnk") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.torrent") returned 0 [0063.301] lstrlenA (lpString="*.torrent") returned 9 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mov") returned 0 [0063.301] lstrlenA (lpString="*.mov") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.m2v") returned 0 [0063.301] lstrlenA (lpString="*.m2v") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.3gp") returned 0 [0063.301] lstrlenA (lpString="*.3gp") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mpeg") returned 0 [0063.301] lstrlenA (lpString="*.mpeg") returned 6 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mpg") returned 0 [0063.301] lstrlenA (lpString="*.mpg") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.flv") returned 0 [0063.301] lstrlenA (lpString="*.flv") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.avi") returned 0 [0063.301] lstrlenA (lpString="*.avi") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mp4") returned 0 [0063.301] lstrlenA (lpString="*.mp4") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wmv") returned 0 [0063.301] lstrlenA (lpString="*.wmv") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.divx") returned 0 [0063.301] lstrlenA (lpString="*.divx") returned 6 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mkv") returned 0 [0063.301] lstrlenA (lpString="*.mkv") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mp3") returned 0 [0063.301] lstrlenA (lpString="*.mp3") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wav") returned 0 [0063.301] lstrlenA (lpString="*.wav") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.flac") returned 0 [0063.301] lstrlenA (lpString="*.flac") returned 6 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ape") returned 0 [0063.301] lstrlenA (lpString="*.ape") returned 5 [0063.301] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wma") returned 0 [0063.301] lstrlenA (lpString="*.wma") returned 5 [0063.302] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ac3") returned 0 [0063.302] lstrlenA (lpString="*.ac3") returned 5 [0063.302] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.doc") returned 0 [0063.302] lstrlenA (lpString="*.doc") returned 5 [0063.302] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0063.302] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0063.302] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0063.302] lstrcmpA (lpString1=".", lpString2="fr-CA") returned -1 [0063.302] lstrcmpA (lpString1="..", lpString2="fr-CA") returned -1 [0063.302] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.302] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fr-CA" | out: lpString1="C:\\Boot\\fr-CA") returned="C:\\Boot\\fr-CA" [0063.302] lstrlenA (lpString="C:\\Boot\\fr-CA") returned 13 [0063.302] FindFirstFileA (in: lpFileName="C:\\Boot\\fr-CA\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0063.303] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.303] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.303] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.303] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.303] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.303] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.303] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.303] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.303] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.303] PathFindFileNameA (pszPath="C:\\Boot\\fr-CA\\*.*") returned="*.*" [0063.303] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fr-CA\\" | out: lpString1="C:\\Boot\\fr-CA\\") returned="C:\\Boot\\fr-CA\\" [0063.303] PathAddBackslashA (in: pszPath="C:\\Boot\\fr-CA\\" | out: pszPath="C:\\Boot\\fr-CA\\") returned="" [0063.303] lstrcatA (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fr-CA\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fr-CA\\HOW TO DECRYPT FILES.txt" [0063.303] GetFileAttributesA (lpFileName="C:\\Boot\\fr-CA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-ca\\how to decrypt files.txt")) returned 0xffffffff [0063.303] CreateFileA (lpFileName="C:\\Boot\\fr-CA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-ca\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.304] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.304] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.306] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.306] CloseHandle (hObject=0x208) returned 1 [0063.306] lstrcatA (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned="C:\\Boot\\fr-CA\\bootmgr.exe.mui" [0063.306] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.306] lstrlenA (lpString="*.zip") returned 5 [0063.306] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.306] lstrlenA (lpString="*.rar") returned 5 [0063.306] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.306] lstrlenA (lpString="*.7z") returned 4 [0063.306] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.306] lstrlenA (lpString="*.tar") returned 5 [0063.306] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.306] lstrlenA (lpString="*.gzip") returned 6 [0063.306] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.306] lstrlenA (lpString="*.jpg") returned 5 [0063.306] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.306] lstrlenA (lpString="*.jpeg") returned 6 [0063.306] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.306] lstrlenA (lpString="*.psd") returned 5 [0063.306] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.306] lstrlenA (lpString="*.cdr") returned 5 [0063.306] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.306] lstrlenA (lpString="*.dwg") returned 5 [0063.306] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.306] lstrlenA (lpString="*.max") returned 5 [0063.306] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.307] lstrlenA (lpString="*.bmp") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.307] lstrlenA (lpString="*.gif") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.307] lstrlenA (lpString="*.png") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.307] lstrlenA (lpString="*.doc") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.307] lstrlenA (lpString="*.docx") returned 6 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.307] lstrlenA (lpString="*.xls") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.307] lstrlenA (lpString="*.xlsx") returned 6 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.307] lstrlenA (lpString="*.ppt") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.307] lstrlenA (lpString="*.pptx") returned 6 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.307] lstrlenA (lpString="*.txt") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.307] lstrlenA (lpString="*.pdf") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.307] lstrlenA (lpString="*.djvu") returned 6 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.307] lstrlenA (lpString="*.htm") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.307] lstrlenA (lpString="*.html") returned 6 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.307] lstrlenA (lpString="*.mdb") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.307] lstrlenA (lpString="*.cer") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.307] lstrlenA (lpString="*.p12") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.307] lstrlenA (lpString="*.pfx") returned 5 [0063.307] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.307] lstrlenA (lpString="*.kwm") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.308] lstrlenA (lpString="*.pwm") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.308] lstrlenA (lpString="*.1cd") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.308] lstrlenA (lpString="*.md") returned 4 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.308] lstrlenA (lpString="*.mdf") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.308] lstrlenA (lpString="*.dbf") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.308] lstrlenA (lpString="*.odt") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.308] lstrlenA (lpString="*.vob") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.308] lstrlenA (lpString="*.ifo") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.308] lstrlenA (lpString="*.lnk") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.308] lstrlenA (lpString="*.torrent") returned 9 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.308] lstrlenA (lpString="*.mov") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.308] lstrlenA (lpString="*.m2v") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.308] lstrlenA (lpString="*.3gp") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.308] lstrlenA (lpString="*.mpeg") returned 6 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.308] lstrlenA (lpString="*.mpg") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.308] lstrlenA (lpString="*.flv") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.308] lstrlenA (lpString="*.avi") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.308] lstrlenA (lpString="*.mp4") returned 5 [0063.308] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.308] lstrlenA (lpString="*.wmv") returned 5 [0063.309] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.309] lstrlenA (lpString="*.divx") returned 6 [0063.309] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.309] lstrlenA (lpString="*.mkv") returned 5 [0063.309] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.309] lstrlenA (lpString="*.mp3") returned 5 [0063.309] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.309] lstrlenA (lpString="*.wav") returned 5 [0063.309] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.309] lstrlenA (lpString="*.flac") returned 6 [0063.309] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.309] lstrlenA (lpString="*.ape") returned 5 [0063.309] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.309] lstrlenA (lpString="*.wma") returned 5 [0063.309] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.309] lstrlenA (lpString="*.ac3") returned 5 [0063.309] PathMatchSpecA (pszFile="C:\\Boot\\fr-CA\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.309] lstrlenA (lpString="*.doc") returned 5 [0063.309] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.309] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0063.309] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0063.309] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1 [0063.309] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1 [0063.309] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.309] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR" [0063.309] lstrlenA (lpString="C:\\Boot\\fr-FR") returned 13 [0063.309] FindFirstFileA (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759990 [0063.310] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.310] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0063.310] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.310] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.310] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.310] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.310] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.310] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.310] PathFindFileNameA (pszPath="C:\\Boot\\fr-FR\\*.*") returned="*.*" [0063.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fr-FR\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\" [0063.310] PathAddBackslashA (in: pszPath="C:\\Boot\\fr-FR\\" | out: pszPath="C:\\Boot\\fr-FR\\") returned="" [0063.310] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" [0063.310] GetFileAttributesA (lpFileName="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-fr\\how to decrypt files.txt")) returned 0xffffffff [0063.310] CreateFileA (lpFileName="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.312] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.312] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.313] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.314] CloseHandle (hObject=0x208) returned 1 [0063.314] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.314] lstrlenA (lpString="*.zip") returned 5 [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.314] lstrlenA (lpString="*.rar") returned 5 [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.314] lstrlenA (lpString="*.7z") returned 4 [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.314] lstrlenA (lpString="*.tar") returned 5 [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.314] lstrlenA (lpString="*.gzip") returned 6 [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.314] lstrlenA (lpString="*.jpg") returned 5 [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.314] lstrlenA (lpString="*.jpeg") returned 6 [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.314] lstrlenA (lpString="*.psd") returned 5 [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.314] lstrlenA (lpString="*.cdr") returned 5 [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.314] lstrlenA (lpString="*.dwg") returned 5 [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.314] lstrlenA (lpString="*.max") returned 5 [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.314] lstrlenA (lpString="*.bmp") returned 5 [0063.314] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.315] lstrlenA (lpString="*.gif") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.315] lstrlenA (lpString="*.png") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.315] lstrlenA (lpString="*.doc") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.315] lstrlenA (lpString="*.docx") returned 6 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.315] lstrlenA (lpString="*.xls") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.315] lstrlenA (lpString="*.xlsx") returned 6 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.315] lstrlenA (lpString="*.ppt") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.315] lstrlenA (lpString="*.pptx") returned 6 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.315] lstrlenA (lpString="*.txt") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.315] lstrlenA (lpString="*.pdf") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.315] lstrlenA (lpString="*.djvu") returned 6 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.315] lstrlenA (lpString="*.htm") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.315] lstrlenA (lpString="*.html") returned 6 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.315] lstrlenA (lpString="*.mdb") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.315] lstrlenA (lpString="*.cer") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.315] lstrlenA (lpString="*.p12") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.315] lstrlenA (lpString="*.pfx") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.315] lstrlenA (lpString="*.kwm") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.315] lstrlenA (lpString="*.pwm") returned 5 [0063.315] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.316] lstrlenA (lpString="*.1cd") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.316] lstrlenA (lpString="*.md") returned 4 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.316] lstrlenA (lpString="*.mdf") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.316] lstrlenA (lpString="*.dbf") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.316] lstrlenA (lpString="*.odt") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.316] lstrlenA (lpString="*.vob") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.316] lstrlenA (lpString="*.ifo") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.316] lstrlenA (lpString="*.lnk") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.316] lstrlenA (lpString="*.torrent") returned 9 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.316] lstrlenA (lpString="*.mov") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.316] lstrlenA (lpString="*.m2v") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.316] lstrlenA (lpString="*.3gp") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.316] lstrlenA (lpString="*.mpeg") returned 6 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.316] lstrlenA (lpString="*.mpg") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.316] lstrlenA (lpString="*.flv") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.316] lstrlenA (lpString="*.avi") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.316] lstrlenA (lpString="*.mp4") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.316] lstrlenA (lpString="*.wmv") returned 5 [0063.316] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.316] lstrlenA (lpString="*.divx") returned 6 [0063.317] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.317] lstrlenA (lpString="*.mkv") returned 5 [0063.317] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.317] lstrlenA (lpString="*.mp3") returned 5 [0063.317] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.317] lstrlenA (lpString="*.wav") returned 5 [0063.317] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.317] lstrlenA (lpString="*.flac") returned 6 [0063.317] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.317] lstrlenA (lpString="*.ape") returned 5 [0063.317] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.317] lstrlenA (lpString="*.wma") returned 5 [0063.317] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.317] lstrlenA (lpString="*.ac3") returned 5 [0063.317] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.317] lstrlenA (lpString="*.doc") returned 5 [0063.317] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.317] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.317] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.317] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.317] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.317] PathFindFileNameA (pszPath="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fr-FR\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\" [0063.317] PathAddBackslashA (in: pszPath="C:\\Boot\\fr-FR\\" | out: pszPath="C:\\Boot\\fr-FR\\") returned="" [0063.317] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" [0063.317] GetFileAttributesA (lpFileName="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-fr\\how to decrypt files.txt")) returned 0x20 [0063.317] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\memtest.exe.mui") returned="C:\\Boot\\fr-FR\\memtest.exe.mui" [0063.317] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.317] lstrlenA (lpString="*.zip") returned 5 [0063.317] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.317] lstrlenA (lpString="*.rar") returned 5 [0063.317] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.318] lstrlenA (lpString="*.7z") returned 4 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.318] lstrlenA (lpString="*.tar") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.318] lstrlenA (lpString="*.gzip") returned 6 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.318] lstrlenA (lpString="*.jpg") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.318] lstrlenA (lpString="*.jpeg") returned 6 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.318] lstrlenA (lpString="*.psd") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.318] lstrlenA (lpString="*.cdr") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.318] lstrlenA (lpString="*.dwg") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.318] lstrlenA (lpString="*.max") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.318] lstrlenA (lpString="*.bmp") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.318] lstrlenA (lpString="*.gif") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.318] lstrlenA (lpString="*.png") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.318] lstrlenA (lpString="*.doc") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.318] lstrlenA (lpString="*.docx") returned 6 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.318] lstrlenA (lpString="*.xls") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.318] lstrlenA (lpString="*.xlsx") returned 6 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.318] lstrlenA (lpString="*.ppt") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.318] lstrlenA (lpString="*.pptx") returned 6 [0063.318] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.318] lstrlenA (lpString="*.txt") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.319] lstrlenA (lpString="*.pdf") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.319] lstrlenA (lpString="*.djvu") returned 6 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.319] lstrlenA (lpString="*.htm") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.319] lstrlenA (lpString="*.html") returned 6 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.319] lstrlenA (lpString="*.mdb") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.319] lstrlenA (lpString="*.cer") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.319] lstrlenA (lpString="*.p12") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.319] lstrlenA (lpString="*.pfx") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.319] lstrlenA (lpString="*.kwm") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.319] lstrlenA (lpString="*.pwm") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.319] lstrlenA (lpString="*.1cd") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.319] lstrlenA (lpString="*.md") returned 4 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.319] lstrlenA (lpString="*.mdf") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.319] lstrlenA (lpString="*.dbf") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.319] lstrlenA (lpString="*.odt") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.319] lstrlenA (lpString="*.vob") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.319] lstrlenA (lpString="*.ifo") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.319] lstrlenA (lpString="*.lnk") returned 5 [0063.319] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.319] lstrlenA (lpString="*.torrent") returned 9 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.320] lstrlenA (lpString="*.mov") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.320] lstrlenA (lpString="*.m2v") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.320] lstrlenA (lpString="*.3gp") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.320] lstrlenA (lpString="*.mpeg") returned 6 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.320] lstrlenA (lpString="*.mpg") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.320] lstrlenA (lpString="*.flv") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.320] lstrlenA (lpString="*.avi") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.320] lstrlenA (lpString="*.mp4") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.320] lstrlenA (lpString="*.wmv") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.320] lstrlenA (lpString="*.divx") returned 6 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.320] lstrlenA (lpString="*.mkv") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.320] lstrlenA (lpString="*.mp3") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.320] lstrlenA (lpString="*.wav") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.320] lstrlenA (lpString="*.flac") returned 6 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.320] lstrlenA (lpString="*.ape") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.320] lstrlenA (lpString="*.wma") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.320] lstrlenA (lpString="*.ac3") returned 5 [0063.320] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.320] lstrlenA (lpString="*.doc") returned 5 [0063.320] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.321] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0063.321] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0063.321] lstrcmpA (lpString1=".", lpString2="hr-HR") returned -1 [0063.321] lstrcmpA (lpString1="..", lpString2="hr-HR") returned -1 [0063.321] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.321] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="hr-HR" | out: lpString1="C:\\Boot\\hr-HR") returned="C:\\Boot\\hr-HR" [0063.321] lstrlenA (lpString="C:\\Boot\\hr-HR") returned 13 [0063.321] FindFirstFileA (in: lpFileName="C:\\Boot\\hr-HR\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0063.322] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.322] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.322] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.322] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.322] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.322] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.322] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.322] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.322] PathFindFileNameA (pszPath="C:\\Boot\\hr-HR\\*.*") returned="*.*" [0063.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\hr-HR\\" | out: lpString1="C:\\Boot\\hr-HR\\") returned="C:\\Boot\\hr-HR\\" [0063.322] PathAddBackslashA (in: pszPath="C:\\Boot\\hr-HR\\" | out: pszPath="C:\\Boot\\hr-HR\\") returned="" [0063.322] lstrcatA (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\hr-HR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\hr-HR\\HOW TO DECRYPT FILES.txt" [0063.322] GetFileAttributesA (lpFileName="C:\\Boot\\hr-HR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hr-hr\\how to decrypt files.txt")) returned 0xffffffff [0063.322] CreateFileA (lpFileName="C:\\Boot\\hr-HR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hr-hr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.322] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.322] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.323] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.323] CloseHandle (hObject=0x208) returned 1 [0063.324] lstrcatA (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned="C:\\Boot\\hr-HR\\bootmgr.exe.mui" [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.324] lstrlenA (lpString="*.zip") returned 5 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.324] lstrlenA (lpString="*.rar") returned 5 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.324] lstrlenA (lpString="*.7z") returned 4 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.324] lstrlenA (lpString="*.tar") returned 5 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.324] lstrlenA (lpString="*.gzip") returned 6 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.324] lstrlenA (lpString="*.jpg") returned 5 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.324] lstrlenA (lpString="*.jpeg") returned 6 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.324] lstrlenA (lpString="*.psd") returned 5 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.324] lstrlenA (lpString="*.cdr") returned 5 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.324] lstrlenA (lpString="*.dwg") returned 5 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.324] lstrlenA (lpString="*.max") returned 5 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.324] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.325] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.326] PathMatchSpecA (pszFile="C:\\Boot\\hr-HR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.326] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.326] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0063.326] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0063.326] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1 [0063.326] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1 [0063.326] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.326] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU" [0063.326] FindFirstFileA (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0063.327] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.327] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0063.327] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.327] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.327] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.327] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.327] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.327] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.327] PathFindFileNameA (pszPath="C:\\Boot\\hu-HU\\*.*") returned="*.*" [0063.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\hu-HU\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\" [0063.327] PathAddBackslashA (in: pszPath="C:\\Boot\\hu-HU\\" | out: pszPath="C:\\Boot\\hu-HU\\") returned="" [0063.327] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" [0063.327] GetFileAttributesA (lpFileName="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hu-hu\\how to decrypt files.txt")) returned 0xffffffff [0063.328] CreateFileA (lpFileName="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hu-hu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.330] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.331] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.331] CloseHandle (hObject=0x208) returned 1 [0063.331] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0063.331] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.331] lstrlenA (lpString="*.zip") returned 5 [0063.331] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.331] lstrlenA (lpString="*.rar") returned 5 [0063.331] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.331] lstrlenA (lpString="*.7z") returned 4 [0063.331] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.331] lstrlenA (lpString="*.tar") returned 5 [0063.331] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.331] lstrlenA (lpString="*.gzip") returned 6 [0063.331] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.331] lstrlenA (lpString="*.jpg") returned 5 [0063.331] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.331] lstrlenA (lpString="*.jpeg") returned 6 [0063.331] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.332] lstrlenA (lpString="*.psd") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.332] lstrlenA (lpString="*.cdr") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.332] lstrlenA (lpString="*.dwg") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.332] lstrlenA (lpString="*.max") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.332] lstrlenA (lpString="*.bmp") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.332] lstrlenA (lpString="*.gif") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.332] lstrlenA (lpString="*.png") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.332] lstrlenA (lpString="*.doc") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.332] lstrlenA (lpString="*.docx") returned 6 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.332] lstrlenA (lpString="*.xls") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.332] lstrlenA (lpString="*.xlsx") returned 6 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.332] lstrlenA (lpString="*.ppt") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.332] lstrlenA (lpString="*.pptx") returned 6 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.332] lstrlenA (lpString="*.txt") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.332] lstrlenA (lpString="*.pdf") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.332] lstrlenA (lpString="*.djvu") returned 6 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.332] lstrlenA (lpString="*.htm") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.332] lstrlenA (lpString="*.html") returned 6 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.332] lstrlenA (lpString="*.mdb") returned 5 [0063.332] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.333] lstrlenA (lpString="*.cer") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.333] lstrlenA (lpString="*.p12") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.333] lstrlenA (lpString="*.pfx") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.333] lstrlenA (lpString="*.kwm") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.333] lstrlenA (lpString="*.pwm") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.333] lstrlenA (lpString="*.1cd") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.333] lstrlenA (lpString="*.md") returned 4 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.333] lstrlenA (lpString="*.mdf") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.333] lstrlenA (lpString="*.dbf") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.333] lstrlenA (lpString="*.odt") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.333] lstrlenA (lpString="*.vob") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.333] lstrlenA (lpString="*.ifo") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.333] lstrlenA (lpString="*.lnk") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.333] lstrlenA (lpString="*.torrent") returned 9 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.333] lstrlenA (lpString="*.mov") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.333] lstrlenA (lpString="*.m2v") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.333] lstrlenA (lpString="*.3gp") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.333] lstrlenA (lpString="*.mpeg") returned 6 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.333] lstrlenA (lpString="*.mpg") returned 5 [0063.333] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.334] lstrlenA (lpString="*.flv") returned 5 [0063.334] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.334] lstrlenA (lpString="*.avi") returned 5 [0063.334] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.334] lstrlenA (lpString="*.mp4") returned 5 [0063.334] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.334] lstrlenA (lpString="*.wmv") returned 5 [0063.334] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.334] lstrlenA (lpString="*.divx") returned 6 [0063.334] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.334] lstrlenA (lpString="*.mkv") returned 5 [0063.334] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.334] lstrlenA (lpString="*.mp3") returned 5 [0063.334] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.334] lstrlenA (lpString="*.wav") returned 5 [0063.334] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.334] lstrlenA (lpString="*.flac") returned 6 [0063.334] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.334] lstrlenA (lpString="*.ape") returned 5 [0063.334] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.334] lstrlenA (lpString="*.wma") returned 5 [0063.334] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.334] lstrlenA (lpString="*.ac3") returned 5 [0063.334] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.334] lstrlenA (lpString="*.doc") returned 5 [0063.334] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.334] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.334] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.334] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.334] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.334] PathFindFileNameA (pszPath="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\hu-HU\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\" [0063.334] PathAddBackslashA (in: pszPath="C:\\Boot\\hu-HU\\" | out: pszPath="C:\\Boot\\hu-HU\\") returned="" [0063.334] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" [0063.334] GetFileAttributesA (lpFileName="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hu-hu\\how to decrypt files.txt")) returned 0x20 [0063.335] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\memtest.exe.mui") returned="C:\\Boot\\hu-HU\\memtest.exe.mui" [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.335] lstrlenA (lpString="*.zip") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.335] lstrlenA (lpString="*.rar") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.335] lstrlenA (lpString="*.7z") returned 4 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.335] lstrlenA (lpString="*.tar") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.335] lstrlenA (lpString="*.gzip") returned 6 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.335] lstrlenA (lpString="*.jpg") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.335] lstrlenA (lpString="*.jpeg") returned 6 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.335] lstrlenA (lpString="*.psd") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.335] lstrlenA (lpString="*.cdr") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.335] lstrlenA (lpString="*.dwg") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.335] lstrlenA (lpString="*.max") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.335] lstrlenA (lpString="*.bmp") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.335] lstrlenA (lpString="*.gif") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.335] lstrlenA (lpString="*.png") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.335] lstrlenA (lpString="*.doc") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.335] lstrlenA (lpString="*.docx") returned 6 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.335] lstrlenA (lpString="*.xls") returned 5 [0063.335] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.336] lstrlenA (lpString="*.xlsx") returned 6 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.336] lstrlenA (lpString="*.ppt") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.336] lstrlenA (lpString="*.pptx") returned 6 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.336] lstrlenA (lpString="*.txt") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.336] lstrlenA (lpString="*.pdf") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.336] lstrlenA (lpString="*.djvu") returned 6 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.336] lstrlenA (lpString="*.htm") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.336] lstrlenA (lpString="*.html") returned 6 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.336] lstrlenA (lpString="*.mdb") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.336] lstrlenA (lpString="*.cer") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.336] lstrlenA (lpString="*.p12") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.336] lstrlenA (lpString="*.pfx") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.336] lstrlenA (lpString="*.kwm") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.336] lstrlenA (lpString="*.pwm") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.336] lstrlenA (lpString="*.1cd") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.336] lstrlenA (lpString="*.md") returned 4 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.336] lstrlenA (lpString="*.mdf") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.336] lstrlenA (lpString="*.dbf") returned 5 [0063.336] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.336] lstrlenA (lpString="*.odt") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.337] lstrlenA (lpString="*.vob") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.337] lstrlenA (lpString="*.ifo") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.337] lstrlenA (lpString="*.lnk") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.337] lstrlenA (lpString="*.torrent") returned 9 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.337] lstrlenA (lpString="*.mov") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.337] lstrlenA (lpString="*.m2v") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.337] lstrlenA (lpString="*.3gp") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.337] lstrlenA (lpString="*.mpeg") returned 6 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.337] lstrlenA (lpString="*.mpg") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.337] lstrlenA (lpString="*.flv") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.337] lstrlenA (lpString="*.avi") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.337] lstrlenA (lpString="*.mp4") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.337] lstrlenA (lpString="*.wmv") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.337] lstrlenA (lpString="*.divx") returned 6 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.337] lstrlenA (lpString="*.mkv") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.337] lstrlenA (lpString="*.mp3") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.337] lstrlenA (lpString="*.wav") returned 5 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.337] lstrlenA (lpString="*.flac") returned 6 [0063.337] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.338] lstrlenA (lpString="*.ape") returned 5 [0063.338] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.338] lstrlenA (lpString="*.wma") returned 5 [0063.338] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.338] lstrlenA (lpString="*.ac3") returned 5 [0063.338] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.338] lstrlenA (lpString="*.doc") returned 5 [0063.338] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.338] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0063.338] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0063.338] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1 [0063.338] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1 [0063.338] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.338] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT" [0063.338] lstrlenA (lpString="C:\\Boot\\it-IT") returned 13 [0063.338] FindFirstFileA (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0063.352] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.352] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.352] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.352] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.352] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.352] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.353] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.353] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.353] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.353] PathFindFileNameA (pszPath="C:\\Boot\\it-IT\\*.*") returned="*.*" [0063.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\it-IT\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\" [0063.353] PathAddBackslashA (in: pszPath="C:\\Boot\\it-IT\\" | out: pszPath="C:\\Boot\\it-IT\\") returned="" [0063.353] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" [0063.353] GetFileAttributesA (lpFileName="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\it-it\\how to decrypt files.txt")) returned 0xffffffff [0063.353] CreateFileA (lpFileName="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\it-it\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.355] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.355] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.356] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.356] CloseHandle (hObject=0x208) returned 1 [0063.356] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui" [0063.356] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.357] lstrlenA (lpString="*.zip") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.357] lstrlenA (lpString="*.rar") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.357] lstrlenA (lpString="*.7z") returned 4 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.357] lstrlenA (lpString="*.tar") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.357] lstrlenA (lpString="*.gzip") returned 6 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.357] lstrlenA (lpString="*.jpg") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.357] lstrlenA (lpString="*.jpeg") returned 6 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.357] lstrlenA (lpString="*.psd") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.357] lstrlenA (lpString="*.cdr") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.357] lstrlenA (lpString="*.dwg") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.357] lstrlenA (lpString="*.max") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.357] lstrlenA (lpString="*.bmp") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.357] lstrlenA (lpString="*.gif") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.357] lstrlenA (lpString="*.png") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.357] lstrlenA (lpString="*.doc") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.357] lstrlenA (lpString="*.docx") returned 6 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.357] lstrlenA (lpString="*.xls") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.357] lstrlenA (lpString="*.xlsx") returned 6 [0063.357] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.357] lstrlenA (lpString="*.ppt") returned 5 [0063.358] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.358] lstrlenA (lpString="*.pptx") returned 6 [0063.358] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.358] lstrlenA (lpString="*.txt") returned 5 [0063.358] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.358] lstrlenA (lpString="*.pdf") returned 5 [0063.358] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.358] lstrlenA (lpString="*.djvu") returned 6 [0063.358] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.358] lstrlenA (lpString="*.htm") returned 5 [0063.358] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.358] lstrlenA (lpString="*.html") returned 6 [0063.358] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.358] lstrlenA (lpString="*.mdb") returned 5 [0063.358] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.358] lstrlenA (lpString="*.cer") returned 5 [0063.358] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.358] lstrlenA (lpString="*.p12") returned 5 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.359] lstrlenA (lpString="*.pfx") returned 5 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.359] lstrlenA (lpString="*.kwm") returned 5 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.359] lstrlenA (lpString="*.pwm") returned 5 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.359] lstrlenA (lpString="*.1cd") returned 5 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.359] lstrlenA (lpString="*.md") returned 4 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.359] lstrlenA (lpString="*.mdf") returned 5 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.359] lstrlenA (lpString="*.dbf") returned 5 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.359] lstrlenA (lpString="*.odt") returned 5 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.359] lstrlenA (lpString="*.vob") returned 5 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.359] lstrlenA (lpString="*.ifo") returned 5 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.359] lstrlenA (lpString="*.lnk") returned 5 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.359] lstrlenA (lpString="*.torrent") returned 9 [0063.359] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.360] lstrlenA (lpString="*.mov") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.360] lstrlenA (lpString="*.m2v") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.360] lstrlenA (lpString="*.3gp") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.360] lstrlenA (lpString="*.mpeg") returned 6 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.360] lstrlenA (lpString="*.mpg") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.360] lstrlenA (lpString="*.flv") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.360] lstrlenA (lpString="*.avi") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.360] lstrlenA (lpString="*.mp4") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.360] lstrlenA (lpString="*.wmv") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.360] lstrlenA (lpString="*.divx") returned 6 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.360] lstrlenA (lpString="*.mkv") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.360] lstrlenA (lpString="*.mp3") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.360] lstrlenA (lpString="*.wav") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.360] lstrlenA (lpString="*.flac") returned 6 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.360] lstrlenA (lpString="*.ape") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.360] lstrlenA (lpString="*.wma") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.360] lstrlenA (lpString="*.ac3") returned 5 [0063.360] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.360] lstrlenA (lpString="*.doc") returned 5 [0063.360] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.360] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.361] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.361] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.361] PathFindFileNameA (pszPath="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\it-IT\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\" [0063.361] PathAddBackslashA (in: pszPath="C:\\Boot\\it-IT\\" | out: pszPath="C:\\Boot\\it-IT\\") returned="" [0063.361] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" [0063.361] GetFileAttributesA (lpFileName="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\it-it\\how to decrypt files.txt")) returned 0x20 [0063.361] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\memtest.exe.mui") returned="C:\\Boot\\it-IT\\memtest.exe.mui" [0063.361] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.361] lstrlenA (lpString="*.zip") returned 5 [0063.361] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.361] lstrlenA (lpString="*.rar") returned 5 [0063.361] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.361] lstrlenA (lpString="*.7z") returned 4 [0063.361] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.361] lstrlenA (lpString="*.tar") returned 5 [0063.361] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.361] lstrlenA (lpString="*.gzip") returned 6 [0063.361] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.361] lstrlenA (lpString="*.jpg") returned 5 [0063.361] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.361] lstrlenA (lpString="*.jpeg") returned 6 [0063.361] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.361] lstrlenA (lpString="*.psd") returned 5 [0063.361] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.361] lstrlenA (lpString="*.cdr") returned 5 [0063.361] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.361] lstrlenA (lpString="*.dwg") returned 5 [0063.361] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.361] lstrlenA (lpString="*.max") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.362] lstrlenA (lpString="*.bmp") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.362] lstrlenA (lpString="*.gif") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.362] lstrlenA (lpString="*.png") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.362] lstrlenA (lpString="*.doc") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.362] lstrlenA (lpString="*.docx") returned 6 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.362] lstrlenA (lpString="*.xls") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.362] lstrlenA (lpString="*.xlsx") returned 6 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.362] lstrlenA (lpString="*.ppt") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.362] lstrlenA (lpString="*.pptx") returned 6 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.362] lstrlenA (lpString="*.txt") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.362] lstrlenA (lpString="*.pdf") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.362] lstrlenA (lpString="*.djvu") returned 6 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.362] lstrlenA (lpString="*.htm") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.362] lstrlenA (lpString="*.html") returned 6 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.362] lstrlenA (lpString="*.mdb") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.362] lstrlenA (lpString="*.cer") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.362] lstrlenA (lpString="*.p12") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.362] lstrlenA (lpString="*.pfx") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.362] lstrlenA (lpString="*.kwm") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.363] lstrlenA (lpString="*.pwm") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.363] lstrlenA (lpString="*.1cd") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.363] lstrlenA (lpString="*.md") returned 4 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.363] lstrlenA (lpString="*.mdf") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.363] lstrlenA (lpString="*.dbf") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.363] lstrlenA (lpString="*.odt") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.363] lstrlenA (lpString="*.vob") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.363] lstrlenA (lpString="*.ifo") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.363] lstrlenA (lpString="*.lnk") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.363] lstrlenA (lpString="*.torrent") returned 9 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.363] lstrlenA (lpString="*.mov") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.363] lstrlenA (lpString="*.m2v") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.363] lstrlenA (lpString="*.3gp") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.363] lstrlenA (lpString="*.mpeg") returned 6 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.363] lstrlenA (lpString="*.mpg") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.363] lstrlenA (lpString="*.flv") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.363] lstrlenA (lpString="*.avi") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.363] lstrlenA (lpString="*.mp4") returned 5 [0063.363] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.363] lstrlenA (lpString="*.wmv") returned 5 [0063.364] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.364] lstrlenA (lpString="*.divx") returned 6 [0063.364] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.364] lstrlenA (lpString="*.mkv") returned 5 [0063.364] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.364] lstrlenA (lpString="*.mp3") returned 5 [0063.364] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.364] lstrlenA (lpString="*.wav") returned 5 [0063.364] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.364] lstrlenA (lpString="*.flac") returned 6 [0063.364] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.364] lstrlenA (lpString="*.ape") returned 5 [0063.364] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.364] lstrlenA (lpString="*.wma") returned 5 [0063.364] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.364] lstrlenA (lpString="*.ac3") returned 5 [0063.364] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.364] lstrlenA (lpString="*.doc") returned 5 [0063.364] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.364] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0063.364] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0063.364] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1 [0063.364] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1 [0063.364] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.364] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP" [0063.364] lstrlenA (lpString="C:\\Boot\\ja-JP") returned 13 [0063.364] FindFirstFileA (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0063.367] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.367] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.367] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.367] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.367] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.367] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.367] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.367] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.367] PathFindFileNameA (pszPath="C:\\Boot\\ja-JP\\*.*") returned="*.*" [0063.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ja-JP\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\" [0063.367] PathAddBackslashA (in: pszPath="C:\\Boot\\ja-JP\\" | out: pszPath="C:\\Boot\\ja-JP\\") returned="" [0063.367] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" [0063.367] GetFileAttributesA (lpFileName="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ja-jp\\how to decrypt files.txt")) returned 0xffffffff [0063.368] CreateFileA (lpFileName="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ja-jp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.370] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.370] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.370] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.371] CloseHandle (hObject=0x208) returned 1 [0063.371] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.371] lstrlenA (lpString="*.zip") returned 5 [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.371] lstrlenA (lpString="*.rar") returned 5 [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.371] lstrlenA (lpString="*.7z") returned 4 [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.371] lstrlenA (lpString="*.tar") returned 5 [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.371] lstrlenA (lpString="*.gzip") returned 6 [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.371] lstrlenA (lpString="*.jpg") returned 5 [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.371] lstrlenA (lpString="*.jpeg") returned 6 [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.371] lstrlenA (lpString="*.psd") returned 5 [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.371] lstrlenA (lpString="*.cdr") returned 5 [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.371] lstrlenA (lpString="*.dwg") returned 5 [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.371] lstrlenA (lpString="*.max") returned 5 [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.371] lstrlenA (lpString="*.bmp") returned 5 [0063.371] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.371] lstrlenA (lpString="*.gif") returned 5 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.372] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.373] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.373] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.373] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.373] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.373] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.373] PathFindFileNameA (pszPath="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ja-JP\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\" [0063.374] PathAddBackslashA (in: pszPath="C:\\Boot\\ja-JP\\" | out: pszPath="C:\\Boot\\ja-JP\\") returned="" [0063.374] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" [0063.376] GetFileAttributesA (lpFileName="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ja-jp\\how to decrypt files.txt")) returned 0x20 [0063.377] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\memtest.exe.mui") returned="C:\\Boot\\ja-JP\\memtest.exe.mui" [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.377] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.378] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.379] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.379] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.379] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.379] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.379] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.379] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.379] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.379] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.379] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.379] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.379] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.379] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.379] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0063.379] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0063.379] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1 [0063.379] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1 [0063.379] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.379] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR" [0063.379] FindFirstFileA (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0063.380] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.381] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.381] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.381] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.381] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.381] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.381] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.381] PathFindFileNameA (pszPath="C:\\Boot\\ko-KR\\*.*") returned="*.*" [0063.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ko-KR\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\" [0063.381] PathAddBackslashA (in: pszPath="C:\\Boot\\ko-KR\\" | out: pszPath="C:\\Boot\\ko-KR\\") returned="" [0063.381] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" [0063.381] GetFileAttributesA (lpFileName="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ko-kr\\how to decrypt files.txt")) returned 0xffffffff [0063.381] CreateFileA (lpFileName="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ko-kr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.383] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.384] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.384] CloseHandle (hObject=0x208) returned 1 [0063.385] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.385] lstrlenA (lpString="*.zip") returned 5 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.385] lstrlenA (lpString="*.rar") returned 5 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.385] lstrlenA (lpString="*.7z") returned 4 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.385] lstrlenA (lpString="*.tar") returned 5 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.385] lstrlenA (lpString="*.gzip") returned 6 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.385] lstrlenA (lpString="*.jpg") returned 5 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.385] lstrlenA (lpString="*.jpeg") returned 6 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.385] lstrlenA (lpString="*.psd") returned 5 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.385] lstrlenA (lpString="*.cdr") returned 5 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.385] lstrlenA (lpString="*.dwg") returned 5 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.385] lstrlenA (lpString="*.max") returned 5 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.385] lstrlenA (lpString="*.bmp") returned 5 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.385] lstrlenA (lpString="*.gif") returned 5 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.385] lstrlenA (lpString="*.png") returned 5 [0063.385] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.386] lstrlenA (lpString="*.doc") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.386] lstrlenA (lpString="*.docx") returned 6 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.386] lstrlenA (lpString="*.xls") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.386] lstrlenA (lpString="*.xlsx") returned 6 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.386] lstrlenA (lpString="*.ppt") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.386] lstrlenA (lpString="*.pptx") returned 6 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.386] lstrlenA (lpString="*.txt") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.386] lstrlenA (lpString="*.pdf") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.386] lstrlenA (lpString="*.djvu") returned 6 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.386] lstrlenA (lpString="*.htm") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.386] lstrlenA (lpString="*.html") returned 6 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.386] lstrlenA (lpString="*.mdb") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.386] lstrlenA (lpString="*.cer") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.386] lstrlenA (lpString="*.p12") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.386] lstrlenA (lpString="*.pfx") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.386] lstrlenA (lpString="*.kwm") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.386] lstrlenA (lpString="*.pwm") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.386] lstrlenA (lpString="*.1cd") returned 5 [0063.386] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.386] lstrlenA (lpString="*.md") returned 4 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.387] lstrlenA (lpString="*.mdf") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.387] lstrlenA (lpString="*.dbf") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.387] lstrlenA (lpString="*.odt") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.387] lstrlenA (lpString="*.vob") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.387] lstrlenA (lpString="*.ifo") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.387] lstrlenA (lpString="*.lnk") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.387] lstrlenA (lpString="*.torrent") returned 9 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.387] lstrlenA (lpString="*.mov") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.387] lstrlenA (lpString="*.m2v") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.387] lstrlenA (lpString="*.3gp") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.387] lstrlenA (lpString="*.mpeg") returned 6 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.387] lstrlenA (lpString="*.mpg") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.387] lstrlenA (lpString="*.flv") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.387] lstrlenA (lpString="*.avi") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.387] lstrlenA (lpString="*.mp4") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.387] lstrlenA (lpString="*.wmv") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.387] lstrlenA (lpString="*.divx") returned 6 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.387] lstrlenA (lpString="*.mkv") returned 5 [0063.387] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.388] lstrlenA (lpString="*.mp3") returned 5 [0063.388] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.388] lstrlenA (lpString="*.wav") returned 5 [0063.388] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.388] lstrlenA (lpString="*.flac") returned 6 [0063.388] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.388] lstrlenA (lpString="*.ape") returned 5 [0063.388] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.388] lstrlenA (lpString="*.wma") returned 5 [0063.388] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.388] lstrlenA (lpString="*.ac3") returned 5 [0063.388] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.388] lstrlenA (lpString="*.doc") returned 5 [0063.388] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.388] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.388] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.388] PathFindFileNameA (pszPath="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ko-KR\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\" [0063.388] PathAddBackslashA (in: pszPath="C:\\Boot\\ko-KR\\" | out: pszPath="C:\\Boot\\ko-KR\\") returned="" [0063.388] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" [0063.388] GetFileAttributesA (lpFileName="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ko-kr\\how to decrypt files.txt")) returned 0x20 [0063.388] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\memtest.exe.mui") returned="C:\\Boot\\ko-KR\\memtest.exe.mui" [0063.388] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.388] lstrlenA (lpString="*.zip") returned 5 [0063.388] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.388] lstrlenA (lpString="*.rar") returned 5 [0063.388] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.388] lstrlenA (lpString="*.7z") returned 4 [0063.388] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.388] lstrlenA (lpString="*.tar") returned 5 [0063.388] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.389] lstrlenA (lpString="*.gzip") returned 6 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.389] lstrlenA (lpString="*.jpg") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.389] lstrlenA (lpString="*.jpeg") returned 6 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.389] lstrlenA (lpString="*.psd") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.389] lstrlenA (lpString="*.cdr") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.389] lstrlenA (lpString="*.dwg") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.389] lstrlenA (lpString="*.max") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.389] lstrlenA (lpString="*.bmp") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.389] lstrlenA (lpString="*.gif") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.389] lstrlenA (lpString="*.png") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.389] lstrlenA (lpString="*.doc") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.389] lstrlenA (lpString="*.docx") returned 6 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.389] lstrlenA (lpString="*.xls") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.389] lstrlenA (lpString="*.xlsx") returned 6 [0063.391] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.391] lstrlenA (lpString="*.ppt") returned 5 [0063.391] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.391] lstrlenA (lpString="*.pptx") returned 6 [0063.391] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.391] lstrlenA (lpString="*.txt") returned 5 [0063.391] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.391] lstrlenA (lpString="*.pdf") returned 5 [0063.391] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.391] lstrlenA (lpString="*.djvu") returned 6 [0063.391] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.392] lstrlenA (lpString="*.htm") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.392] lstrlenA (lpString="*.html") returned 6 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.392] lstrlenA (lpString="*.mdb") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.392] lstrlenA (lpString="*.cer") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.392] lstrlenA (lpString="*.p12") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.392] lstrlenA (lpString="*.pfx") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.392] lstrlenA (lpString="*.kwm") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.392] lstrlenA (lpString="*.pwm") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.392] lstrlenA (lpString="*.1cd") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.392] lstrlenA (lpString="*.md") returned 4 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.392] lstrlenA (lpString="*.mdf") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.392] lstrlenA (lpString="*.dbf") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.392] lstrlenA (lpString="*.odt") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.392] lstrlenA (lpString="*.vob") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.392] lstrlenA (lpString="*.ifo") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.392] lstrlenA (lpString="*.lnk") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.392] lstrlenA (lpString="*.torrent") returned 9 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.392] lstrlenA (lpString="*.mov") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.392] lstrlenA (lpString="*.m2v") returned 5 [0063.392] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.393] lstrlenA (lpString="*.3gp") returned 5 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.393] lstrlenA (lpString="*.mpeg") returned 6 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.393] lstrlenA (lpString="*.mpg") returned 5 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.393] lstrlenA (lpString="*.flv") returned 5 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.393] lstrlenA (lpString="*.avi") returned 5 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.393] lstrlenA (lpString="*.mp4") returned 5 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.393] lstrlenA (lpString="*.wmv") returned 5 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.393] lstrlenA (lpString="*.divx") returned 6 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.393] lstrlenA (lpString="*.mkv") returned 5 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.393] lstrlenA (lpString="*.mp3") returned 5 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.393] lstrlenA (lpString="*.wav") returned 5 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.393] lstrlenA (lpString="*.flac") returned 6 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.393] lstrlenA (lpString="*.ape") returned 5 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.393] lstrlenA (lpString="*.wma") returned 5 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.393] lstrlenA (lpString="*.ac3") returned 5 [0063.393] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.393] lstrlenA (lpString="*.doc") returned 5 [0063.393] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.393] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0063.394] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0063.394] lstrcmpA (lpString1=".", lpString2="lt-LT") returned -1 [0063.394] lstrcmpA (lpString1="..", lpString2="lt-LT") returned -1 [0063.394] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.394] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="lt-LT" | out: lpString1="C:\\Boot\\lt-LT") returned="C:\\Boot\\lt-LT" [0063.394] lstrlenA (lpString="C:\\Boot\\lt-LT") returned 13 [0063.394] FindFirstFileA (in: lpFileName="C:\\Boot\\lt-LT\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ed0 [0063.394] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.394] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.394] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.394] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.394] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.394] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.394] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.394] PathFindFileNameA (pszPath="C:\\Boot\\lt-LT\\*.*") returned="*.*" [0063.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\lt-LT\\" | out: lpString1="C:\\Boot\\lt-LT\\") returned="C:\\Boot\\lt-LT\\" [0063.394] PathAddBackslashA (in: pszPath="C:\\Boot\\lt-LT\\" | out: pszPath="C:\\Boot\\lt-LT\\") returned="" [0063.394] lstrcatA (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\lt-LT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\lt-LT\\HOW TO DECRYPT FILES.txt" [0063.394] GetFileAttributesA (lpFileName="C:\\Boot\\lt-LT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\lt-lt\\how to decrypt files.txt")) returned 0xffffffff [0063.394] CreateFileA (lpFileName="C:\\Boot\\lt-LT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\lt-lt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.395] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.395] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.399] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.399] CloseHandle (hObject=0x208) returned 1 [0063.399] lstrcatA (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned="C:\\Boot\\lt-LT\\bootmgr.exe.mui" [0063.399] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.399] lstrlenA (lpString="*.zip") returned 5 [0063.399] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.399] lstrlenA (lpString="*.rar") returned 5 [0063.399] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.399] lstrlenA (lpString="*.7z") returned 4 [0063.399] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.399] lstrlenA (lpString="*.tar") returned 5 [0063.399] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.399] lstrlenA (lpString="*.gzip") returned 6 [0063.399] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.399] lstrlenA (lpString="*.jpg") returned 5 [0063.399] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.399] lstrlenA (lpString="*.jpeg") returned 6 [0063.399] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.399] lstrlenA (lpString="*.psd") returned 5 [0063.399] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.400] lstrlenA (lpString="*.cdr") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.400] lstrlenA (lpString="*.dwg") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.400] lstrlenA (lpString="*.max") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.400] lstrlenA (lpString="*.bmp") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.400] lstrlenA (lpString="*.gif") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.400] lstrlenA (lpString="*.png") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.400] lstrlenA (lpString="*.doc") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.400] lstrlenA (lpString="*.docx") returned 6 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.400] lstrlenA (lpString="*.xls") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.400] lstrlenA (lpString="*.xlsx") returned 6 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.400] lstrlenA (lpString="*.ppt") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.400] lstrlenA (lpString="*.pptx") returned 6 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.400] lstrlenA (lpString="*.txt") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.400] lstrlenA (lpString="*.pdf") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.400] lstrlenA (lpString="*.djvu") returned 6 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.400] lstrlenA (lpString="*.htm") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.400] lstrlenA (lpString="*.html") returned 6 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.400] lstrlenA (lpString="*.mdb") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.401] lstrlenA (lpString="*.cer") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.401] lstrlenA (lpString="*.p12") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.401] lstrlenA (lpString="*.pfx") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.401] lstrlenA (lpString="*.kwm") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.401] lstrlenA (lpString="*.pwm") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.401] lstrlenA (lpString="*.1cd") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.401] lstrlenA (lpString="*.md") returned 4 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.401] lstrlenA (lpString="*.mdf") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.401] lstrlenA (lpString="*.dbf") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.401] lstrlenA (lpString="*.odt") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.401] lstrlenA (lpString="*.vob") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.401] lstrlenA (lpString="*.ifo") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.401] lstrlenA (lpString="*.lnk") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.401] lstrlenA (lpString="*.torrent") returned 9 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.401] lstrlenA (lpString="*.mov") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.401] lstrlenA (lpString="*.m2v") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.401] lstrlenA (lpString="*.3gp") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.401] lstrlenA (lpString="*.mpeg") returned 6 [0063.401] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.401] lstrlenA (lpString="*.mpg") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.402] lstrlenA (lpString="*.flv") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.402] lstrlenA (lpString="*.avi") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.402] lstrlenA (lpString="*.mp4") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.402] lstrlenA (lpString="*.wmv") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.402] lstrlenA (lpString="*.divx") returned 6 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.402] lstrlenA (lpString="*.mkv") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.402] lstrlenA (lpString="*.mp3") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.402] lstrlenA (lpString="*.wav") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.402] lstrlenA (lpString="*.flac") returned 6 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.402] lstrlenA (lpString="*.ape") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.402] lstrlenA (lpString="*.wma") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.402] lstrlenA (lpString="*.ac3") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Boot\\lt-LT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.402] lstrlenA (lpString="*.doc") returned 5 [0063.402] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.402] FindClose (in: hFindFile=0x759ed0 | out: hFindFile=0x759ed0) returned 1 [0063.402] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0063.402] lstrcmpA (lpString1=".", lpString2="lv-LV") returned -1 [0063.402] lstrcmpA (lpString1="..", lpString2="lv-LV") returned -1 [0063.402] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.403] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="lv-LV" | out: lpString1="C:\\Boot\\lv-LV") returned="C:\\Boot\\lv-LV" [0063.403] lstrlenA (lpString="C:\\Boot\\lv-LV") returned 13 [0063.403] FindFirstFileA (in: lpFileName="C:\\Boot\\lv-LV\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0063.403] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.403] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0063.403] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.403] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.404] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.404] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.404] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.404] PathFindFileNameA (pszPath="C:\\Boot\\lv-LV\\*.*") returned="*.*" [0063.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\lv-LV\\" | out: lpString1="C:\\Boot\\lv-LV\\") returned="C:\\Boot\\lv-LV\\" [0063.404] PathAddBackslashA (in: pszPath="C:\\Boot\\lv-LV\\" | out: pszPath="C:\\Boot\\lv-LV\\") returned="" [0063.404] lstrcatA (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\lv-LV\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\lv-LV\\HOW TO DECRYPT FILES.txt" [0063.404] GetFileAttributesA (lpFileName="C:\\Boot\\lv-LV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\lv-lv\\how to decrypt files.txt")) returned 0xffffffff [0063.404] CreateFileA (lpFileName="C:\\Boot\\lv-LV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\lv-lv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.405] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.405] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.407] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.407] CloseHandle (hObject=0x208) returned 1 [0063.407] lstrcatA (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned="C:\\Boot\\lv-LV\\bootmgr.exe.mui" [0063.407] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.407] lstrlenA (lpString="*.zip") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.407] lstrlenA (lpString="*.rar") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.407] lstrlenA (lpString="*.7z") returned 4 [0063.407] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.407] lstrlenA (lpString="*.tar") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.407] lstrlenA (lpString="*.gzip") returned 6 [0063.407] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.407] lstrlenA (lpString="*.jpg") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.407] lstrlenA (lpString="*.jpeg") returned 6 [0063.407] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.407] lstrlenA (lpString="*.psd") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.407] lstrlenA (lpString="*.cdr") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.407] lstrlenA (lpString="*.dwg") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.408] lstrlenA (lpString="*.max") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.408] lstrlenA (lpString="*.bmp") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.408] lstrlenA (lpString="*.gif") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.408] lstrlenA (lpString="*.png") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.408] lstrlenA (lpString="*.doc") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.408] lstrlenA (lpString="*.docx") returned 6 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.408] lstrlenA (lpString="*.xls") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.408] lstrlenA (lpString="*.xlsx") returned 6 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.408] lstrlenA (lpString="*.ppt") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.408] lstrlenA (lpString="*.pptx") returned 6 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.408] lstrlenA (lpString="*.txt") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.408] lstrlenA (lpString="*.pdf") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.408] lstrlenA (lpString="*.djvu") returned 6 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.408] lstrlenA (lpString="*.htm") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.408] lstrlenA (lpString="*.html") returned 6 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.408] lstrlenA (lpString="*.mdb") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.408] lstrlenA (lpString="*.cer") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.408] lstrlenA (lpString="*.p12") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.408] lstrlenA (lpString="*.pfx") returned 5 [0063.409] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.409] lstrlenA (lpString="*.kwm") returned 5 [0063.409] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.409] lstrlenA (lpString="*.pwm") returned 5 [0063.409] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.409] lstrlenA (lpString="*.1cd") returned 5 [0063.409] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.409] lstrlenA (lpString="*.md") returned 4 [0063.409] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.409] lstrlenA (lpString="*.mdf") returned 5 [0063.409] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.409] lstrlenA (lpString="*.dbf") returned 5 [0063.409] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.410] lstrlenA (lpString="*.odt") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.410] lstrlenA (lpString="*.vob") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.410] lstrlenA (lpString="*.ifo") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.410] lstrlenA (lpString="*.lnk") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.410] lstrlenA (lpString="*.torrent") returned 9 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.410] lstrlenA (lpString="*.mov") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.410] lstrlenA (lpString="*.m2v") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.410] lstrlenA (lpString="*.3gp") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.410] lstrlenA (lpString="*.mpeg") returned 6 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.410] lstrlenA (lpString="*.mpg") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.410] lstrlenA (lpString="*.flv") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.410] lstrlenA (lpString="*.avi") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.410] lstrlenA (lpString="*.mp4") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.410] lstrlenA (lpString="*.wmv") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.410] lstrlenA (lpString="*.divx") returned 6 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.410] lstrlenA (lpString="*.mkv") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.410] lstrlenA (lpString="*.mp3") returned 5 [0063.410] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.410] lstrlenA (lpString="*.wav") returned 5 [0063.411] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.411] lstrlenA (lpString="*.flac") returned 6 [0063.411] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.411] lstrlenA (lpString="*.ape") returned 5 [0063.411] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.411] lstrlenA (lpString="*.wma") returned 5 [0063.411] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.411] lstrlenA (lpString="*.ac3") returned 5 [0063.411] PathMatchSpecA (pszFile="C:\\Boot\\lv-LV\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.411] lstrlenA (lpString="*.doc") returned 5 [0063.411] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.411] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0063.411] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0063.411] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.411] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe") returned -1 [0063.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe") returned -1 [0063.411] lstrcmpiA (lpString1="", lpString2="memtest.exe") returned -1 [0063.411] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0063.411] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0063.411] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0063.411] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0063.411] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe" [0063.411] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.zip") returned 0 [0063.411] lstrlenA (lpString="*.zip") returned 5 [0063.411] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.rar") returned 0 [0063.411] lstrlenA (lpString="*.rar") returned 5 [0063.411] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.7z") returned 0 [0063.411] lstrlenA (lpString="*.7z") returned 4 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.tar") returned 0 [0063.412] lstrlenA (lpString="*.tar") returned 5 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gzip") returned 0 [0063.412] lstrlenA (lpString="*.gzip") returned 6 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpg") returned 0 [0063.412] lstrlenA (lpString="*.jpg") returned 5 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpeg") returned 0 [0063.412] lstrlenA (lpString="*.jpeg") returned 6 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.psd") returned 0 [0063.412] lstrlenA (lpString="*.psd") returned 5 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cdr") returned 0 [0063.412] lstrlenA (lpString="*.cdr") returned 5 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dwg") returned 0 [0063.412] lstrlenA (lpString="*.dwg") returned 5 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.max") returned 0 [0063.412] lstrlenA (lpString="*.max") returned 5 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.bmp") returned 0 [0063.412] lstrlenA (lpString="*.bmp") returned 5 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gif") returned 0 [0063.412] lstrlenA (lpString="*.gif") returned 5 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.png") returned 0 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.doc") returned 0 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.docx") returned 0 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xls") returned 0 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xlsx") returned 0 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ppt") returned 0 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pptx") returned 0 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.txt") returned 0 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pdf") returned 0 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.djvu") returned 0 [0063.412] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.htm") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.html") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mdb") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cer") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.p12") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pfx") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.kwm") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pwm") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.1cd") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.md") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mdf") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dbf") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.odt") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vob") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ifo") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.lnk") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.torrent") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mov") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.m2v") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.3gp") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpeg") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpg") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flv") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.avi") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp4") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wmv") returned 0 [0063.413] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.divx") returned 0 [0063.414] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mkv") returned 0 [0063.414] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp3") returned 0 [0063.414] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wav") returned 0 [0063.414] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flac") returned 0 [0063.414] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ape") returned 0 [0063.414] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wma") returned 0 [0063.414] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ac3") returned 0 [0063.414] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.doc") returned 0 [0063.414] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0063.414] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1 [0063.414] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1 [0063.414] PathFindFileNameA (pszPath="C:\\Boot\\memtest.exe") returned="memtest.exe" [0063.414] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO" [0063.414] FindFirstFileA (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x58, cFileName=".", cAlternateFileName="")) returned 0x75a010 [0063.415] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.415] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x58, cFileName="..", cAlternateFileName="")) returned 1 [0063.415] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.415] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.415] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x740000, dwReserved1=0x58, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.415] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.415] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.415] PathFindFileNameA (pszPath="C:\\Boot\\nb-NO\\*.*") returned="*.*" [0063.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nb-NO\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\" [0063.415] PathAddBackslashA (in: pszPath="C:\\Boot\\nb-NO\\" | out: pszPath="C:\\Boot\\nb-NO\\") returned="" [0063.415] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" [0063.415] GetFileAttributesA (lpFileName="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nb-no\\how to decrypt files.txt")) returned 0xffffffff [0063.415] CreateFileA (lpFileName="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nb-no\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.417] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.418] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.418] CloseHandle (hObject=0x208) returned 1 [0063.419] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.419] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.420] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.422] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.422] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.422] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.422] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.422] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.422] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.422] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.422] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.422] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.422] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.422] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.422] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.422] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.422] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.422] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.422] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.422] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.422] PathFindFileNameA (pszPath="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nb-NO\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\" [0063.422] PathAddBackslashA (in: pszPath="C:\\Boot\\nb-NO\\" | out: pszPath="C:\\Boot\\nb-NO\\") returned="" [0063.422] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" [0063.422] GetFileAttributesA (lpFileName="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nb-no\\how to decrypt files.txt")) returned 0x20 [0063.422] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\memtest.exe.mui") returned="C:\\Boot\\nb-NO\\memtest.exe.mui" [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.423] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.424] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.425] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.425] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.425] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.425] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.425] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.425] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.425] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.425] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.425] FindClose (in: hFindFile=0x75a010 | out: hFindFile=0x75a010) returned 1 [0063.425] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0063.425] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1 [0063.425] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1 [0063.425] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.425] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL" [0063.425] lstrlenA (lpString="C:\\Boot\\nl-NL") returned 13 [0063.425] FindFirstFileA (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0063.425] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.425] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.426] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.426] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.426] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.426] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.426] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.426] PathFindFileNameA (pszPath="C:\\Boot\\nl-NL\\*.*") returned="*.*" [0063.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nl-NL\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\" [0063.426] PathAddBackslashA (in: pszPath="C:\\Boot\\nl-NL\\" | out: pszPath="C:\\Boot\\nl-NL\\") returned="" [0063.426] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" [0063.426] GetFileAttributesA (lpFileName="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nl-nl\\how to decrypt files.txt")) returned 0xffffffff [0063.426] CreateFileA (lpFileName="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nl-nl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.428] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.428] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.429] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.429] CloseHandle (hObject=0x208) returned 1 [0063.429] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0063.429] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.429] lstrlenA (lpString="*.zip") returned 5 [0063.429] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.429] lstrlenA (lpString="*.rar") returned 5 [0063.429] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.429] lstrlenA (lpString="*.7z") returned 4 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.430] lstrlenA (lpString="*.tar") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.430] lstrlenA (lpString="*.gzip") returned 6 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.430] lstrlenA (lpString="*.jpg") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.430] lstrlenA (lpString="*.jpeg") returned 6 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.430] lstrlenA (lpString="*.psd") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.430] lstrlenA (lpString="*.cdr") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.430] lstrlenA (lpString="*.dwg") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.430] lstrlenA (lpString="*.max") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.430] lstrlenA (lpString="*.bmp") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.430] lstrlenA (lpString="*.gif") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.430] lstrlenA (lpString="*.png") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.430] lstrlenA (lpString="*.doc") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.430] lstrlenA (lpString="*.docx") returned 6 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.430] lstrlenA (lpString="*.xls") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.430] lstrlenA (lpString="*.xlsx") returned 6 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.430] lstrlenA (lpString="*.ppt") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.430] lstrlenA (lpString="*.pptx") returned 6 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.430] lstrlenA (lpString="*.txt") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.431] lstrlenA (lpString="*.pdf") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.431] lstrlenA (lpString="*.djvu") returned 6 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.431] lstrlenA (lpString="*.htm") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.431] lstrlenA (lpString="*.html") returned 6 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.431] lstrlenA (lpString="*.mdb") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.431] lstrlenA (lpString="*.cer") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.431] lstrlenA (lpString="*.p12") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.431] lstrlenA (lpString="*.pfx") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.431] lstrlenA (lpString="*.kwm") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.431] lstrlenA (lpString="*.pwm") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.431] lstrlenA (lpString="*.1cd") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.431] lstrlenA (lpString="*.md") returned 4 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.431] lstrlenA (lpString="*.mdf") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.431] lstrlenA (lpString="*.dbf") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.431] lstrlenA (lpString="*.odt") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.431] lstrlenA (lpString="*.vob") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.431] lstrlenA (lpString="*.ifo") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.431] lstrlenA (lpString="*.lnk") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.431] lstrlenA (lpString="*.torrent") returned 9 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.432] lstrlenA (lpString="*.mov") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.432] lstrlenA (lpString="*.m2v") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.432] lstrlenA (lpString="*.3gp") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.432] lstrlenA (lpString="*.mpeg") returned 6 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.432] lstrlenA (lpString="*.mpg") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.432] lstrlenA (lpString="*.flv") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.432] lstrlenA (lpString="*.avi") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.432] lstrlenA (lpString="*.mp4") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.432] lstrlenA (lpString="*.wmv") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.432] lstrlenA (lpString="*.divx") returned 6 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.432] lstrlenA (lpString="*.mkv") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.432] lstrlenA (lpString="*.mp3") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.432] lstrlenA (lpString="*.wav") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.432] lstrlenA (lpString="*.flac") returned 6 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.432] lstrlenA (lpString="*.ape") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.432] lstrlenA (lpString="*.wma") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.432] lstrlenA (lpString="*.ac3") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.432] lstrlenA (lpString="*.doc") returned 5 [0063.432] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.433] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.433] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.433] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.433] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.433] PathFindFileNameA (pszPath="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nl-NL\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\" [0063.433] PathAddBackslashA (in: pszPath="C:\\Boot\\nl-NL\\" | out: pszPath="C:\\Boot\\nl-NL\\") returned="" [0063.433] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" [0063.433] GetFileAttributesA (lpFileName="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nl-nl\\how to decrypt files.txt")) returned 0x20 [0063.433] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\memtest.exe.mui") returned="C:\\Boot\\nl-NL\\memtest.exe.mui" [0063.433] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.433] lstrlenA (lpString="*.zip") returned 5 [0063.433] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.433] lstrlenA (lpString="*.rar") returned 5 [0063.433] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.433] lstrlenA (lpString="*.7z") returned 4 [0063.433] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.433] lstrlenA (lpString="*.tar") returned 5 [0063.433] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.433] lstrlenA (lpString="*.gzip") returned 6 [0063.433] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.433] lstrlenA (lpString="*.jpg") returned 5 [0063.433] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.433] lstrlenA (lpString="*.jpeg") returned 6 [0063.433] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.433] lstrlenA (lpString="*.psd") returned 5 [0063.433] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.433] lstrlenA (lpString="*.cdr") returned 5 [0063.433] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.433] lstrlenA (lpString="*.dwg") returned 5 [0063.433] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.433] lstrlenA (lpString="*.max") returned 5 [0063.433] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.434] lstrlenA (lpString="*.bmp") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.434] lstrlenA (lpString="*.gif") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.434] lstrlenA (lpString="*.png") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.434] lstrlenA (lpString="*.doc") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.434] lstrlenA (lpString="*.docx") returned 6 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.434] lstrlenA (lpString="*.xls") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.434] lstrlenA (lpString="*.xlsx") returned 6 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.434] lstrlenA (lpString="*.ppt") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.434] lstrlenA (lpString="*.pptx") returned 6 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.434] lstrlenA (lpString="*.txt") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.434] lstrlenA (lpString="*.pdf") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.434] lstrlenA (lpString="*.djvu") returned 6 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.434] lstrlenA (lpString="*.htm") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.434] lstrlenA (lpString="*.html") returned 6 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.434] lstrlenA (lpString="*.mdb") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.434] lstrlenA (lpString="*.cer") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.434] lstrlenA (lpString="*.p12") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.434] lstrlenA (lpString="*.pfx") returned 5 [0063.434] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.434] lstrlenA (lpString="*.kwm") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.435] lstrlenA (lpString="*.pwm") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.435] lstrlenA (lpString="*.1cd") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.435] lstrlenA (lpString="*.md") returned 4 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.435] lstrlenA (lpString="*.mdf") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.435] lstrlenA (lpString="*.dbf") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.435] lstrlenA (lpString="*.odt") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.435] lstrlenA (lpString="*.vob") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.435] lstrlenA (lpString="*.ifo") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.435] lstrlenA (lpString="*.lnk") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.435] lstrlenA (lpString="*.torrent") returned 9 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.435] lstrlenA (lpString="*.mov") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.435] lstrlenA (lpString="*.m2v") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.435] lstrlenA (lpString="*.3gp") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.435] lstrlenA (lpString="*.mpeg") returned 6 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.435] lstrlenA (lpString="*.mpg") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.435] lstrlenA (lpString="*.flv") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.435] lstrlenA (lpString="*.avi") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.435] lstrlenA (lpString="*.mp4") returned 5 [0063.435] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.436] lstrlenA (lpString="*.wmv") returned 5 [0063.436] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.436] lstrlenA (lpString="*.divx") returned 6 [0063.436] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.436] lstrlenA (lpString="*.mkv") returned 5 [0063.436] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.436] lstrlenA (lpString="*.mp3") returned 5 [0063.436] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.436] lstrlenA (lpString="*.wav") returned 5 [0063.436] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.436] lstrlenA (lpString="*.flac") returned 6 [0063.436] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.436] lstrlenA (lpString="*.ape") returned 5 [0063.436] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.436] lstrlenA (lpString="*.wma") returned 5 [0063.436] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.436] lstrlenA (lpString="*.ac3") returned 5 [0063.436] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.436] lstrlenA (lpString="*.doc") returned 5 [0063.436] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.438] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0063.438] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0063.438] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1 [0063.438] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1 [0063.438] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.438] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL" [0063.438] lstrlenA (lpString="C:\\Boot\\pl-PL") returned 13 [0063.438] FindFirstFileA (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d90 [0063.439] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.439] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.439] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.439] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.439] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.439] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.439] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.439] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.439] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.439] PathFindFileNameA (pszPath="C:\\Boot\\pl-PL\\*.*") returned="*.*" [0063.440] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pl-PL\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\" [0063.440] PathAddBackslashA (in: pszPath="C:\\Boot\\pl-PL\\" | out: pszPath="C:\\Boot\\pl-PL\\") returned="" [0063.440] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" [0063.440] GetFileAttributesA (lpFileName="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pl-pl\\how to decrypt files.txt")) returned 0xffffffff [0063.440] CreateFileA (lpFileName="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pl-pl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.442] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.442] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.443] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.443] CloseHandle (hObject=0x208) returned 1 [0063.443] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0063.443] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.443] lstrlenA (lpString="*.zip") returned 5 [0063.443] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.443] lstrlenA (lpString="*.rar") returned 5 [0063.443] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.443] lstrlenA (lpString="*.7z") returned 4 [0063.443] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.443] lstrlenA (lpString="*.tar") returned 5 [0063.443] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.443] lstrlenA (lpString="*.gzip") returned 6 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.444] lstrlenA (lpString="*.jpg") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.444] lstrlenA (lpString="*.jpeg") returned 6 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.444] lstrlenA (lpString="*.psd") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.444] lstrlenA (lpString="*.cdr") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.444] lstrlenA (lpString="*.dwg") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.444] lstrlenA (lpString="*.max") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.444] lstrlenA (lpString="*.bmp") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.444] lstrlenA (lpString="*.gif") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.444] lstrlenA (lpString="*.png") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.444] lstrlenA (lpString="*.doc") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.444] lstrlenA (lpString="*.docx") returned 6 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.444] lstrlenA (lpString="*.xls") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.444] lstrlenA (lpString="*.xlsx") returned 6 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.444] lstrlenA (lpString="*.ppt") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.444] lstrlenA (lpString="*.pptx") returned 6 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.444] lstrlenA (lpString="*.txt") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.444] lstrlenA (lpString="*.pdf") returned 5 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.444] lstrlenA (lpString="*.djvu") returned 6 [0063.444] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.445] lstrlenA (lpString="*.htm") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.445] lstrlenA (lpString="*.html") returned 6 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.445] lstrlenA (lpString="*.mdb") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.445] lstrlenA (lpString="*.cer") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.445] lstrlenA (lpString="*.p12") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.445] lstrlenA (lpString="*.pfx") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.445] lstrlenA (lpString="*.kwm") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.445] lstrlenA (lpString="*.pwm") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.445] lstrlenA (lpString="*.1cd") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.445] lstrlenA (lpString="*.md") returned 4 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.445] lstrlenA (lpString="*.mdf") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.445] lstrlenA (lpString="*.dbf") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.445] lstrlenA (lpString="*.odt") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.445] lstrlenA (lpString="*.vob") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.445] lstrlenA (lpString="*.ifo") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.445] lstrlenA (lpString="*.lnk") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.445] lstrlenA (lpString="*.torrent") returned 9 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.445] lstrlenA (lpString="*.mov") returned 5 [0063.445] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.446] lstrlenA (lpString="*.m2v") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.446] lstrlenA (lpString="*.3gp") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.446] lstrlenA (lpString="*.mpeg") returned 6 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.446] lstrlenA (lpString="*.mpg") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.446] lstrlenA (lpString="*.flv") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.446] lstrlenA (lpString="*.avi") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.446] lstrlenA (lpString="*.mp4") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.446] lstrlenA (lpString="*.wmv") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.446] lstrlenA (lpString="*.divx") returned 6 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.446] lstrlenA (lpString="*.mkv") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.446] lstrlenA (lpString="*.mp3") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.446] lstrlenA (lpString="*.wav") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.446] lstrlenA (lpString="*.flac") returned 6 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.446] lstrlenA (lpString="*.ape") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.446] lstrlenA (lpString="*.wma") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.446] lstrlenA (lpString="*.ac3") returned 5 [0063.446] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.446] lstrlenA (lpString="*.doc") returned 5 [0063.446] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.446] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.446] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.446] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.447] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.447] PathFindFileNameA (pszPath="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pl-PL\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\" [0063.447] PathAddBackslashA (in: pszPath="C:\\Boot\\pl-PL\\" | out: pszPath="C:\\Boot\\pl-PL\\") returned="" [0063.447] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" [0063.447] GetFileAttributesA (lpFileName="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pl-pl\\how to decrypt files.txt")) returned 0x20 [0063.447] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\memtest.exe.mui") returned="C:\\Boot\\pl-PL\\memtest.exe.mui" [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.447] lstrlenA (lpString="*.zip") returned 5 [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.447] lstrlenA (lpString="*.rar") returned 5 [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.447] lstrlenA (lpString="*.7z") returned 4 [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.447] lstrlenA (lpString="*.tar") returned 5 [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.447] lstrlenA (lpString="*.gzip") returned 6 [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.447] lstrlenA (lpString="*.jpg") returned 5 [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.447] lstrlenA (lpString="*.jpeg") returned 6 [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.447] lstrlenA (lpString="*.psd") returned 5 [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.447] lstrlenA (lpString="*.cdr") returned 5 [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.447] lstrlenA (lpString="*.dwg") returned 5 [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.447] lstrlenA (lpString="*.max") returned 5 [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.447] lstrlenA (lpString="*.bmp") returned 5 [0063.447] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.447] lstrlenA (lpString="*.gif") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.448] lstrlenA (lpString="*.png") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.448] lstrlenA (lpString="*.doc") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.448] lstrlenA (lpString="*.docx") returned 6 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.448] lstrlenA (lpString="*.xls") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.448] lstrlenA (lpString="*.xlsx") returned 6 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.448] lstrlenA (lpString="*.ppt") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.448] lstrlenA (lpString="*.pptx") returned 6 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.448] lstrlenA (lpString="*.txt") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.448] lstrlenA (lpString="*.pdf") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.448] lstrlenA (lpString="*.djvu") returned 6 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.448] lstrlenA (lpString="*.htm") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.448] lstrlenA (lpString="*.html") returned 6 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.448] lstrlenA (lpString="*.mdb") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.448] lstrlenA (lpString="*.cer") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.448] lstrlenA (lpString="*.p12") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.448] lstrlenA (lpString="*.pfx") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.448] lstrlenA (lpString="*.kwm") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.448] lstrlenA (lpString="*.pwm") returned 5 [0063.448] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.448] lstrlenA (lpString="*.1cd") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.449] lstrlenA (lpString="*.md") returned 4 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.449] lstrlenA (lpString="*.mdf") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.449] lstrlenA (lpString="*.dbf") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.449] lstrlenA (lpString="*.odt") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.449] lstrlenA (lpString="*.vob") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.449] lstrlenA (lpString="*.ifo") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.449] lstrlenA (lpString="*.lnk") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.449] lstrlenA (lpString="*.torrent") returned 9 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.449] lstrlenA (lpString="*.mov") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.449] lstrlenA (lpString="*.m2v") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.449] lstrlenA (lpString="*.3gp") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.449] lstrlenA (lpString="*.mpeg") returned 6 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.449] lstrlenA (lpString="*.mpg") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.449] lstrlenA (lpString="*.flv") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.449] lstrlenA (lpString="*.avi") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.449] lstrlenA (lpString="*.mp4") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.449] lstrlenA (lpString="*.wmv") returned 5 [0063.449] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.450] lstrlenA (lpString="*.divx") returned 6 [0063.450] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.450] lstrlenA (lpString="*.mkv") returned 5 [0063.450] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.450] lstrlenA (lpString="*.mp3") returned 5 [0063.450] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.450] lstrlenA (lpString="*.wav") returned 5 [0063.450] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.450] lstrlenA (lpString="*.flac") returned 6 [0063.450] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.450] lstrlenA (lpString="*.ape") returned 5 [0063.450] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.450] lstrlenA (lpString="*.wma") returned 5 [0063.450] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.450] lstrlenA (lpString="*.ac3") returned 5 [0063.450] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.450] lstrlenA (lpString="*.doc") returned 5 [0063.450] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.450] FindClose (in: hFindFile=0x759d90 | out: hFindFile=0x759d90) returned 1 [0063.450] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0063.450] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1 [0063.450] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1 [0063.450] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.450] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR" [0063.450] lstrlenA (lpString="C:\\Boot\\pt-BR") returned 13 [0063.450] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0063.451] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.451] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.451] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.451] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.452] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.452] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.452] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.452] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.452] PathFindFileNameA (pszPath="C:\\Boot\\pt-BR\\*.*") returned="*.*" [0063.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-BR\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\" [0063.452] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-BR\\" | out: pszPath="C:\\Boot\\pt-BR\\") returned="" [0063.452] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" [0063.452] GetFileAttributesA (lpFileName="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-br\\how to decrypt files.txt")) returned 0xffffffff [0063.452] CreateFileA (lpFileName="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-br\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.455] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.456] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.457] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.457] CloseHandle (hObject=0x208) returned 1 [0063.457] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0063.457] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.457] lstrlenA (lpString="*.zip") returned 5 [0063.457] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.457] lstrlenA (lpString="*.rar") returned 5 [0063.457] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.457] lstrlenA (lpString="*.7z") returned 4 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.458] lstrlenA (lpString="*.tar") returned 5 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.458] lstrlenA (lpString="*.gzip") returned 6 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.458] lstrlenA (lpString="*.jpg") returned 5 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.458] lstrlenA (lpString="*.jpeg") returned 6 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.458] lstrlenA (lpString="*.psd") returned 5 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.458] lstrlenA (lpString="*.cdr") returned 5 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.458] lstrlenA (lpString="*.dwg") returned 5 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.458] lstrlenA (lpString="*.max") returned 5 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.458] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.459] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.460] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.460] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.460] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.460] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.460] PathFindFileNameA (pszPath="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-BR\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\" [0063.460] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-BR\\" | out: pszPath="C:\\Boot\\pt-BR\\") returned="" [0063.460] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" [0063.460] GetFileAttributesA (lpFileName="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-br\\how to decrypt files.txt")) returned 0x20 [0063.460] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\memtest.exe.mui") returned="C:\\Boot\\pt-BR\\memtest.exe.mui" [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.460] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.461] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.462] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.463] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.463] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.463] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.463] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.463] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.463] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.463] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.463] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.463] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0063.463] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0063.463] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1 [0063.463] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1 [0063.463] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.463] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT" [0063.463] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0063.464] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.464] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.464] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.464] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.464] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.464] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.464] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.464] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.464] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.464] PathFindFileNameA (pszPath="C:\\Boot\\pt-PT\\*.*") returned="*.*" [0063.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-PT\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\" [0063.464] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-PT\\" | out: pszPath="C:\\Boot\\pt-PT\\") returned="" [0063.464] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" [0063.465] GetFileAttributesA (lpFileName="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-pt\\how to decrypt files.txt")) returned 0xffffffff [0063.465] CreateFileA (lpFileName="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-pt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.467] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.468] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.468] CloseHandle (hObject=0x208) returned 1 [0063.468] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0063.468] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.468] lstrlenA (lpString="*.zip") returned 5 [0063.468] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.468] lstrlenA (lpString="*.rar") returned 5 [0063.468] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.468] lstrlenA (lpString="*.7z") returned 4 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.469] lstrlenA (lpString="*.tar") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.469] lstrlenA (lpString="*.gzip") returned 6 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.469] lstrlenA (lpString="*.jpg") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.469] lstrlenA (lpString="*.jpeg") returned 6 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.469] lstrlenA (lpString="*.psd") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.469] lstrlenA (lpString="*.cdr") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.469] lstrlenA (lpString="*.dwg") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.469] lstrlenA (lpString="*.max") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.469] lstrlenA (lpString="*.bmp") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.469] lstrlenA (lpString="*.gif") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.469] lstrlenA (lpString="*.png") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.469] lstrlenA (lpString="*.doc") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.469] lstrlenA (lpString="*.docx") returned 6 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.469] lstrlenA (lpString="*.xls") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.469] lstrlenA (lpString="*.xlsx") returned 6 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.469] lstrlenA (lpString="*.ppt") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.469] lstrlenA (lpString="*.pptx") returned 6 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.469] lstrlenA (lpString="*.txt") returned 5 [0063.469] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.470] lstrlenA (lpString="*.pdf") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.470] lstrlenA (lpString="*.djvu") returned 6 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.470] lstrlenA (lpString="*.htm") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.470] lstrlenA (lpString="*.html") returned 6 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.470] lstrlenA (lpString="*.mdb") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.470] lstrlenA (lpString="*.cer") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.470] lstrlenA (lpString="*.p12") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.470] lstrlenA (lpString="*.pfx") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.470] lstrlenA (lpString="*.kwm") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.470] lstrlenA (lpString="*.pwm") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.470] lstrlenA (lpString="*.1cd") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.470] lstrlenA (lpString="*.md") returned 4 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.470] lstrlenA (lpString="*.mdf") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.470] lstrlenA (lpString="*.dbf") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.470] lstrlenA (lpString="*.odt") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.470] lstrlenA (lpString="*.vob") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.470] lstrlenA (lpString="*.ifo") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.470] lstrlenA (lpString="*.lnk") returned 5 [0063.470] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.470] lstrlenA (lpString="*.torrent") returned 9 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.471] lstrlenA (lpString="*.mov") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.471] lstrlenA (lpString="*.m2v") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.471] lstrlenA (lpString="*.3gp") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.471] lstrlenA (lpString="*.mpeg") returned 6 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.471] lstrlenA (lpString="*.mpg") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.471] lstrlenA (lpString="*.flv") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.471] lstrlenA (lpString="*.avi") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.471] lstrlenA (lpString="*.mp4") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.471] lstrlenA (lpString="*.wmv") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.471] lstrlenA (lpString="*.divx") returned 6 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.471] lstrlenA (lpString="*.mkv") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.471] lstrlenA (lpString="*.mp3") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.471] lstrlenA (lpString="*.wav") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.471] lstrlenA (lpString="*.flac") returned 6 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.471] lstrlenA (lpString="*.ape") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.471] lstrlenA (lpString="*.wma") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.471] lstrlenA (lpString="*.ac3") returned 5 [0063.471] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.471] lstrlenA (lpString="*.doc") returned 5 [0063.471] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.472] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.472] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.472] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.472] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.472] PathFindFileNameA (pszPath="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.472] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-PT\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\" [0063.472] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-PT\\" | out: pszPath="C:\\Boot\\pt-PT\\") returned="" [0063.472] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" [0063.472] GetFileAttributesA (lpFileName="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-pt\\how to decrypt files.txt")) returned 0x20 [0063.472] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\memtest.exe.mui") returned="C:\\Boot\\pt-PT\\memtest.exe.mui" [0063.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.472] lstrlenA (lpString="*.zip") returned 5 [0063.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.472] lstrlenA (lpString="*.rar") returned 5 [0063.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.472] lstrlenA (lpString="*.7z") returned 4 [0063.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.472] lstrlenA (lpString="*.tar") returned 5 [0063.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.472] lstrlenA (lpString="*.gzip") returned 6 [0063.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.472] lstrlenA (lpString="*.jpg") returned 5 [0063.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.472] lstrlenA (lpString="*.jpeg") returned 6 [0063.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.472] lstrlenA (lpString="*.psd") returned 5 [0063.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.472] lstrlenA (lpString="*.cdr") returned 5 [0063.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.472] lstrlenA (lpString="*.dwg") returned 5 [0063.472] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.472] lstrlenA (lpString="*.max") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.473] lstrlenA (lpString="*.bmp") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.473] lstrlenA (lpString="*.gif") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.473] lstrlenA (lpString="*.png") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.473] lstrlenA (lpString="*.doc") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.473] lstrlenA (lpString="*.docx") returned 6 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.473] lstrlenA (lpString="*.xls") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.473] lstrlenA (lpString="*.xlsx") returned 6 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.473] lstrlenA (lpString="*.ppt") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.473] lstrlenA (lpString="*.pptx") returned 6 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.473] lstrlenA (lpString="*.txt") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.473] lstrlenA (lpString="*.pdf") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.473] lstrlenA (lpString="*.djvu") returned 6 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.473] lstrlenA (lpString="*.htm") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.473] lstrlenA (lpString="*.html") returned 6 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.473] lstrlenA (lpString="*.mdb") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.473] lstrlenA (lpString="*.cer") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.473] lstrlenA (lpString="*.p12") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.473] lstrlenA (lpString="*.pfx") returned 5 [0063.473] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.474] lstrlenA (lpString="*.kwm") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.474] lstrlenA (lpString="*.pwm") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.474] lstrlenA (lpString="*.1cd") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.474] lstrlenA (lpString="*.md") returned 4 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.474] lstrlenA (lpString="*.mdf") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.474] lstrlenA (lpString="*.dbf") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.474] lstrlenA (lpString="*.odt") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.474] lstrlenA (lpString="*.vob") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.474] lstrlenA (lpString="*.ifo") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.474] lstrlenA (lpString="*.lnk") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.474] lstrlenA (lpString="*.torrent") returned 9 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.474] lstrlenA (lpString="*.mov") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.474] lstrlenA (lpString="*.m2v") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.474] lstrlenA (lpString="*.3gp") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.474] lstrlenA (lpString="*.mpeg") returned 6 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.474] lstrlenA (lpString="*.mpg") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.474] lstrlenA (lpString="*.flv") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.474] lstrlenA (lpString="*.avi") returned 5 [0063.474] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.474] lstrlenA (lpString="*.mp4") returned 5 [0063.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.475] lstrlenA (lpString="*.wmv") returned 5 [0063.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.475] lstrlenA (lpString="*.divx") returned 6 [0063.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.475] lstrlenA (lpString="*.mkv") returned 5 [0063.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.475] lstrlenA (lpString="*.mp3") returned 5 [0063.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.475] lstrlenA (lpString="*.wav") returned 5 [0063.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.475] lstrlenA (lpString="*.flac") returned 6 [0063.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.475] lstrlenA (lpString="*.ape") returned 5 [0063.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.475] lstrlenA (lpString="*.wma") returned 5 [0063.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.475] lstrlenA (lpString="*.ac3") returned 5 [0063.475] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.475] lstrlenA (lpString="*.doc") returned 5 [0063.475] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.475] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0063.475] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0063.475] lstrcmpA (lpString1=".", lpString2="qps-ploc") returned -1 [0063.475] lstrcmpA (lpString1="..", lpString2="qps-ploc") returned -1 [0063.475] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.475] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="qps-ploc" | out: lpString1="C:\\Boot\\qps-ploc") returned="C:\\Boot\\qps-ploc" [0063.475] lstrlenA (lpString="C:\\Boot\\qps-ploc") returned 16 [0063.475] FindFirstFileA (in: lpFileName="C:\\Boot\\qps-ploc\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0063.476] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.476] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.476] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.476] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.476] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.476] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.476] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.476] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.476] PathFindFileNameA (pszPath="C:\\Boot\\qps-ploc\\*.*") returned="*.*" [0063.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\qps-ploc\\" | out: lpString1="C:\\Boot\\qps-ploc\\") returned="C:\\Boot\\qps-ploc\\" [0063.476] PathAddBackslashA (in: pszPath="C:\\Boot\\qps-ploc\\" | out: pszPath="C:\\Boot\\qps-ploc\\") returned="" [0063.476] lstrcatA (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt" [0063.476] GetFileAttributesA (lpFileName="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\qps-ploc\\how to decrypt files.txt")) returned 0xffffffff [0063.476] CreateFileA (lpFileName="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\qps-ploc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.500] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.500] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.501] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.501] CloseHandle (hObject=0x208) returned 1 [0063.501] lstrcatA (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned="C:\\Boot\\qps-ploc\\bootmgr.exe.mui" [0063.501] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.501] lstrlenA (lpString="*.zip") returned 5 [0063.501] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.501] lstrlenA (lpString="*.rar") returned 5 [0063.501] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.501] lstrlenA (lpString="*.7z") returned 4 [0063.501] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.501] lstrlenA (lpString="*.tar") returned 5 [0063.501] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.501] lstrlenA (lpString="*.gzip") returned 6 [0063.501] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.501] lstrlenA (lpString="*.jpg") returned 5 [0063.501] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.501] lstrlenA (lpString="*.jpeg") returned 6 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.502] lstrlenA (lpString="*.psd") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.502] lstrlenA (lpString="*.cdr") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.502] lstrlenA (lpString="*.dwg") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.502] lstrlenA (lpString="*.max") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.502] lstrlenA (lpString="*.bmp") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.502] lstrlenA (lpString="*.gif") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.502] lstrlenA (lpString="*.png") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.502] lstrlenA (lpString="*.doc") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.502] lstrlenA (lpString="*.docx") returned 6 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.502] lstrlenA (lpString="*.xls") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.502] lstrlenA (lpString="*.xlsx") returned 6 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.502] lstrlenA (lpString="*.ppt") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.502] lstrlenA (lpString="*.pptx") returned 6 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.502] lstrlenA (lpString="*.txt") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.502] lstrlenA (lpString="*.pdf") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.502] lstrlenA (lpString="*.djvu") returned 6 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.502] lstrlenA (lpString="*.htm") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.502] lstrlenA (lpString="*.html") returned 6 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.503] lstrlenA (lpString="*.mdb") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.503] lstrlenA (lpString="*.cer") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.503] lstrlenA (lpString="*.p12") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.503] lstrlenA (lpString="*.pfx") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.503] lstrlenA (lpString="*.kwm") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.503] lstrlenA (lpString="*.pwm") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.503] lstrlenA (lpString="*.1cd") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.503] lstrlenA (lpString="*.md") returned 4 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.503] lstrlenA (lpString="*.mdf") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.503] lstrlenA (lpString="*.dbf") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.503] lstrlenA (lpString="*.odt") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.503] lstrlenA (lpString="*.vob") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.503] lstrlenA (lpString="*.ifo") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.503] lstrlenA (lpString="*.lnk") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.503] lstrlenA (lpString="*.torrent") returned 9 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.503] lstrlenA (lpString="*.mov") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.503] lstrlenA (lpString="*.m2v") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.503] lstrlenA (lpString="*.3gp") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.503] lstrlenA (lpString="*.mpeg") returned 6 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.504] lstrlenA (lpString="*.mpg") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.504] lstrlenA (lpString="*.flv") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.504] lstrlenA (lpString="*.avi") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.504] lstrlenA (lpString="*.mp4") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.504] lstrlenA (lpString="*.wmv") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.504] lstrlenA (lpString="*.divx") returned 6 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.504] lstrlenA (lpString="*.mkv") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.504] lstrlenA (lpString="*.mp3") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.504] lstrlenA (lpString="*.wav") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.504] lstrlenA (lpString="*.flac") returned 6 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.504] lstrlenA (lpString="*.ape") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.504] lstrlenA (lpString="*.wma") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.504] lstrlenA (lpString="*.ac3") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.504] lstrlenA (lpString="*.doc") returned 5 [0063.504] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.504] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.521] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.521] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.521] PathFindFileNameA (pszPath="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\qps-ploc\\" | out: lpString1="C:\\Boot\\qps-ploc\\") returned="C:\\Boot\\qps-ploc\\" [0063.521] PathAddBackslashA (in: pszPath="C:\\Boot\\qps-ploc\\" | out: pszPath="C:\\Boot\\qps-ploc\\") returned="" [0063.521] lstrcatA (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt" [0063.521] GetFileAttributesA (lpFileName="C:\\Boot\\qps-ploc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\qps-ploc\\how to decrypt files.txt")) returned 0x20 [0063.521] lstrcatA (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned="C:\\Boot\\qps-ploc\\memtest.exe.mui" [0063.521] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.521] lstrlenA (lpString="*.zip") returned 5 [0063.521] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.521] lstrlenA (lpString="*.rar") returned 5 [0063.521] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.521] lstrlenA (lpString="*.7z") returned 4 [0063.521] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.521] lstrlenA (lpString="*.tar") returned 5 [0063.521] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.521] lstrlenA (lpString="*.gzip") returned 6 [0063.521] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.521] lstrlenA (lpString="*.jpg") returned 5 [0063.521] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.522] lstrlenA (lpString="*.jpeg") returned 6 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.522] lstrlenA (lpString="*.psd") returned 5 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.522] lstrlenA (lpString="*.cdr") returned 5 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.522] lstrlenA (lpString="*.dwg") returned 5 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.522] lstrlenA (lpString="*.max") returned 5 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.522] lstrlenA (lpString="*.bmp") returned 5 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.522] lstrlenA (lpString="*.gif") returned 5 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.522] lstrlenA (lpString="*.png") returned 5 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.522] lstrlenA (lpString="*.doc") returned 5 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.522] lstrlenA (lpString="*.docx") returned 6 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.522] lstrlenA (lpString="*.xls") returned 5 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.522] lstrlenA (lpString="*.xlsx") returned 6 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.522] lstrlenA (lpString="*.ppt") returned 5 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.522] lstrlenA (lpString="*.pptx") returned 6 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.522] lstrlenA (lpString="*.txt") returned 5 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.522] lstrlenA (lpString="*.pdf") returned 5 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.522] lstrlenA (lpString="*.djvu") returned 6 [0063.522] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.523] lstrlenA (lpString="*.htm") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.523] lstrlenA (lpString="*.html") returned 6 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.523] lstrlenA (lpString="*.mdb") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.523] lstrlenA (lpString="*.cer") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.523] lstrlenA (lpString="*.p12") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.523] lstrlenA (lpString="*.pfx") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.523] lstrlenA (lpString="*.kwm") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.523] lstrlenA (lpString="*.pwm") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.523] lstrlenA (lpString="*.1cd") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.523] lstrlenA (lpString="*.md") returned 4 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.523] lstrlenA (lpString="*.mdf") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.523] lstrlenA (lpString="*.dbf") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.523] lstrlenA (lpString="*.odt") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.523] lstrlenA (lpString="*.vob") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.523] lstrlenA (lpString="*.ifo") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.523] lstrlenA (lpString="*.lnk") returned 5 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.523] lstrlenA (lpString="*.torrent") returned 9 [0063.523] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.524] lstrlenA (lpString="*.mov") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.524] lstrlenA (lpString="*.m2v") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.524] lstrlenA (lpString="*.3gp") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.524] lstrlenA (lpString="*.mpeg") returned 6 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.524] lstrlenA (lpString="*.mpg") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.524] lstrlenA (lpString="*.flv") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.524] lstrlenA (lpString="*.avi") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.524] lstrlenA (lpString="*.mp4") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.524] lstrlenA (lpString="*.wmv") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.524] lstrlenA (lpString="*.divx") returned 6 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.524] lstrlenA (lpString="*.mkv") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.524] lstrlenA (lpString="*.mp3") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.524] lstrlenA (lpString="*.wav") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.524] lstrlenA (lpString="*.flac") returned 6 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.524] lstrlenA (lpString="*.ape") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.524] lstrlenA (lpString="*.wma") returned 5 [0063.524] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.524] lstrlenA (lpString="*.ac3") returned 5 [0063.525] PathMatchSpecA (pszFile="C:\\Boot\\qps-ploc\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.525] lstrlenA (lpString="*.doc") returned 5 [0063.525] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.525] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0063.525] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0063.525] lstrcmpA (lpString1=".", lpString2="Resources") returned -1 [0063.525] lstrcmpA (lpString1="..", lpString2="Resources") returned -1 [0063.525] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.525] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="Resources" | out: lpString1="C:\\Boot\\Resources") returned="C:\\Boot\\Resources" [0063.525] lstrlenA (lpString="C:\\Boot\\Resources") returned 17 [0063.525] FindFirstFileA (in: lpFileName="C:\\Boot\\Resources\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0063.526] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.526] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.526] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.526] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.526] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0063.526] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.526] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootres.dll") returned 1 [0063.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootres.dll") returned 1 [0063.526] lstrcmpiA (lpString1="", lpString2="bootres.dll") returned -1 [0063.526] PathFindFileNameA (pszPath="C:\\Boot\\Resources\\*.*") returned="*.*" [0063.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Resources\\" | out: lpString1="C:\\Boot\\Resources\\") returned="C:\\Boot\\Resources\\" [0063.526] PathAddBackslashA (in: pszPath="C:\\Boot\\Resources\\" | out: pszPath="C:\\Boot\\Resources\\") returned="" [0063.526] lstrcatA (in: lpString1="C:\\Boot\\Resources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Resources\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Resources\\HOW TO DECRYPT FILES.txt" [0063.526] GetFileAttributesA (lpFileName="C:\\Boot\\Resources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\resources\\how to decrypt files.txt")) returned 0xffffffff [0063.526] CreateFileA (lpFileName="C:\\Boot\\Resources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\resources\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.527] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.527] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.528] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.528] CloseHandle (hObject=0x208) returned 1 [0063.528] lstrcatA (in: lpString1="C:\\Boot\\Resources\\", lpString2="bootres.dll" | out: lpString1="C:\\Boot\\Resources\\bootres.dll") returned="C:\\Boot\\Resources\\bootres.dll" [0063.528] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.zip") returned 0 [0063.528] lstrlenA (lpString="*.zip") returned 5 [0063.528] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.rar") returned 0 [0063.528] lstrlenA (lpString="*.rar") returned 5 [0063.528] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.7z") returned 0 [0063.528] lstrlenA (lpString="*.7z") returned 4 [0063.528] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.tar") returned 0 [0063.528] lstrlenA (lpString="*.tar") returned 5 [0063.528] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.gzip") returned 0 [0063.528] lstrlenA (lpString="*.gzip") returned 6 [0063.528] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.jpg") returned 0 [0063.529] lstrlenA (lpString="*.jpg") returned 5 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.jpeg") returned 0 [0063.529] lstrlenA (lpString="*.jpeg") returned 6 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.psd") returned 0 [0063.529] lstrlenA (lpString="*.psd") returned 5 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.cdr") returned 0 [0063.529] lstrlenA (lpString="*.cdr") returned 5 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.dwg") returned 0 [0063.529] lstrlenA (lpString="*.dwg") returned 5 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.max") returned 0 [0063.529] lstrlenA (lpString="*.max") returned 5 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.bmp") returned 0 [0063.529] lstrlenA (lpString="*.bmp") returned 5 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.gif") returned 0 [0063.529] lstrlenA (lpString="*.gif") returned 5 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.png") returned 0 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.doc") returned 0 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.docx") returned 0 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.xls") returned 0 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.xlsx") returned 0 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.ppt") returned 0 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.pptx") returned 0 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.txt") returned 0 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.pdf") returned 0 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.djvu") returned 0 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.htm") returned 0 [0063.529] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.html") returned 0 [0063.530] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mdb") returned 0 [0063.530] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.cer") returned 0 [0063.530] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.p12") returned 0 [0063.530] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.pfx") returned 0 [0063.530] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.kwm") returned 0 [0063.530] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.pwm") returned 0 [0063.530] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.1cd") returned 0 [0063.530] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.md") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mdf") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.dbf") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.odt") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.vob") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.ifo") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.lnk") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.torrent") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mov") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.m2v") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.3gp") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mpeg") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mpg") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.flv") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.avi") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mp4") returned 0 [0063.531] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.wmv") returned 0 [0063.532] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.divx") returned 0 [0063.532] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mkv") returned 0 [0063.532] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.mp3") returned 0 [0063.532] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.wav") returned 0 [0063.532] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.flac") returned 0 [0063.532] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.ape") returned 0 [0063.532] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.wma") returned 0 [0063.532] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.ac3") returned 0 [0063.532] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\bootres.dll", pszSpec="*.doc") returned 0 [0063.532] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="en-US", cAlternateFileName="")) returned 1 [0063.532] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0063.532] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0063.532] PathFindFileNameA (pszPath="C:\\Boot\\Resources\\bootres.dll") returned="bootres.dll" [0063.532] lstrcatA (in: lpString1="C:\\Boot\\Resources\\", lpString2="en-US" | out: lpString1="C:\\Boot\\Resources\\en-US") returned="C:\\Boot\\Resources\\en-US" [0063.532] FindFirstFileA (in: lpFileName="C:\\Boot\\Resources\\en-US\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7530b0, dwReserved1=0x68, cFileName=".", cAlternateFileName="")) returned 0x759b50 [0063.532] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.532] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7530b0, dwReserved1=0x68, cFileName="..", cAlternateFileName="")) returned 1 [0063.532] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.533] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.533] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x7530b0, dwReserved1=0x68, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0063.533] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0063.533] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootres.dll.mui") returned 1 [0063.533] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootres.dll.mui") returned 1 [0063.533] lstrcmpiA (lpString1="", lpString2="bootres.dll.mui") returned -1 [0063.533] PathFindFileNameA (pszPath="C:\\Boot\\Resources\\en-US\\*.*") returned="*.*" [0063.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Resources\\en-US\\" | out: lpString1="C:\\Boot\\Resources\\en-US\\") returned="C:\\Boot\\Resources\\en-US\\" [0063.533] PathAddBackslashA (in: pszPath="C:\\Boot\\Resources\\en-US\\" | out: pszPath="C:\\Boot\\Resources\\en-US\\") returned="" [0063.533] lstrcatA (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Resources\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Resources\\en-US\\HOW TO DECRYPT FILES.txt" [0063.533] GetFileAttributesA (lpFileName="C:\\Boot\\Resources\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\resources\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0063.533] CreateFileA (lpFileName="C:\\Boot\\Resources\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\resources\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0063.534] WriteFile (in: hFile=0x20c, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.535] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.535] CloseHandle (hObject=0x20c) returned 1 [0063.535] lstrcatA (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="bootres.dll.mui" | out: lpString1="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" [0063.535] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.zip") returned 0 [0063.535] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.rar") returned 0 [0063.535] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.7z") returned 0 [0063.535] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.tar") returned 0 [0063.535] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.gzip") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.jpg") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.jpeg") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.psd") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.cdr") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.dwg") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.max") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.bmp") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.gif") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.png") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.doc") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.docx") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.xls") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.xlsx") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.ppt") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.pptx") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.txt") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.pdf") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.djvu") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.htm") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.html") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mdb") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.cer") returned 0 [0063.536] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.p12") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.pfx") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.kwm") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.pwm") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.1cd") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.md") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mdf") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.dbf") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.odt") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.vob") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.ifo") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.lnk") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.torrent") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mov") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.m2v") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.3gp") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mpeg") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mpg") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.flv") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.avi") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mp4") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.wmv") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.divx") returned 0 [0063.537] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mkv") returned 0 [0063.538] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.mp3") returned 0 [0063.538] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.wav") returned 0 [0063.538] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.flac") returned 0 [0063.538] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.ape") returned 0 [0063.538] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.wma") returned 0 [0063.538] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.ac3") returned 0 [0063.538] PathMatchSpecA (pszFile="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", pszSpec="*.doc") returned 0 [0063.538] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x7530b0, dwReserved1=0x68, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0063.538] FindClose (in: hFindFile=0x759b50 | out: hFindFile=0x759b50) returned 1 [0063.538] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="en-US", cAlternateFileName="")) returned 0 [0063.538] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0063.538] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0063.538] lstrcmpA (lpString1=".", lpString2="ro-RO") returned -1 [0063.538] lstrcmpA (lpString1="..", lpString2="ro-RO") returned -1 [0063.538] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.538] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ro-RO" | out: lpString1="C:\\Boot\\ro-RO") returned="C:\\Boot\\ro-RO" [0063.538] lstrlenA (lpString="C:\\Boot\\ro-RO") returned 13 [0063.538] FindFirstFileA (in: lpFileName="C:\\Boot\\ro-RO\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName=".", cAlternateFileName="")) returned 0x759fd0 [0063.539] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.539] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="..", cAlternateFileName="")) returned 1 [0063.539] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.539] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.539] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.539] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.540] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.540] PathFindFileNameA (pszPath="C:\\Boot\\ro-RO\\*.*") returned="*.*" [0063.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ro-RO\\" | out: lpString1="C:\\Boot\\ro-RO\\") returned="C:\\Boot\\ro-RO\\" [0063.540] PathAddBackslashA (in: pszPath="C:\\Boot\\ro-RO\\" | out: pszPath="C:\\Boot\\ro-RO\\") returned="" [0063.540] lstrcatA (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ro-RO\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ro-RO\\HOW TO DECRYPT FILES.txt" [0063.540] GetFileAttributesA (lpFileName="C:\\Boot\\ro-RO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ro-ro\\how to decrypt files.txt")) returned 0xffffffff [0063.540] CreateFileA (lpFileName="C:\\Boot\\ro-RO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ro-ro\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.540] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.540] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.541] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.541] CloseHandle (hObject=0x208) returned 1 [0063.541] lstrcatA (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned="C:\\Boot\\ro-RO\\bootmgr.exe.mui" [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.542] lstrlenA (lpString="*.zip") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.542] lstrlenA (lpString="*.rar") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.542] lstrlenA (lpString="*.7z") returned 4 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.542] lstrlenA (lpString="*.tar") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.542] lstrlenA (lpString="*.gzip") returned 6 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.542] lstrlenA (lpString="*.jpg") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.542] lstrlenA (lpString="*.jpeg") returned 6 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.542] lstrlenA (lpString="*.psd") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.542] lstrlenA (lpString="*.cdr") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.542] lstrlenA (lpString="*.dwg") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.542] lstrlenA (lpString="*.max") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.542] lstrlenA (lpString="*.bmp") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.542] lstrlenA (lpString="*.gif") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.542] lstrlenA (lpString="*.png") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.542] lstrlenA (lpString="*.doc") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.542] lstrlenA (lpString="*.docx") returned 6 [0063.542] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.543] lstrlenA (lpString="*.xls") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.543] lstrlenA (lpString="*.xlsx") returned 6 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.543] lstrlenA (lpString="*.ppt") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.543] lstrlenA (lpString="*.pptx") returned 6 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.543] lstrlenA (lpString="*.txt") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.543] lstrlenA (lpString="*.pdf") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.543] lstrlenA (lpString="*.djvu") returned 6 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.543] lstrlenA (lpString="*.htm") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.543] lstrlenA (lpString="*.html") returned 6 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.543] lstrlenA (lpString="*.mdb") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.543] lstrlenA (lpString="*.cer") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.543] lstrlenA (lpString="*.p12") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.543] lstrlenA (lpString="*.pfx") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.543] lstrlenA (lpString="*.kwm") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.543] lstrlenA (lpString="*.pwm") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.543] lstrlenA (lpString="*.1cd") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.543] lstrlenA (lpString="*.md") returned 4 [0063.543] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.544] lstrlenA (lpString="*.mdf") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.544] lstrlenA (lpString="*.dbf") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.544] lstrlenA (lpString="*.odt") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.544] lstrlenA (lpString="*.vob") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.544] lstrlenA (lpString="*.ifo") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.544] lstrlenA (lpString="*.lnk") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.544] lstrlenA (lpString="*.torrent") returned 9 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.544] lstrlenA (lpString="*.mov") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.544] lstrlenA (lpString="*.m2v") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.544] lstrlenA (lpString="*.3gp") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.544] lstrlenA (lpString="*.mpeg") returned 6 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.544] lstrlenA (lpString="*.mpg") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.544] lstrlenA (lpString="*.flv") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.544] lstrlenA (lpString="*.avi") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.544] lstrlenA (lpString="*.mp4") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.544] lstrlenA (lpString="*.wmv") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.544] lstrlenA (lpString="*.divx") returned 6 [0063.544] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.545] lstrlenA (lpString="*.mkv") returned 5 [0063.545] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.545] lstrlenA (lpString="*.mp3") returned 5 [0063.545] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.545] lstrlenA (lpString="*.wav") returned 5 [0063.545] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.545] lstrlenA (lpString="*.flac") returned 6 [0063.545] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.545] lstrlenA (lpString="*.ape") returned 5 [0063.545] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.545] lstrlenA (lpString="*.wma") returned 5 [0063.545] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.545] lstrlenA (lpString="*.ac3") returned 5 [0063.545] PathMatchSpecA (pszFile="C:\\Boot\\ro-RO\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.545] lstrlenA (lpString="*.doc") returned 5 [0063.545] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.545] FindClose (in: hFindFile=0x759fd0 | out: hFindFile=0x759fd0) returned 1 [0063.545] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0063.545] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1 [0063.545] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1 [0063.545] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.545] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU" [0063.545] lstrlenA (lpString="C:\\Boot\\ru-RU") returned 13 [0063.545] FindFirstFileA (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759990 [0063.547] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.547] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0063.547] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.547] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.547] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.547] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.547] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.547] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.547] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.547] PathFindFileNameA (pszPath="C:\\Boot\\ru-RU\\*.*") returned="*.*" [0063.547] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ru-RU\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\" [0063.547] PathAddBackslashA (in: pszPath="C:\\Boot\\ru-RU\\" | out: pszPath="C:\\Boot\\ru-RU\\") returned="" [0063.547] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" [0063.547] GetFileAttributesA (lpFileName="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ru-ru\\how to decrypt files.txt")) returned 0xffffffff [0063.547] CreateFileA (lpFileName="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ru-ru\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.549] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.549] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.550] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.550] CloseHandle (hObject=0x208) returned 1 [0063.551] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.551] lstrlenA (lpString="*.zip") returned 5 [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.551] lstrlenA (lpString="*.rar") returned 5 [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.551] lstrlenA (lpString="*.7z") returned 4 [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.551] lstrlenA (lpString="*.tar") returned 5 [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.551] lstrlenA (lpString="*.gzip") returned 6 [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.551] lstrlenA (lpString="*.jpg") returned 5 [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.551] lstrlenA (lpString="*.jpeg") returned 6 [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.551] lstrlenA (lpString="*.psd") returned 5 [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.551] lstrlenA (lpString="*.cdr") returned 5 [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.551] lstrlenA (lpString="*.dwg") returned 5 [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.551] lstrlenA (lpString="*.max") returned 5 [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.551] lstrlenA (lpString="*.bmp") returned 5 [0063.551] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.552] lstrlenA (lpString="*.gif") returned 5 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.552] lstrlenA (lpString="*.png") returned 5 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.552] lstrlenA (lpString="*.doc") returned 5 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.552] lstrlenA (lpString="*.docx") returned 6 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.552] lstrlenA (lpString="*.xls") returned 5 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.552] lstrlenA (lpString="*.xlsx") returned 6 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.552] lstrlenA (lpString="*.ppt") returned 5 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.552] lstrlenA (lpString="*.pptx") returned 6 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.552] lstrlenA (lpString="*.txt") returned 5 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.552] lstrlenA (lpString="*.pdf") returned 5 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.552] lstrlenA (lpString="*.djvu") returned 6 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.552] lstrlenA (lpString="*.htm") returned 5 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.552] lstrlenA (lpString="*.html") returned 6 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.552] lstrlenA (lpString="*.mdb") returned 5 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.552] lstrlenA (lpString="*.cer") returned 5 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.552] lstrlenA (lpString="*.p12") returned 5 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.552] lstrlenA (lpString="*.pfx") returned 5 [0063.552] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.553] lstrlenA (lpString="*.kwm") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.553] lstrlenA (lpString="*.pwm") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.553] lstrlenA (lpString="*.1cd") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.553] lstrlenA (lpString="*.md") returned 4 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.553] lstrlenA (lpString="*.mdf") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.553] lstrlenA (lpString="*.dbf") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.553] lstrlenA (lpString="*.odt") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.553] lstrlenA (lpString="*.vob") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.553] lstrlenA (lpString="*.ifo") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.553] lstrlenA (lpString="*.lnk") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.553] lstrlenA (lpString="*.torrent") returned 9 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.553] lstrlenA (lpString="*.mov") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.553] lstrlenA (lpString="*.m2v") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.553] lstrlenA (lpString="*.3gp") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.553] lstrlenA (lpString="*.mpeg") returned 6 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.553] lstrlenA (lpString="*.mpg") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.553] lstrlenA (lpString="*.flv") returned 5 [0063.554] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.554] lstrlenA (lpString="*.avi") returned 5 [0063.554] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.554] lstrlenA (lpString="*.mp4") returned 5 [0063.554] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.554] lstrlenA (lpString="*.wmv") returned 5 [0063.554] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.554] lstrlenA (lpString="*.divx") returned 6 [0063.554] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.554] lstrlenA (lpString="*.mkv") returned 5 [0063.554] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.554] lstrlenA (lpString="*.mp3") returned 5 [0063.554] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.554] lstrlenA (lpString="*.wav") returned 5 [0063.554] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.554] lstrlenA (lpString="*.flac") returned 6 [0063.554] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.554] lstrlenA (lpString="*.ape") returned 5 [0063.554] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.554] lstrlenA (lpString="*.wma") returned 5 [0063.554] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.554] lstrlenA (lpString="*.ac3") returned 5 [0063.554] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.554] lstrlenA (lpString="*.doc") returned 5 [0063.554] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.554] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.554] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.554] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.554] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.554] PathFindFileNameA (pszPath="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ru-RU\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\" [0063.554] PathAddBackslashA (in: pszPath="C:\\Boot\\ru-RU\\" | out: pszPath="C:\\Boot\\ru-RU\\") returned="" [0063.555] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" [0063.555] GetFileAttributesA (lpFileName="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ru-ru\\how to decrypt files.txt")) returned 0x20 [0063.555] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\memtest.exe.mui") returned="C:\\Boot\\ru-RU\\memtest.exe.mui" [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.555] lstrlenA (lpString="*.zip") returned 5 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.555] lstrlenA (lpString="*.rar") returned 5 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.555] lstrlenA (lpString="*.7z") returned 4 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.555] lstrlenA (lpString="*.tar") returned 5 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.555] lstrlenA (lpString="*.gzip") returned 6 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.555] lstrlenA (lpString="*.jpg") returned 5 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.555] lstrlenA (lpString="*.jpeg") returned 6 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.555] lstrlenA (lpString="*.psd") returned 5 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.555] lstrlenA (lpString="*.cdr") returned 5 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.555] lstrlenA (lpString="*.dwg") returned 5 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.555] lstrlenA (lpString="*.max") returned 5 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.555] lstrlenA (lpString="*.bmp") returned 5 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.555] lstrlenA (lpString="*.gif") returned 5 [0063.555] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.556] lstrlenA (lpString="*.png") returned 5 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.556] lstrlenA (lpString="*.doc") returned 5 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.556] lstrlenA (lpString="*.docx") returned 6 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.556] lstrlenA (lpString="*.xls") returned 5 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.556] lstrlenA (lpString="*.xlsx") returned 6 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.556] lstrlenA (lpString="*.ppt") returned 5 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.556] lstrlenA (lpString="*.pptx") returned 6 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.556] lstrlenA (lpString="*.txt") returned 5 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.556] lstrlenA (lpString="*.pdf") returned 5 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.556] lstrlenA (lpString="*.djvu") returned 6 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.556] lstrlenA (lpString="*.htm") returned 5 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.556] lstrlenA (lpString="*.html") returned 6 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.556] lstrlenA (lpString="*.mdb") returned 5 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.556] lstrlenA (lpString="*.cer") returned 5 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.556] lstrlenA (lpString="*.p12") returned 5 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.556] lstrlenA (lpString="*.pfx") returned 5 [0063.556] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.556] lstrlenA (lpString="*.kwm") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.557] lstrlenA (lpString="*.pwm") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.557] lstrlenA (lpString="*.1cd") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.557] lstrlenA (lpString="*.md") returned 4 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.557] lstrlenA (lpString="*.mdf") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.557] lstrlenA (lpString="*.dbf") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.557] lstrlenA (lpString="*.odt") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.557] lstrlenA (lpString="*.vob") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.557] lstrlenA (lpString="*.ifo") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.557] lstrlenA (lpString="*.lnk") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.557] lstrlenA (lpString="*.torrent") returned 9 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.557] lstrlenA (lpString="*.mov") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.557] lstrlenA (lpString="*.m2v") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.557] lstrlenA (lpString="*.3gp") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.557] lstrlenA (lpString="*.mpeg") returned 6 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.557] lstrlenA (lpString="*.mpg") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.557] lstrlenA (lpString="*.flv") returned 5 [0063.557] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.558] lstrlenA (lpString="*.avi") returned 5 [0063.558] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.558] lstrlenA (lpString="*.mp4") returned 5 [0063.558] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.558] lstrlenA (lpString="*.wmv") returned 5 [0063.558] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.558] lstrlenA (lpString="*.divx") returned 6 [0063.558] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.558] lstrlenA (lpString="*.mkv") returned 5 [0063.558] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.558] lstrlenA (lpString="*.mp3") returned 5 [0063.558] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.558] lstrlenA (lpString="*.wav") returned 5 [0063.558] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.558] lstrlenA (lpString="*.flac") returned 6 [0063.558] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.558] lstrlenA (lpString="*.ape") returned 5 [0063.558] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.558] lstrlenA (lpString="*.wma") returned 5 [0063.558] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.558] lstrlenA (lpString="*.ac3") returned 5 [0063.558] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.558] lstrlenA (lpString="*.doc") returned 5 [0063.558] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.558] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0063.558] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0063.559] lstrcmpA (lpString1=".", lpString2="sk-SK") returned -1 [0063.559] lstrcmpA (lpString1="..", lpString2="sk-SK") returned -1 [0063.559] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.559] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sk-SK" | out: lpString1="C:\\Boot\\sk-SK") returned="C:\\Boot\\sk-SK" [0063.559] lstrlenA (lpString="C:\\Boot\\sk-SK") returned 13 [0063.559] FindFirstFileA (in: lpFileName="C:\\Boot\\sk-SK\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0063.559] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.559] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.559] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.559] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.559] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.559] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.559] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.559] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.559] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.559] PathFindFileNameA (pszPath="C:\\Boot\\sk-SK\\*.*") returned="*.*" [0063.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sk-SK\\" | out: lpString1="C:\\Boot\\sk-SK\\") returned="C:\\Boot\\sk-SK\\" [0063.559] PathAddBackslashA (in: pszPath="C:\\Boot\\sk-SK\\" | out: pszPath="C:\\Boot\\sk-SK\\") returned="" [0063.559] lstrcatA (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sk-SK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sk-SK\\HOW TO DECRYPT FILES.txt" [0063.559] GetFileAttributesA (lpFileName="C:\\Boot\\sk-SK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sk-sk\\how to decrypt files.txt")) returned 0xffffffff [0063.559] CreateFileA (lpFileName="C:\\Boot\\sk-SK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sk-sk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.560] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.560] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.567] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.568] CloseHandle (hObject=0x208) returned 1 [0063.568] lstrcatA (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned="C:\\Boot\\sk-SK\\bootmgr.exe.mui" [0063.568] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.568] lstrlenA (lpString="*.zip") returned 5 [0063.568] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.568] lstrlenA (lpString="*.rar") returned 5 [0063.568] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.568] lstrlenA (lpString="*.7z") returned 4 [0063.568] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.568] lstrlenA (lpString="*.tar") returned 5 [0063.568] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.568] lstrlenA (lpString="*.gzip") returned 6 [0063.568] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.568] lstrlenA (lpString="*.jpg") returned 5 [0063.568] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.568] lstrlenA (lpString="*.jpeg") returned 6 [0063.568] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.568] lstrlenA (lpString="*.psd") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.569] lstrlenA (lpString="*.cdr") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.569] lstrlenA (lpString="*.dwg") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.569] lstrlenA (lpString="*.max") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.569] lstrlenA (lpString="*.bmp") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.569] lstrlenA (lpString="*.gif") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.569] lstrlenA (lpString="*.png") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.569] lstrlenA (lpString="*.doc") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.569] lstrlenA (lpString="*.docx") returned 6 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.569] lstrlenA (lpString="*.xls") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.569] lstrlenA (lpString="*.xlsx") returned 6 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.569] lstrlenA (lpString="*.ppt") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.569] lstrlenA (lpString="*.pptx") returned 6 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.569] lstrlenA (lpString="*.txt") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.569] lstrlenA (lpString="*.pdf") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.569] lstrlenA (lpString="*.djvu") returned 6 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.569] lstrlenA (lpString="*.htm") returned 5 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.569] lstrlenA (lpString="*.html") returned 6 [0063.569] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.570] lstrlenA (lpString="*.mdb") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.570] lstrlenA (lpString="*.cer") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.570] lstrlenA (lpString="*.p12") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.570] lstrlenA (lpString="*.pfx") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.570] lstrlenA (lpString="*.kwm") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.570] lstrlenA (lpString="*.pwm") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.570] lstrlenA (lpString="*.1cd") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.570] lstrlenA (lpString="*.md") returned 4 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.570] lstrlenA (lpString="*.mdf") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.570] lstrlenA (lpString="*.dbf") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.570] lstrlenA (lpString="*.odt") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.570] lstrlenA (lpString="*.vob") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.570] lstrlenA (lpString="*.ifo") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.570] lstrlenA (lpString="*.lnk") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.570] lstrlenA (lpString="*.torrent") returned 9 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.570] lstrlenA (lpString="*.mov") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.570] lstrlenA (lpString="*.m2v") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.570] lstrlenA (lpString="*.3gp") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.571] lstrlenA (lpString="*.mpeg") returned 6 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.571] lstrlenA (lpString="*.mpg") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.571] lstrlenA (lpString="*.flv") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.571] lstrlenA (lpString="*.avi") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.571] lstrlenA (lpString="*.mp4") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.571] lstrlenA (lpString="*.wmv") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.571] lstrlenA (lpString="*.divx") returned 6 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.571] lstrlenA (lpString="*.mkv") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.571] lstrlenA (lpString="*.mp3") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.571] lstrlenA (lpString="*.wav") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.571] lstrlenA (lpString="*.flac") returned 6 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.571] lstrlenA (lpString="*.ape") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.571] lstrlenA (lpString="*.wma") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.571] lstrlenA (lpString="*.ac3") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Boot\\sk-SK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.571] lstrlenA (lpString="*.doc") returned 5 [0063.571] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.571] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0063.572] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0063.572] lstrcmpA (lpString1=".", lpString2="sl-SI") returned -1 [0063.572] lstrcmpA (lpString1="..", lpString2="sl-SI") returned -1 [0063.572] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.572] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sl-SI" | out: lpString1="C:\\Boot\\sl-SI") returned="C:\\Boot\\sl-SI" [0063.572] lstrlenA (lpString="C:\\Boot\\sl-SI") returned 13 [0063.572] FindFirstFileA (in: lpFileName="C:\\Boot\\sl-SI\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0063.572] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.572] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0063.573] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.573] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.573] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.573] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.573] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.573] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.573] PathFindFileNameA (pszPath="C:\\Boot\\sl-SI\\*.*") returned="*.*" [0063.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sl-SI\\" | out: lpString1="C:\\Boot\\sl-SI\\") returned="C:\\Boot\\sl-SI\\" [0063.573] PathAddBackslashA (in: pszPath="C:\\Boot\\sl-SI\\" | out: pszPath="C:\\Boot\\sl-SI\\") returned="" [0063.573] lstrcatA (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sl-SI\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sl-SI\\HOW TO DECRYPT FILES.txt" [0063.573] GetFileAttributesA (lpFileName="C:\\Boot\\sl-SI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sl-si\\how to decrypt files.txt")) returned 0xffffffff [0063.573] CreateFileA (lpFileName="C:\\Boot\\sl-SI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sl-si\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.574] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.574] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.575] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.575] CloseHandle (hObject=0x208) returned 1 [0063.575] lstrcatA (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned="C:\\Boot\\sl-SI\\bootmgr.exe.mui" [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.576] lstrlenA (lpString="*.zip") returned 5 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.576] lstrlenA (lpString="*.rar") returned 5 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.576] lstrlenA (lpString="*.7z") returned 4 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.576] lstrlenA (lpString="*.tar") returned 5 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.576] lstrlenA (lpString="*.gzip") returned 6 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.576] lstrlenA (lpString="*.jpg") returned 5 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.576] lstrlenA (lpString="*.jpeg") returned 6 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.576] lstrlenA (lpString="*.psd") returned 5 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.576] lstrlenA (lpString="*.cdr") returned 5 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.576] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.577] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.577] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.577] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.577] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.577] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.578] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.579] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.579] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.579] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.579] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.579] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.579] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.579] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.579] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.579] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.579] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.579] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.579] PathMatchSpecA (pszFile="C:\\Boot\\sl-SI\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.579] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.579] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0063.579] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0063.579] lstrcmpA (lpString1=".", lpString2="sr-Latn-CS") returned -1 [0063.579] lstrcmpA (lpString1="..", lpString2="sr-Latn-CS") returned -1 [0063.579] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.579] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-CS" | out: lpString1="C:\\Boot\\sr-Latn-CS") returned="C:\\Boot\\sr-Latn-CS" [0063.579] FindFirstFileA (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759e90 [0063.580] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.580] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0063.580] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.580] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.580] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.580] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.580] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.580] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.580] PathFindFileNameA (pszPath="C:\\Boot\\sr-Latn-CS\\*.*") returned="*.*" [0063.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sr-Latn-CS\\" | out: lpString1="C:\\Boot\\sr-Latn-CS\\") returned="C:\\Boot\\sr-Latn-CS\\" [0063.580] PathAddBackslashA (in: pszPath="C:\\Boot\\sr-Latn-CS\\" | out: pszPath="C:\\Boot\\sr-Latn-CS\\") returned="" [0063.580] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" [0063.580] GetFileAttributesA (lpFileName="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sr-latn-cs\\how to decrypt files.txt")) returned 0xffffffff [0063.580] CreateFileA (lpFileName="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sr-latn-cs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.582] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.583] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.583] CloseHandle (hObject=0x208) returned 1 [0063.583] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" [0063.583] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.584] lstrlenA (lpString="*.zip") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.584] lstrlenA (lpString="*.rar") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.584] lstrlenA (lpString="*.7z") returned 4 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.584] lstrlenA (lpString="*.tar") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.584] lstrlenA (lpString="*.gzip") returned 6 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.584] lstrlenA (lpString="*.jpg") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.584] lstrlenA (lpString="*.jpeg") returned 6 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.584] lstrlenA (lpString="*.psd") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.584] lstrlenA (lpString="*.cdr") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.584] lstrlenA (lpString="*.dwg") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.584] lstrlenA (lpString="*.max") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.584] lstrlenA (lpString="*.bmp") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.584] lstrlenA (lpString="*.gif") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.584] lstrlenA (lpString="*.png") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.584] lstrlenA (lpString="*.doc") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.584] lstrlenA (lpString="*.docx") returned 6 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.584] lstrlenA (lpString="*.xls") returned 5 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.584] lstrlenA (lpString="*.xlsx") returned 6 [0063.584] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.584] lstrlenA (lpString="*.ppt") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.585] lstrlenA (lpString="*.pptx") returned 6 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.585] lstrlenA (lpString="*.txt") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.585] lstrlenA (lpString="*.pdf") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.585] lstrlenA (lpString="*.djvu") returned 6 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.585] lstrlenA (lpString="*.htm") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.585] lstrlenA (lpString="*.html") returned 6 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.585] lstrlenA (lpString="*.mdb") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.585] lstrlenA (lpString="*.cer") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.585] lstrlenA (lpString="*.p12") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.585] lstrlenA (lpString="*.pfx") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.585] lstrlenA (lpString="*.kwm") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.585] lstrlenA (lpString="*.pwm") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.585] lstrlenA (lpString="*.1cd") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.585] lstrlenA (lpString="*.md") returned 4 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.585] lstrlenA (lpString="*.mdf") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.585] lstrlenA (lpString="*.dbf") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.585] lstrlenA (lpString="*.odt") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.585] lstrlenA (lpString="*.vob") returned 5 [0063.585] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.585] lstrlenA (lpString="*.ifo") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.586] lstrlenA (lpString="*.lnk") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.586] lstrlenA (lpString="*.torrent") returned 9 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.586] lstrlenA (lpString="*.mov") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.586] lstrlenA (lpString="*.m2v") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.586] lstrlenA (lpString="*.3gp") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.586] lstrlenA (lpString="*.mpeg") returned 6 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.586] lstrlenA (lpString="*.mpg") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.586] lstrlenA (lpString="*.flv") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.586] lstrlenA (lpString="*.avi") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.586] lstrlenA (lpString="*.mp4") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.586] lstrlenA (lpString="*.wmv") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.586] lstrlenA (lpString="*.divx") returned 6 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.586] lstrlenA (lpString="*.mkv") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.586] lstrlenA (lpString="*.mp3") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.586] lstrlenA (lpString="*.wav") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.586] lstrlenA (lpString="*.flac") returned 6 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.586] lstrlenA (lpString="*.ape") returned 5 [0063.586] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.586] lstrlenA (lpString="*.wma") returned 5 [0063.587] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.587] lstrlenA (lpString="*.ac3") returned 5 [0063.587] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.587] lstrlenA (lpString="*.doc") returned 5 [0063.587] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.587] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.587] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.587] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.587] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.587] PathFindFileNameA (pszPath="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sr-Latn-CS\\" | out: lpString1="C:\\Boot\\sr-Latn-CS\\") returned="C:\\Boot\\sr-Latn-CS\\" [0063.587] PathAddBackslashA (in: pszPath="C:\\Boot\\sr-Latn-CS\\" | out: pszPath="C:\\Boot\\sr-Latn-CS\\") returned="" [0063.587] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" [0063.587] GetFileAttributesA (lpFileName="C:\\Boot\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sr-latn-cs\\how to decrypt files.txt")) returned 0x20 [0063.587] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" [0063.587] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.587] lstrlenA (lpString="*.zip") returned 5 [0063.587] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.587] lstrlenA (lpString="*.rar") returned 5 [0063.587] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.587] lstrlenA (lpString="*.7z") returned 4 [0063.587] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.587] lstrlenA (lpString="*.tar") returned 5 [0063.587] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.587] lstrlenA (lpString="*.gzip") returned 6 [0063.587] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.587] lstrlenA (lpString="*.jpg") returned 5 [0063.587] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.587] lstrlenA (lpString="*.jpeg") returned 6 [0063.587] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.587] lstrlenA (lpString="*.psd") returned 5 [0063.587] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.588] lstrlenA (lpString="*.cdr") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.588] lstrlenA (lpString="*.dwg") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.588] lstrlenA (lpString="*.max") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.588] lstrlenA (lpString="*.bmp") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.588] lstrlenA (lpString="*.gif") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.588] lstrlenA (lpString="*.png") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.588] lstrlenA (lpString="*.doc") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.588] lstrlenA (lpString="*.docx") returned 6 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.588] lstrlenA (lpString="*.xls") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.588] lstrlenA (lpString="*.xlsx") returned 6 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.588] lstrlenA (lpString="*.ppt") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.588] lstrlenA (lpString="*.pptx") returned 6 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.588] lstrlenA (lpString="*.txt") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.588] lstrlenA (lpString="*.pdf") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.588] lstrlenA (lpString="*.djvu") returned 6 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.588] lstrlenA (lpString="*.htm") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.588] lstrlenA (lpString="*.html") returned 6 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.588] lstrlenA (lpString="*.mdb") returned 5 [0063.588] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.588] lstrlenA (lpString="*.cer") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.589] lstrlenA (lpString="*.p12") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.589] lstrlenA (lpString="*.pfx") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.589] lstrlenA (lpString="*.kwm") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.589] lstrlenA (lpString="*.pwm") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.589] lstrlenA (lpString="*.1cd") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.589] lstrlenA (lpString="*.md") returned 4 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.589] lstrlenA (lpString="*.mdf") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.589] lstrlenA (lpString="*.dbf") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.589] lstrlenA (lpString="*.odt") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.589] lstrlenA (lpString="*.vob") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.589] lstrlenA (lpString="*.ifo") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.589] lstrlenA (lpString="*.lnk") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.589] lstrlenA (lpString="*.torrent") returned 9 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.589] lstrlenA (lpString="*.mov") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.589] lstrlenA (lpString="*.m2v") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.589] lstrlenA (lpString="*.3gp") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.589] lstrlenA (lpString="*.mpeg") returned 6 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.589] lstrlenA (lpString="*.mpg") returned 5 [0063.589] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.590] lstrlenA (lpString="*.flv") returned 5 [0063.590] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.590] lstrlenA (lpString="*.avi") returned 5 [0063.590] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.590] lstrlenA (lpString="*.mp4") returned 5 [0063.590] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.590] lstrlenA (lpString="*.wmv") returned 5 [0063.590] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.590] lstrlenA (lpString="*.divx") returned 6 [0063.590] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.590] lstrlenA (lpString="*.mkv") returned 5 [0063.590] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.590] lstrlenA (lpString="*.mp3") returned 5 [0063.590] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.590] lstrlenA (lpString="*.wav") returned 5 [0063.590] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.590] lstrlenA (lpString="*.flac") returned 6 [0063.590] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.590] lstrlenA (lpString="*.ape") returned 5 [0063.590] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.590] lstrlenA (lpString="*.wma") returned 5 [0063.590] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.590] lstrlenA (lpString="*.ac3") returned 5 [0063.590] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.590] lstrlenA (lpString="*.doc") returned 5 [0063.590] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.590] FindClose (in: hFindFile=0x759e90 | out: hFindFile=0x759e90) returned 1 [0063.590] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0063.590] lstrcmpA (lpString1=".", lpString2="sr-Latn-RS") returned -1 [0063.590] lstrcmpA (lpString1="..", lpString2="sr-Latn-RS") returned -1 [0063.590] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.591] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-RS" | out: lpString1="C:\\Boot\\sr-Latn-RS") returned="C:\\Boot\\sr-Latn-RS" [0063.591] lstrlenA (lpString="C:\\Boot\\sr-Latn-RS") returned 18 [0063.591] FindFirstFileA (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0063.591] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.591] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.591] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.591] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.591] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.591] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.592] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.592] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.592] PathFindFileNameA (pszPath="C:\\Boot\\sr-Latn-RS\\*.*") returned="*.*" [0063.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sr-Latn-RS\\" | out: lpString1="C:\\Boot\\sr-Latn-RS\\") returned="C:\\Boot\\sr-Latn-RS\\" [0063.592] PathAddBackslashA (in: pszPath="C:\\Boot\\sr-Latn-RS\\" | out: pszPath="C:\\Boot\\sr-Latn-RS\\") returned="" [0063.592] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt" [0063.592] GetFileAttributesA (lpFileName="C:\\Boot\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sr-latn-rs\\how to decrypt files.txt")) returned 0xffffffff [0063.592] CreateFileA (lpFileName="C:\\Boot\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sr-latn-rs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.592] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.592] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.606] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.606] CloseHandle (hObject=0x208) returned 1 [0063.607] lstrcatA (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.607] lstrlenA (lpString="*.zip") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.607] lstrlenA (lpString="*.rar") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.607] lstrlenA (lpString="*.7z") returned 4 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.607] lstrlenA (lpString="*.tar") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.607] lstrlenA (lpString="*.gzip") returned 6 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.607] lstrlenA (lpString="*.jpg") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.607] lstrlenA (lpString="*.jpeg") returned 6 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.607] lstrlenA (lpString="*.psd") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.607] lstrlenA (lpString="*.cdr") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.607] lstrlenA (lpString="*.dwg") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.607] lstrlenA (lpString="*.max") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.607] lstrlenA (lpString="*.bmp") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.607] lstrlenA (lpString="*.gif") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.607] lstrlenA (lpString="*.png") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.607] lstrlenA (lpString="*.doc") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.607] lstrlenA (lpString="*.docx") returned 6 [0063.607] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.608] lstrlenA (lpString="*.xls") returned 5 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.608] lstrlenA (lpString="*.xlsx") returned 6 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.608] lstrlenA (lpString="*.ppt") returned 5 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.608] lstrlenA (lpString="*.pptx") returned 6 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.608] lstrlenA (lpString="*.txt") returned 5 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.608] lstrlenA (lpString="*.pdf") returned 5 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.608] lstrlenA (lpString="*.djvu") returned 6 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.608] lstrlenA (lpString="*.htm") returned 5 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.608] lstrlenA (lpString="*.html") returned 6 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.608] lstrlenA (lpString="*.mdb") returned 5 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.608] lstrlenA (lpString="*.cer") returned 5 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.608] lstrlenA (lpString="*.p12") returned 5 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.608] lstrlenA (lpString="*.pfx") returned 5 [0063.608] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.609] lstrlenA (lpString="*.kwm") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.609] lstrlenA (lpString="*.pwm") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.609] lstrlenA (lpString="*.1cd") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.609] lstrlenA (lpString="*.md") returned 4 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.609] lstrlenA (lpString="*.mdf") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.609] lstrlenA (lpString="*.dbf") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.609] lstrlenA (lpString="*.odt") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.609] lstrlenA (lpString="*.vob") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.609] lstrlenA (lpString="*.ifo") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.609] lstrlenA (lpString="*.lnk") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.609] lstrlenA (lpString="*.torrent") returned 9 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.609] lstrlenA (lpString="*.mov") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.609] lstrlenA (lpString="*.m2v") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.609] lstrlenA (lpString="*.3gp") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.609] lstrlenA (lpString="*.mpeg") returned 6 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.609] lstrlenA (lpString="*.mpg") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.609] lstrlenA (lpString="*.flv") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.609] lstrlenA (lpString="*.avi") returned 5 [0063.609] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.609] lstrlenA (lpString="*.mp4") returned 5 [0063.610] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.610] lstrlenA (lpString="*.wmv") returned 5 [0063.610] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.610] lstrlenA (lpString="*.divx") returned 6 [0063.610] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.610] lstrlenA (lpString="*.mkv") returned 5 [0063.610] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.610] lstrlenA (lpString="*.mp3") returned 5 [0063.610] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.610] lstrlenA (lpString="*.wav") returned 5 [0063.610] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.610] lstrlenA (lpString="*.flac") returned 6 [0063.610] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.610] lstrlenA (lpString="*.ape") returned 5 [0063.610] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.610] lstrlenA (lpString="*.wma") returned 5 [0063.610] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.610] lstrlenA (lpString="*.ac3") returned 5 [0063.610] PathMatchSpecA (pszFile="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.610] lstrlenA (lpString="*.doc") returned 5 [0063.610] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.610] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0063.610] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0063.610] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1 [0063.610] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1 [0063.610] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.610] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE" [0063.610] lstrlenA (lpString="C:\\Boot\\sv-SE") returned 13 [0063.610] FindFirstFileA (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759b50 [0063.611] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.611] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0063.611] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.611] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.611] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.611] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.611] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.612] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.612] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.612] PathFindFileNameA (pszPath="C:\\Boot\\sv-SE\\*.*") returned="*.*" [0063.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sv-SE\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\" [0063.612] PathAddBackslashA (in: pszPath="C:\\Boot\\sv-SE\\" | out: pszPath="C:\\Boot\\sv-SE\\") returned="" [0063.612] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" [0063.612] GetFileAttributesA (lpFileName="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sv-se\\how to decrypt files.txt")) returned 0xffffffff [0063.612] CreateFileA (lpFileName="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sv-se\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.614] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.614] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.615] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.615] CloseHandle (hObject=0x208) returned 1 [0063.616] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.616] lstrlenA (lpString="*.zip") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.616] lstrlenA (lpString="*.rar") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.616] lstrlenA (lpString="*.7z") returned 4 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.616] lstrlenA (lpString="*.tar") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.616] lstrlenA (lpString="*.gzip") returned 6 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.616] lstrlenA (lpString="*.jpg") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.616] lstrlenA (lpString="*.jpeg") returned 6 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.616] lstrlenA (lpString="*.psd") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.616] lstrlenA (lpString="*.cdr") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.616] lstrlenA (lpString="*.dwg") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.616] lstrlenA (lpString="*.max") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.616] lstrlenA (lpString="*.bmp") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.616] lstrlenA (lpString="*.gif") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.616] lstrlenA (lpString="*.png") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.616] lstrlenA (lpString="*.doc") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.616] lstrlenA (lpString="*.docx") returned 6 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.616] lstrlenA (lpString="*.xls") returned 5 [0063.616] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.616] lstrlenA (lpString="*.xlsx") returned 6 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.617] lstrlenA (lpString="*.ppt") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.617] lstrlenA (lpString="*.pptx") returned 6 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.617] lstrlenA (lpString="*.txt") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.617] lstrlenA (lpString="*.pdf") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.617] lstrlenA (lpString="*.djvu") returned 6 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.617] lstrlenA (lpString="*.htm") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.617] lstrlenA (lpString="*.html") returned 6 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.617] lstrlenA (lpString="*.mdb") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.617] lstrlenA (lpString="*.cer") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.617] lstrlenA (lpString="*.p12") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.617] lstrlenA (lpString="*.pfx") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.617] lstrlenA (lpString="*.kwm") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.617] lstrlenA (lpString="*.pwm") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.617] lstrlenA (lpString="*.1cd") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.617] lstrlenA (lpString="*.md") returned 4 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.617] lstrlenA (lpString="*.mdf") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.617] lstrlenA (lpString="*.dbf") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.617] lstrlenA (lpString="*.odt") returned 5 [0063.617] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.618] lstrlenA (lpString="*.vob") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.618] lstrlenA (lpString="*.ifo") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.618] lstrlenA (lpString="*.lnk") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.618] lstrlenA (lpString="*.torrent") returned 9 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.618] lstrlenA (lpString="*.mov") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.618] lstrlenA (lpString="*.m2v") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.618] lstrlenA (lpString="*.3gp") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.618] lstrlenA (lpString="*.mpeg") returned 6 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.618] lstrlenA (lpString="*.mpg") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.618] lstrlenA (lpString="*.flv") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.618] lstrlenA (lpString="*.avi") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.618] lstrlenA (lpString="*.mp4") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.618] lstrlenA (lpString="*.wmv") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.618] lstrlenA (lpString="*.divx") returned 6 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.618] lstrlenA (lpString="*.mkv") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.618] lstrlenA (lpString="*.mp3") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.618] lstrlenA (lpString="*.wav") returned 5 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.618] lstrlenA (lpString="*.flac") returned 6 [0063.618] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.618] lstrlenA (lpString="*.ape") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.619] lstrlenA (lpString="*.wma") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.619] lstrlenA (lpString="*.ac3") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.619] lstrlenA (lpString="*.doc") returned 5 [0063.619] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.619] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.619] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.619] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.619] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.619] PathFindFileNameA (pszPath="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sv-SE\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\" [0063.619] PathAddBackslashA (in: pszPath="C:\\Boot\\sv-SE\\" | out: pszPath="C:\\Boot\\sv-SE\\") returned="" [0063.619] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" [0063.619] GetFileAttributesA (lpFileName="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sv-se\\how to decrypt files.txt")) returned 0x20 [0063.619] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\memtest.exe.mui") returned="C:\\Boot\\sv-SE\\memtest.exe.mui" [0063.619] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.619] lstrlenA (lpString="*.zip") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.619] lstrlenA (lpString="*.rar") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.619] lstrlenA (lpString="*.7z") returned 4 [0063.619] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.619] lstrlenA (lpString="*.tar") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.619] lstrlenA (lpString="*.gzip") returned 6 [0063.619] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.619] lstrlenA (lpString="*.jpg") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.619] lstrlenA (lpString="*.jpeg") returned 6 [0063.619] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.619] lstrlenA (lpString="*.psd") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.620] lstrlenA (lpString="*.cdr") returned 5 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.620] lstrlenA (lpString="*.dwg") returned 5 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.620] lstrlenA (lpString="*.max") returned 5 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.620] lstrlenA (lpString="*.bmp") returned 5 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.620] lstrlenA (lpString="*.gif") returned 5 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.620] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.621] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.622] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.622] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.622] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.622] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.622] FindClose (in: hFindFile=0x759b50 | out: hFindFile=0x759b50) returned 1 [0063.622] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0063.622] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1 [0063.622] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1 [0063.622] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.622] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR" [0063.622] FindFirstFileA (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0063.622] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.622] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.622] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.622] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.622] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.622] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.622] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.622] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.622] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.622] PathFindFileNameA (pszPath="C:\\Boot\\tr-TR\\*.*") returned="*.*" [0063.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\tr-TR\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\" [0063.623] PathAddBackslashA (in: pszPath="C:\\Boot\\tr-TR\\" | out: pszPath="C:\\Boot\\tr-TR\\") returned="" [0063.623] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" [0063.623] GetFileAttributesA (lpFileName="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\tr-tr\\how to decrypt files.txt")) returned 0xffffffff [0063.623] CreateFileA (lpFileName="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\tr-tr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.645] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.646] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.646] CloseHandle (hObject=0x208) returned 1 [0063.647] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.647] lstrlenA (lpString="*.zip") returned 5 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.647] lstrlenA (lpString="*.rar") returned 5 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.647] lstrlenA (lpString="*.7z") returned 4 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.647] lstrlenA (lpString="*.tar") returned 5 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.647] lstrlenA (lpString="*.gzip") returned 6 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.647] lstrlenA (lpString="*.jpg") returned 5 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.647] lstrlenA (lpString="*.jpeg") returned 6 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.647] lstrlenA (lpString="*.psd") returned 5 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.647] lstrlenA (lpString="*.cdr") returned 5 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.647] lstrlenA (lpString="*.dwg") returned 5 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.647] lstrlenA (lpString="*.max") returned 5 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.647] lstrlenA (lpString="*.bmp") returned 5 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.647] lstrlenA (lpString="*.gif") returned 5 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.647] lstrlenA (lpString="*.png") returned 5 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.647] lstrlenA (lpString="*.doc") returned 5 [0063.647] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.647] lstrlenA (lpString="*.docx") returned 6 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.648] lstrlenA (lpString="*.xls") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.648] lstrlenA (lpString="*.xlsx") returned 6 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.648] lstrlenA (lpString="*.ppt") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.648] lstrlenA (lpString="*.pptx") returned 6 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.648] lstrlenA (lpString="*.txt") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.648] lstrlenA (lpString="*.pdf") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.648] lstrlenA (lpString="*.djvu") returned 6 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.648] lstrlenA (lpString="*.htm") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.648] lstrlenA (lpString="*.html") returned 6 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.648] lstrlenA (lpString="*.mdb") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.648] lstrlenA (lpString="*.cer") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.648] lstrlenA (lpString="*.p12") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.648] lstrlenA (lpString="*.pfx") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.648] lstrlenA (lpString="*.kwm") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.648] lstrlenA (lpString="*.pwm") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.648] lstrlenA (lpString="*.1cd") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.648] lstrlenA (lpString="*.md") returned 4 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.648] lstrlenA (lpString="*.mdf") returned 5 [0063.648] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.648] lstrlenA (lpString="*.dbf") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.649] lstrlenA (lpString="*.odt") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.649] lstrlenA (lpString="*.vob") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.649] lstrlenA (lpString="*.ifo") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.649] lstrlenA (lpString="*.lnk") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.649] lstrlenA (lpString="*.torrent") returned 9 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.649] lstrlenA (lpString="*.mov") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.649] lstrlenA (lpString="*.m2v") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.649] lstrlenA (lpString="*.3gp") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.649] lstrlenA (lpString="*.mpeg") returned 6 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.649] lstrlenA (lpString="*.mpg") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.649] lstrlenA (lpString="*.flv") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.649] lstrlenA (lpString="*.avi") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.649] lstrlenA (lpString="*.mp4") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.649] lstrlenA (lpString="*.wmv") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.649] lstrlenA (lpString="*.divx") returned 6 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.649] lstrlenA (lpString="*.mkv") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.649] lstrlenA (lpString="*.mp3") returned 5 [0063.649] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.649] lstrlenA (lpString="*.wav") returned 5 [0063.650] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.650] lstrlenA (lpString="*.flac") returned 6 [0063.650] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.650] lstrlenA (lpString="*.ape") returned 5 [0063.650] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.650] lstrlenA (lpString="*.wma") returned 5 [0063.650] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.650] lstrlenA (lpString="*.ac3") returned 5 [0063.650] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.650] lstrlenA (lpString="*.doc") returned 5 [0063.650] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.650] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.650] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.650] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.650] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.650] PathFindFileNameA (pszPath="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\tr-TR\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\" [0063.650] PathAddBackslashA (in: pszPath="C:\\Boot\\tr-TR\\" | out: pszPath="C:\\Boot\\tr-TR\\") returned="" [0063.650] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" [0063.650] GetFileAttributesA (lpFileName="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\tr-tr\\how to decrypt files.txt")) returned 0x20 [0063.650] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\memtest.exe.mui") returned="C:\\Boot\\tr-TR\\memtest.exe.mui" [0063.650] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.651] lstrlenA (lpString="*.zip") returned 5 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.651] lstrlenA (lpString="*.rar") returned 5 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.651] lstrlenA (lpString="*.7z") returned 4 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.651] lstrlenA (lpString="*.tar") returned 5 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.651] lstrlenA (lpString="*.gzip") returned 6 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.651] lstrlenA (lpString="*.jpg") returned 5 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.651] lstrlenA (lpString="*.jpeg") returned 6 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.651] lstrlenA (lpString="*.psd") returned 5 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.651] lstrlenA (lpString="*.cdr") returned 5 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.651] lstrlenA (lpString="*.dwg") returned 5 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.651] lstrlenA (lpString="*.max") returned 5 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.651] lstrlenA (lpString="*.bmp") returned 5 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.651] lstrlenA (lpString="*.gif") returned 5 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.651] lstrlenA (lpString="*.png") returned 5 [0063.651] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.652] lstrlenA (lpString="*.doc") returned 5 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.652] lstrlenA (lpString="*.docx") returned 6 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.652] lstrlenA (lpString="*.xls") returned 5 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.652] lstrlenA (lpString="*.xlsx") returned 6 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.652] lstrlenA (lpString="*.ppt") returned 5 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.652] lstrlenA (lpString="*.pptx") returned 6 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.652] lstrlenA (lpString="*.txt") returned 5 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.652] lstrlenA (lpString="*.pdf") returned 5 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.652] lstrlenA (lpString="*.djvu") returned 6 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.652] lstrlenA (lpString="*.htm") returned 5 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.652] lstrlenA (lpString="*.html") returned 6 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.652] lstrlenA (lpString="*.mdb") returned 5 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.652] lstrlenA (lpString="*.cer") returned 5 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.652] lstrlenA (lpString="*.p12") returned 5 [0063.652] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.653] lstrlenA (lpString="*.pfx") returned 5 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.653] lstrlenA (lpString="*.kwm") returned 5 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.653] lstrlenA (lpString="*.pwm") returned 5 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.653] lstrlenA (lpString="*.1cd") returned 5 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.653] lstrlenA (lpString="*.md") returned 4 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.653] lstrlenA (lpString="*.mdf") returned 5 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.653] lstrlenA (lpString="*.dbf") returned 5 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.653] lstrlenA (lpString="*.odt") returned 5 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.653] lstrlenA (lpString="*.vob") returned 5 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.653] lstrlenA (lpString="*.ifo") returned 5 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.653] lstrlenA (lpString="*.lnk") returned 5 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.653] lstrlenA (lpString="*.torrent") returned 9 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.653] lstrlenA (lpString="*.mov") returned 5 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.653] lstrlenA (lpString="*.m2v") returned 5 [0063.653] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.653] lstrlenA (lpString="*.3gp") returned 5 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.654] lstrlenA (lpString="*.mpeg") returned 6 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.654] lstrlenA (lpString="*.mpg") returned 5 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.654] lstrlenA (lpString="*.flv") returned 5 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.654] lstrlenA (lpString="*.avi") returned 5 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.654] lstrlenA (lpString="*.mp4") returned 5 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.654] lstrlenA (lpString="*.wmv") returned 5 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.654] lstrlenA (lpString="*.divx") returned 6 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.654] lstrlenA (lpString="*.mkv") returned 5 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.654] lstrlenA (lpString="*.mp3") returned 5 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.654] lstrlenA (lpString="*.wav") returned 5 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.654] lstrlenA (lpString="*.flac") returned 6 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.654] lstrlenA (lpString="*.ape") returned 5 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.654] lstrlenA (lpString="*.wma") returned 5 [0063.654] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.654] lstrlenA (lpString="*.ac3") returned 5 [0063.655] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.655] lstrlenA (lpString="*.doc") returned 5 [0063.655] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.655] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0063.656] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0063.656] lstrcmpA (lpString1=".", lpString2="uk-UA") returned -1 [0063.656] lstrcmpA (lpString1="..", lpString2="uk-UA") returned -1 [0063.656] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.656] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="uk-UA" | out: lpString1="C:\\Boot\\uk-UA") returned="C:\\Boot\\uk-UA" [0063.656] lstrlenA (lpString="C:\\Boot\\uk-UA") returned 13 [0063.656] FindFirstFileA (in: lpFileName="C:\\Boot\\uk-UA\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0063.657] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.657] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.658] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.658] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.658] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.658] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.658] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.658] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.658] PathFindFileNameA (pszPath="C:\\Boot\\uk-UA\\*.*") returned="*.*" [0063.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\uk-UA\\" | out: lpString1="C:\\Boot\\uk-UA\\") returned="C:\\Boot\\uk-UA\\" [0063.658] PathAddBackslashA (in: pszPath="C:\\Boot\\uk-UA\\" | out: pszPath="C:\\Boot\\uk-UA\\") returned="" [0063.658] lstrcatA (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\uk-UA\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\uk-UA\\HOW TO DECRYPT FILES.txt" [0063.658] GetFileAttributesA (lpFileName="C:\\Boot\\uk-UA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\uk-ua\\how to decrypt files.txt")) returned 0xffffffff [0063.658] CreateFileA (lpFileName="C:\\Boot\\uk-UA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\uk-ua\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.659] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.659] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.660] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.660] CloseHandle (hObject=0x208) returned 1 [0063.661] lstrcatA (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned="C:\\Boot\\uk-UA\\bootmgr.exe.mui" [0063.661] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.661] lstrlenA (lpString="*.zip") returned 5 [0063.661] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.661] lstrlenA (lpString="*.rar") returned 5 [0063.661] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.661] lstrlenA (lpString="*.7z") returned 4 [0063.661] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.661] lstrlenA (lpString="*.tar") returned 5 [0063.661] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.661] lstrlenA (lpString="*.gzip") returned 6 [0063.661] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.661] lstrlenA (lpString="*.jpg") returned 5 [0063.661] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.661] lstrlenA (lpString="*.jpeg") returned 6 [0063.661] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.661] lstrlenA (lpString="*.psd") returned 5 [0063.661] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.661] lstrlenA (lpString="*.cdr") returned 5 [0063.661] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.661] lstrlenA (lpString="*.dwg") returned 5 [0063.661] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.662] lstrlenA (lpString="*.max") returned 5 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.662] lstrlenA (lpString="*.bmp") returned 5 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.662] lstrlenA (lpString="*.gif") returned 5 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.662] lstrlenA (lpString="*.png") returned 5 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.662] lstrlenA (lpString="*.doc") returned 5 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.662] lstrlenA (lpString="*.docx") returned 6 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.662] lstrlenA (lpString="*.xls") returned 5 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.662] lstrlenA (lpString="*.xlsx") returned 6 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.662] lstrlenA (lpString="*.ppt") returned 5 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.662] lstrlenA (lpString="*.pptx") returned 6 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.662] lstrlenA (lpString="*.txt") returned 5 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.662] lstrlenA (lpString="*.pdf") returned 5 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.662] lstrlenA (lpString="*.djvu") returned 6 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.662] lstrlenA (lpString="*.htm") returned 5 [0063.662] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.662] lstrlenA (lpString="*.html") returned 6 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.663] lstrlenA (lpString="*.mdb") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.663] lstrlenA (lpString="*.cer") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.663] lstrlenA (lpString="*.p12") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.663] lstrlenA (lpString="*.pfx") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.663] lstrlenA (lpString="*.kwm") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.663] lstrlenA (lpString="*.pwm") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.663] lstrlenA (lpString="*.1cd") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.663] lstrlenA (lpString="*.md") returned 4 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.663] lstrlenA (lpString="*.mdf") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.663] lstrlenA (lpString="*.dbf") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.663] lstrlenA (lpString="*.odt") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.663] lstrlenA (lpString="*.vob") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.663] lstrlenA (lpString="*.ifo") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.663] lstrlenA (lpString="*.lnk") returned 5 [0063.663] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.663] lstrlenA (lpString="*.torrent") returned 9 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.664] lstrlenA (lpString="*.mov") returned 5 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.664] lstrlenA (lpString="*.m2v") returned 5 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.664] lstrlenA (lpString="*.3gp") returned 5 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.664] lstrlenA (lpString="*.mpeg") returned 6 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.664] lstrlenA (lpString="*.mpg") returned 5 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.664] lstrlenA (lpString="*.flv") returned 5 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.664] lstrlenA (lpString="*.avi") returned 5 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.664] lstrlenA (lpString="*.mp4") returned 5 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.664] lstrlenA (lpString="*.wmv") returned 5 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.664] lstrlenA (lpString="*.divx") returned 6 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.664] lstrlenA (lpString="*.mkv") returned 5 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.664] lstrlenA (lpString="*.mp3") returned 5 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.664] lstrlenA (lpString="*.wav") returned 5 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.664] lstrlenA (lpString="*.flac") returned 6 [0063.664] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.664] lstrlenA (lpString="*.ape") returned 5 [0063.665] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.665] lstrlenA (lpString="*.wma") returned 5 [0063.665] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.665] lstrlenA (lpString="*.ac3") returned 5 [0063.665] PathMatchSpecA (pszFile="C:\\Boot\\uk-UA\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.665] lstrlenA (lpString="*.doc") returned 5 [0063.665] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.665] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0063.665] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0063.665] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.665] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="updaterevokesipolicy.p7b") returned -1 [0063.665] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="updaterevokesipolicy.p7b") returned -1 [0063.665] lstrcmpiA (lpString1="", lpString2="updaterevokesipolicy.p7b") returned -1 [0063.665] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0063.665] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0063.665] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0063.665] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0063.665] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="updaterevokesipolicy.p7b" | out: lpString1="C:\\Boot\\updaterevokesipolicy.p7b") returned="C:\\Boot\\updaterevokesipolicy.p7b" [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.zip") returned 0 [0063.666] lstrlenA (lpString="*.zip") returned 5 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.rar") returned 0 [0063.666] lstrlenA (lpString="*.rar") returned 5 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.7z") returned 0 [0063.666] lstrlenA (lpString="*.7z") returned 4 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.tar") returned 0 [0063.666] lstrlenA (lpString="*.tar") returned 5 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.gzip") returned 0 [0063.666] lstrlenA (lpString="*.gzip") returned 6 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.jpg") returned 0 [0063.666] lstrlenA (lpString="*.jpg") returned 5 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.jpeg") returned 0 [0063.666] lstrlenA (lpString="*.jpeg") returned 6 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.psd") returned 0 [0063.666] lstrlenA (lpString="*.psd") returned 5 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.cdr") returned 0 [0063.666] lstrlenA (lpString="*.cdr") returned 5 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.dwg") returned 0 [0063.666] lstrlenA (lpString="*.dwg") returned 5 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.max") returned 0 [0063.666] lstrlenA (lpString="*.max") returned 5 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.bmp") returned 0 [0063.666] lstrlenA (lpString="*.bmp") returned 5 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.gif") returned 0 [0063.666] lstrlenA (lpString="*.gif") returned 5 [0063.666] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.png") returned 0 [0063.666] lstrlenA (lpString="*.png") returned 5 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.doc") returned 0 [0063.667] lstrlenA (lpString="*.doc") returned 5 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.docx") returned 0 [0063.667] lstrlenA (lpString="*.docx") returned 6 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.xls") returned 0 [0063.667] lstrlenA (lpString="*.xls") returned 5 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.xlsx") returned 0 [0063.667] lstrlenA (lpString="*.xlsx") returned 6 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.ppt") returned 0 [0063.667] lstrlenA (lpString="*.ppt") returned 5 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.pptx") returned 0 [0063.667] lstrlenA (lpString="*.pptx") returned 6 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.txt") returned 0 [0063.667] lstrlenA (lpString="*.txt") returned 5 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.pdf") returned 0 [0063.667] lstrlenA (lpString="*.pdf") returned 5 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.djvu") returned 0 [0063.667] lstrlenA (lpString="*.djvu") returned 6 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.htm") returned 0 [0063.667] lstrlenA (lpString="*.htm") returned 5 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.html") returned 0 [0063.667] lstrlenA (lpString="*.html") returned 6 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.mdb") returned 0 [0063.667] lstrlenA (lpString="*.mdb") returned 5 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.cer") returned 0 [0063.667] lstrlenA (lpString="*.cer") returned 5 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.p12") returned 0 [0063.667] lstrlenA (lpString="*.p12") returned 5 [0063.667] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.pfx") returned 0 [0063.668] lstrlenA (lpString="*.pfx") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.kwm") returned 0 [0063.668] lstrlenA (lpString="*.kwm") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.pwm") returned 0 [0063.668] lstrlenA (lpString="*.pwm") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.1cd") returned 0 [0063.668] lstrlenA (lpString="*.1cd") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.md") returned 0 [0063.668] lstrlenA (lpString="*.md") returned 4 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.mdf") returned 0 [0063.668] lstrlenA (lpString="*.mdf") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.dbf") returned 0 [0063.668] lstrlenA (lpString="*.dbf") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.odt") returned 0 [0063.668] lstrlenA (lpString="*.odt") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.vob") returned 0 [0063.668] lstrlenA (lpString="*.vob") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.ifo") returned 0 [0063.668] lstrlenA (lpString="*.ifo") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.lnk") returned 0 [0063.668] lstrlenA (lpString="*.lnk") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.torrent") returned 0 [0063.668] lstrlenA (lpString="*.torrent") returned 9 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.mov") returned 0 [0063.668] lstrlenA (lpString="*.mov") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.m2v") returned 0 [0063.668] lstrlenA (lpString="*.m2v") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.3gp") returned 0 [0063.668] lstrlenA (lpString="*.3gp") returned 5 [0063.668] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.mpeg") returned 0 [0063.669] lstrlenA (lpString="*.mpeg") returned 6 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.mpg") returned 0 [0063.669] lstrlenA (lpString="*.mpg") returned 5 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.flv") returned 0 [0063.669] lstrlenA (lpString="*.flv") returned 5 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.avi") returned 0 [0063.669] lstrlenA (lpString="*.avi") returned 5 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.mp4") returned 0 [0063.669] lstrlenA (lpString="*.mp4") returned 5 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.wmv") returned 0 [0063.669] lstrlenA (lpString="*.wmv") returned 5 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.divx") returned 0 [0063.669] lstrlenA (lpString="*.divx") returned 6 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.mkv") returned 0 [0063.669] lstrlenA (lpString="*.mkv") returned 5 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.mp3") returned 0 [0063.669] lstrlenA (lpString="*.mp3") returned 5 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.wav") returned 0 [0063.669] lstrlenA (lpString="*.wav") returned 5 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.flac") returned 0 [0063.669] lstrlenA (lpString="*.flac") returned 6 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.ape") returned 0 [0063.669] lstrlenA (lpString="*.ape") returned 5 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.wma") returned 0 [0063.669] lstrlenA (lpString="*.wma") returned 5 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.ac3") returned 0 [0063.669] lstrlenA (lpString="*.ac3") returned 5 [0063.669] PathMatchSpecA (pszFile="C:\\Boot\\updaterevokesipolicy.p7b", pszSpec="*.doc") returned 0 [0063.669] lstrlenA (lpString="*.doc") returned 5 [0063.670] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0063.670] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1 [0063.670] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1 [0063.670] PathFindFileNameA (pszPath="C:\\Boot\\updaterevokesipolicy.p7b") returned="updaterevokesipolicy.p7b" [0063.670] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN" [0063.670] lstrlenA (lpString="C:\\Boot\\zh-CN") returned 13 [0063.670] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x58, cFileName=".", cAlternateFileName="")) returned 0x759fd0 [0063.674] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.674] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x58, cFileName="..", cAlternateFileName="")) returned 1 [0063.675] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.675] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.675] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x740000, dwReserved1=0x58, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.675] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.675] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.675] PathFindFileNameA (pszPath="C:\\Boot\\zh-CN\\*.*") returned="*.*" [0063.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-CN\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\" [0063.675] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-CN\\" | out: pszPath="C:\\Boot\\zh-CN\\") returned="" [0063.675] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" [0063.675] GetFileAttributesA (lpFileName="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-cn\\how to decrypt files.txt")) returned 0xffffffff [0063.675] CreateFileA (lpFileName="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-cn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.677] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.677] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.679] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.679] CloseHandle (hObject=0x208) returned 1 [0063.679] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0063.679] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.679] lstrlenA (lpString="*.zip") returned 5 [0063.679] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.679] lstrlenA (lpString="*.rar") returned 5 [0063.679] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.679] lstrlenA (lpString="*.7z") returned 4 [0063.679] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.679] lstrlenA (lpString="*.tar") returned 5 [0063.679] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.679] lstrlenA (lpString="*.gzip") returned 6 [0063.679] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.679] lstrlenA (lpString="*.jpg") returned 5 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.680] lstrlenA (lpString="*.jpeg") returned 6 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.680] lstrlenA (lpString="*.psd") returned 5 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.680] lstrlenA (lpString="*.cdr") returned 5 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.680] lstrlenA (lpString="*.dwg") returned 5 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.680] lstrlenA (lpString="*.max") returned 5 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.680] lstrlenA (lpString="*.bmp") returned 5 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.680] lstrlenA (lpString="*.gif") returned 5 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.680] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.681] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.682] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.682] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.682] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.682] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.682] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.682] PathFindFileNameA (pszPath="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-CN\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\" [0063.683] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-CN\\" | out: pszPath="C:\\Boot\\zh-CN\\") returned="" [0063.683] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" [0063.683] GetFileAttributesA (lpFileName="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-cn\\how to decrypt files.txt")) returned 0x20 [0063.683] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\memtest.exe.mui") returned="C:\\Boot\\zh-CN\\memtest.exe.mui" [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.683] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.684] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.685] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.686] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.686] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.686] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.686] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.686] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.686] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.686] FindClose (in: hFindFile=0x759fd0 | out: hFindFile=0x759fd0) returned 1 [0063.686] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0063.686] lstrcmpA (lpString1=".", lpString2="zh-HK") returned -1 [0063.686] lstrcmpA (lpString1="..", lpString2="zh-HK") returned -1 [0063.824] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.824] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK" [0063.824] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0063.825] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.825] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.825] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.825] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.825] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.825] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.825] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.825] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.825] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.825] PathFindFileNameA (pszPath="C:\\Boot\\zh-HK\\*.*") returned="*.*" [0063.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-HK\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\" [0063.825] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-HK\\" | out: pszPath="C:\\Boot\\zh-HK\\") returned="" [0063.825] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" [0063.825] GetFileAttributesA (lpFileName="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-hk\\how to decrypt files.txt")) returned 0xffffffff [0063.825] CreateFileA (lpFileName="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-hk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.829] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.830] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.830] CloseHandle (hObject=0x208) returned 1 [0063.830] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0063.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.830] lstrlenA (lpString="*.zip") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.830] lstrlenA (lpString="*.rar") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.830] lstrlenA (lpString="*.7z") returned 4 [0063.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.830] lstrlenA (lpString="*.tar") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.830] lstrlenA (lpString="*.gzip") returned 6 [0063.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.830] lstrlenA (lpString="*.jpg") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.830] lstrlenA (lpString="*.jpeg") returned 6 [0063.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.830] lstrlenA (lpString="*.psd") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.830] lstrlenA (lpString="*.cdr") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.830] lstrlenA (lpString="*.dwg") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.831] lstrlenA (lpString="*.max") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.831] lstrlenA (lpString="*.bmp") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.831] lstrlenA (lpString="*.gif") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.831] lstrlenA (lpString="*.png") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.831] lstrlenA (lpString="*.doc") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.831] lstrlenA (lpString="*.docx") returned 6 [0063.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.831] lstrlenA (lpString="*.xls") returned 5 [0063.831] lstrlenA (lpString="*.xlsx") returned 6 [0063.831] lstrlenA (lpString="*.ppt") returned 5 [0063.831] lstrlenA (lpString="*.pptx") returned 6 [0063.831] lstrlenA (lpString="*.txt") returned 5 [0063.831] lstrlenA (lpString="*.pdf") returned 5 [0063.831] lstrlenA (lpString="*.djvu") returned 6 [0063.831] lstrlenA (lpString="*.htm") returned 5 [0063.831] lstrlenA (lpString="*.html") returned 6 [0063.831] lstrlenA (lpString="*.mdb") returned 5 [0063.832] lstrlenA (lpString="*.cer") returned 5 [0063.832] lstrlenA (lpString="*.p12") returned 5 [0063.832] lstrlenA (lpString="*.pfx") returned 5 [0063.832] lstrlenA (lpString="*.kwm") returned 5 [0063.832] lstrlenA (lpString="*.pwm") returned 5 [0063.832] lstrlenA (lpString="*.1cd") returned 5 [0063.832] lstrlenA (lpString="*.md") returned 4 [0063.832] lstrlenA (lpString="*.mdf") returned 5 [0063.832] lstrlenA (lpString="*.dbf") returned 5 [0063.832] lstrlenA (lpString="*.odt") returned 5 [0063.832] lstrlenA (lpString="*.vob") returned 5 [0063.832] lstrlenA (lpString="*.ifo") returned 5 [0063.832] lstrlenA (lpString="*.lnk") returned 5 [0063.832] lstrlenA (lpString="*.torrent") returned 9 [0063.832] lstrlenA (lpString="*.mov") returned 5 [0063.832] lstrlenA (lpString="*.m2v") returned 5 [0063.832] lstrlenA (lpString="*.3gp") returned 5 [0063.832] lstrlenA (lpString="*.mpeg") returned 6 [0063.832] lstrlenA (lpString="*.mpg") returned 5 [0063.832] lstrlenA (lpString="*.flv") returned 5 [0063.832] lstrlenA (lpString="*.avi") returned 5 [0063.832] lstrlenA (lpString="*.mp4") returned 5 [0063.832] lstrlenA (lpString="*.wmv") returned 5 [0063.832] lstrlenA (lpString="*.divx") returned 6 [0063.832] lstrlenA (lpString="*.mkv") returned 5 [0063.832] lstrlenA (lpString="*.mp3") returned 5 [0063.833] lstrlenA (lpString="*.wav") returned 5 [0063.833] lstrlenA (lpString="*.flac") returned 6 [0063.833] lstrlenA (lpString="*.ape") returned 5 [0063.833] lstrlenA (lpString="*.wma") returned 5 [0063.833] lstrlenA (lpString="*.ac3") returned 5 [0063.833] lstrlenA (lpString="*.doc") returned 5 [0063.833] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.833] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.833] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.833] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.833] PathFindFileNameA (pszPath="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-HK\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\" [0063.833] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-HK\\" | out: pszPath="C:\\Boot\\zh-HK\\") returned="" [0063.833] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" [0063.833] GetFileAttributesA (lpFileName="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-hk\\how to decrypt files.txt")) returned 0x20 [0063.833] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\memtest.exe.mui") returned="C:\\Boot\\zh-HK\\memtest.exe.mui" [0063.833] lstrlenA (lpString="*.zip") returned 5 [0063.833] lstrlenA (lpString="*.rar") returned 5 [0063.833] lstrlenA (lpString="*.7z") returned 4 [0063.833] lstrlenA (lpString="*.tar") returned 5 [0063.833] lstrlenA (lpString="*.gzip") returned 6 [0063.833] lstrlenA (lpString="*.jpg") returned 5 [0063.833] lstrlenA (lpString="*.jpeg") returned 6 [0063.833] lstrlenA (lpString="*.psd") returned 5 [0063.833] lstrlenA (lpString="*.cdr") returned 5 [0063.834] lstrlenA (lpString="*.dwg") returned 5 [0063.834] lstrlenA (lpString="*.max") returned 5 [0063.834] lstrlenA (lpString="*.bmp") returned 5 [0063.834] lstrlenA (lpString="*.gif") returned 5 [0063.834] lstrlenA (lpString="*.png") returned 5 [0063.834] lstrlenA (lpString="*.doc") returned 5 [0063.834] lstrlenA (lpString="*.docx") returned 6 [0063.834] lstrlenA (lpString="*.xls") returned 5 [0063.834] lstrlenA (lpString="*.xlsx") returned 6 [0063.834] lstrlenA (lpString="*.ppt") returned 5 [0063.834] lstrlenA (lpString="*.pptx") returned 6 [0063.834] lstrlenA (lpString="*.txt") returned 5 [0063.834] lstrlenA (lpString="*.pdf") returned 5 [0063.834] lstrlenA (lpString="*.djvu") returned 6 [0063.834] lstrlenA (lpString="*.htm") returned 5 [0063.834] lstrlenA (lpString="*.html") returned 6 [0063.834] lstrlenA (lpString="*.mdb") returned 5 [0063.834] lstrlenA (lpString="*.cer") returned 5 [0063.834] lstrlenA (lpString="*.p12") returned 5 [0063.834] lstrlenA (lpString="*.pfx") returned 5 [0063.834] lstrlenA (lpString="*.kwm") returned 5 [0063.834] lstrlenA (lpString="*.pwm") returned 5 [0063.834] lstrlenA (lpString="*.1cd") returned 5 [0063.834] lstrlenA (lpString="*.md") returned 4 [0063.834] lstrlenA (lpString="*.mdf") returned 5 [0063.834] lstrlenA (lpString="*.dbf") returned 5 [0063.835] lstrlenA (lpString="*.odt") returned 5 [0063.835] lstrlenA (lpString="*.vob") returned 5 [0063.835] lstrlenA (lpString="*.ifo") returned 5 [0063.835] lstrlenA (lpString="*.lnk") returned 5 [0063.835] lstrlenA (lpString="*.torrent") returned 9 [0063.835] lstrlenA (lpString="*.mov") returned 5 [0063.835] lstrlenA (lpString="*.m2v") returned 5 [0063.835] lstrlenA (lpString="*.3gp") returned 5 [0063.835] lstrlenA (lpString="*.mpeg") returned 6 [0063.835] lstrlenA (lpString="*.mpg") returned 5 [0063.835] lstrlenA (lpString="*.flv") returned 5 [0063.835] lstrlenA (lpString="*.avi") returned 5 [0063.835] lstrlenA (lpString="*.mp4") returned 5 [0063.835] lstrlenA (lpString="*.wmv") returned 5 [0063.835] lstrlenA (lpString="*.divx") returned 6 [0063.835] lstrlenA (lpString="*.mkv") returned 5 [0063.835] lstrlenA (lpString="*.mp3") returned 5 [0063.835] lstrlenA (lpString="*.wav") returned 5 [0063.835] lstrlenA (lpString="*.flac") returned 6 [0063.835] lstrlenA (lpString="*.ape") returned 5 [0063.835] lstrlenA (lpString="*.wma") returned 5 [0063.835] lstrlenA (lpString="*.ac3") returned 5 [0063.835] lstrlenA (lpString="*.doc") returned 5 [0063.835] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.835] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0063.836] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0063.836] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1 [0063.836] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1 [0063.836] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0063.836] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW" [0063.836] lstrlenA (lpString="C:\\Boot\\zh-TW") returned 13 [0063.836] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0063.836] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.836] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.837] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.837] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.837] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.837] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.837] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0063.837] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0063.837] PathFindFileNameA (pszPath="C:\\Boot\\zh-TW\\*.*") returned="*.*" [0063.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-TW\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\" [0063.837] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-TW\\" | out: pszPath="C:\\Boot\\zh-TW\\") returned="" [0063.837] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" [0063.837] GetFileAttributesA (lpFileName="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-tw\\how to decrypt files.txt")) returned 0xffffffff [0063.837] CreateFileA (lpFileName="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-tw\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.839] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.839] WriteFile (in: hFile=0x208, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.840] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.840] CloseHandle (hObject=0x208) returned 1 [0063.840] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0063.840] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0063.840] lstrlenA (lpString="*.zip") returned 5 [0063.840] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0063.840] lstrlenA (lpString="*.rar") returned 5 [0063.840] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0063.840] lstrlenA (lpString="*.7z") returned 4 [0063.840] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0063.840] lstrlenA (lpString="*.tar") returned 5 [0063.840] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0063.841] lstrlenA (lpString="*.gzip") returned 6 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0063.841] lstrlenA (lpString="*.jpg") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0063.841] lstrlenA (lpString="*.jpeg") returned 6 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0063.841] lstrlenA (lpString="*.psd") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0063.841] lstrlenA (lpString="*.cdr") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0063.841] lstrlenA (lpString="*.dwg") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0063.841] lstrlenA (lpString="*.max") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0063.841] lstrlenA (lpString="*.bmp") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0063.841] lstrlenA (lpString="*.gif") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0063.841] lstrlenA (lpString="*.png") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.841] lstrlenA (lpString="*.doc") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0063.841] lstrlenA (lpString="*.docx") returned 6 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0063.841] lstrlenA (lpString="*.xls") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0063.841] lstrlenA (lpString="*.xlsx") returned 6 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0063.841] lstrlenA (lpString="*.ppt") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0063.841] lstrlenA (lpString="*.pptx") returned 6 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0063.841] lstrlenA (lpString="*.txt") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0063.841] lstrlenA (lpString="*.pdf") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0063.841] lstrlenA (lpString="*.djvu") returned 6 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0063.842] lstrlenA (lpString="*.htm") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0063.842] lstrlenA (lpString="*.html") returned 6 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0063.842] lstrlenA (lpString="*.mdb") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0063.842] lstrlenA (lpString="*.cer") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0063.842] lstrlenA (lpString="*.p12") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0063.842] lstrlenA (lpString="*.pfx") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0063.842] lstrlenA (lpString="*.kwm") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0063.842] lstrlenA (lpString="*.pwm") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0063.842] lstrlenA (lpString="*.1cd") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0063.842] lstrlenA (lpString="*.md") returned 4 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0063.842] lstrlenA (lpString="*.mdf") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0063.842] lstrlenA (lpString="*.dbf") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0063.842] lstrlenA (lpString="*.odt") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0063.842] lstrlenA (lpString="*.vob") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0063.842] lstrlenA (lpString="*.ifo") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0063.843] lstrlenA (lpString="*.lnk") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0063.843] lstrlenA (lpString="*.torrent") returned 9 [0063.843] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0063.843] lstrlenA (lpString="*.mov") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0063.843] lstrlenA (lpString="*.m2v") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0063.843] lstrlenA (lpString="*.3gp") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0063.843] lstrlenA (lpString="*.mpeg") returned 6 [0063.843] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0063.843] lstrlenA (lpString="*.mpg") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0063.843] lstrlenA (lpString="*.flv") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0063.843] lstrlenA (lpString="*.avi") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0063.843] lstrlenA (lpString="*.mp4") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0063.843] lstrlenA (lpString="*.wmv") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0063.843] lstrlenA (lpString="*.divx") returned 6 [0063.844] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0063.844] lstrlenA (lpString="*.mkv") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0063.844] lstrlenA (lpString="*.mp3") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0063.844] lstrlenA (lpString="*.wav") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0063.844] lstrlenA (lpString="*.flac") returned 6 [0063.844] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0063.844] lstrlenA (lpString="*.ape") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0063.844] lstrlenA (lpString="*.wma") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0063.844] lstrlenA (lpString="*.ac3") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0063.844] lstrlenA (lpString="*.doc") returned 5 [0063.844] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.844] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0063.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0063.844] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0063.844] PathFindFileNameA (pszPath="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0063.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-TW\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\" [0063.844] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-TW\\" | out: pszPath="C:\\Boot\\zh-TW\\") returned="" [0063.844] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" [0063.844] GetFileAttributesA (lpFileName="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-tw\\how to decrypt files.txt")) returned 0x20 [0063.844] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\memtest.exe.mui") returned="C:\\Boot\\zh-TW\\memtest.exe.mui" [0063.844] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0063.844] lstrlenA (lpString="*.zip") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0063.844] lstrlenA (lpString="*.rar") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0063.845] lstrlenA (lpString="*.7z") returned 4 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0063.845] lstrlenA (lpString="*.tar") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0063.845] lstrlenA (lpString="*.gzip") returned 6 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0063.845] lstrlenA (lpString="*.jpg") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0063.845] lstrlenA (lpString="*.jpeg") returned 6 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0063.845] lstrlenA (lpString="*.psd") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0063.845] lstrlenA (lpString="*.cdr") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0063.845] lstrlenA (lpString="*.dwg") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.max") returned 0 [0063.845] lstrlenA (lpString="*.max") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0063.845] lstrlenA (lpString="*.bmp") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0063.845] lstrlenA (lpString="*.gif") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.png") returned 0 [0063.845] lstrlenA (lpString="*.png") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.845] lstrlenA (lpString="*.doc") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0063.845] lstrlenA (lpString="*.docx") returned 6 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0063.845] lstrlenA (lpString="*.xls") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0063.845] lstrlenA (lpString="*.xlsx") returned 6 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0063.845] lstrlenA (lpString="*.ppt") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0063.845] lstrlenA (lpString="*.pptx") returned 6 [0063.845] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0063.845] lstrlenA (lpString="*.txt") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0063.846] lstrlenA (lpString="*.pdf") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0063.846] lstrlenA (lpString="*.djvu") returned 6 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0063.846] lstrlenA (lpString="*.htm") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.html") returned 0 [0063.846] lstrlenA (lpString="*.html") returned 6 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0063.846] lstrlenA (lpString="*.mdb") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0063.846] lstrlenA (lpString="*.cer") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0063.846] lstrlenA (lpString="*.p12") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0063.846] lstrlenA (lpString="*.pfx") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0063.846] lstrlenA (lpString="*.kwm") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0063.846] lstrlenA (lpString="*.pwm") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0063.846] lstrlenA (lpString="*.1cd") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.md") returned 0 [0063.846] lstrlenA (lpString="*.md") returned 4 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0063.846] lstrlenA (lpString="*.mdf") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0063.846] lstrlenA (lpString="*.dbf") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0063.846] lstrlenA (lpString="*.odt") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0063.846] lstrlenA (lpString="*.vob") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0063.846] lstrlenA (lpString="*.ifo") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0063.846] lstrlenA (lpString="*.lnk") returned 5 [0063.846] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0063.847] lstrlenA (lpString="*.torrent") returned 9 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0063.847] lstrlenA (lpString="*.mov") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0063.847] lstrlenA (lpString="*.m2v") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0063.847] lstrlenA (lpString="*.3gp") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0063.847] lstrlenA (lpString="*.mpeg") returned 6 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0063.847] lstrlenA (lpString="*.mpg") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0063.847] lstrlenA (lpString="*.flv") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0063.847] lstrlenA (lpString="*.avi") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0063.847] lstrlenA (lpString="*.mp4") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0063.847] lstrlenA (lpString="*.wmv") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0063.847] lstrlenA (lpString="*.divx") returned 6 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0063.847] lstrlenA (lpString="*.mkv") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0063.847] lstrlenA (lpString="*.mp3") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0063.847] lstrlenA (lpString="*.wav") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0063.847] lstrlenA (lpString="*.flac") returned 6 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0063.847] lstrlenA (lpString="*.ape") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0063.847] lstrlenA (lpString="*.wma") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0063.847] lstrlenA (lpString="*.ac3") returned 5 [0063.847] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0063.847] lstrlenA (lpString="*.doc") returned 5 [0063.848] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.848] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0063.848] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0063.848] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0063.848] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0063.848] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0 [0063.848] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr") returned 1 [0063.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr") returned 1 [0063.848] lstrcmpiA (lpString1="", lpString2="bootmgr") returned -1 [0063.848] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0063.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0063.848] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0063.848] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0063.848] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0063.848] lstrcatA (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0063.848] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.zip") returned 0 [0063.848] lstrlenA (lpString="*.zip") returned 5 [0063.848] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.rar") returned 0 [0063.848] lstrlenA (lpString="*.rar") returned 5 [0063.848] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.7z") returned 0 [0063.848] lstrlenA (lpString="*.7z") returned 4 [0063.848] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.tar") returned 0 [0063.848] lstrlenA (lpString="*.tar") returned 5 [0063.848] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gzip") returned 0 [0063.848] lstrlenA (lpString="*.gzip") returned 6 [0063.848] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpg") returned 0 [0063.848] lstrlenA (lpString="*.jpg") returned 5 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpeg") returned 0 [0063.849] lstrlenA (lpString="*.jpeg") returned 6 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.psd") returned 0 [0063.849] lstrlenA (lpString="*.psd") returned 5 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cdr") returned 0 [0063.849] lstrlenA (lpString="*.cdr") returned 5 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.dwg") returned 0 [0063.849] lstrlenA (lpString="*.dwg") returned 5 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.max") returned 0 [0063.849] lstrlenA (lpString="*.max") returned 5 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.bmp") returned 0 [0063.849] lstrlenA (lpString="*.bmp") returned 5 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gif") returned 0 [0063.849] lstrlenA (lpString="*.gif") returned 5 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.png") returned 0 [0063.849] lstrlenA (lpString="*.png") returned 5 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.doc") returned 0 [0063.849] lstrlenA (lpString="*.doc") returned 5 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.docx") returned 0 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xls") returned 0 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xlsx") returned 0 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ppt") returned 0 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pptx") returned 0 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.txt") returned 0 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pdf") returned 0 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.djvu") returned 0 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.htm") returned 0 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.html") returned 0 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mdb") returned 0 [0063.849] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cer") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.p12") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pfx") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.kwm") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pwm") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.1cd") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.md") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mdf") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.dbf") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.odt") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vob") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ifo") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.lnk") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.torrent") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mov") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.m2v") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.3gp") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mpeg") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mpg") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.flv") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.avi") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mp4") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wmv") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.divx") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mkv") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mp3") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wav") returned 0 [0063.850] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.flac") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ape") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wma") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ac3") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.doc") returned 0 [0063.851] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0063.851] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0 [0063.851] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOOTNXT") returned 1 [0063.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTNXT") returned 1 [0063.851] lstrcmpiA (lpString1="", lpString2="BOOTNXT") returned -1 [0063.851] PathFindFileNameA (pszPath="C:\\bootmgr") returned="bootmgr" [0063.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0063.851] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0063.851] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0063.851] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0063.851] lstrcatA (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.zip") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.rar") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.7z") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.tar") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.gzip") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.jpg") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.jpeg") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.psd") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.cdr") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.dwg") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.max") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.bmp") returned 0 [0063.851] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.gif") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.png") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.doc") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.docx") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.xls") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.xlsx") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.ppt") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.pptx") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.txt") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.pdf") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.djvu") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.htm") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.html") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.mdb") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.cer") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.p12") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.pfx") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.kwm") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.pwm") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.1cd") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.md") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.mdf") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.dbf") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.odt") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.vob") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.ifo") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.lnk") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.torrent") returned 0 [0063.852] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.mov") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.m2v") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.3gp") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.mpeg") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.mpg") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.flv") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.avi") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.mp4") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.wmv") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.divx") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.mkv") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.mp3") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.wav") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.flac") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.ape") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.wma") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.ac3") returned 0 [0063.853] PathMatchSpecA (pszFile="C:\\BOOTNXT", pszSpec="*.doc") returned 0 [0063.853] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0063.853] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0 [0063.853] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOOTSECT.BAK") returned 1 [0063.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTSECT.BAK") returned 1 [0063.853] lstrcmpiA (lpString1="", lpString2="BOOTSECT.BAK") returned -1 [0063.853] PathFindFileNameA (pszPath="C:\\BOOTNXT") returned="BOOTNXT" [0063.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0063.853] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0063.853] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0063.853] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0063.854] lstrcatA (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.zip") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.rar") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.7z") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.tar") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.gzip") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.jpg") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.jpeg") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.psd") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.cdr") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.dwg") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.max") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.bmp") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.gif") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.png") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.doc") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.docx") returned 0 [0063.854] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.xls") returned 0 [0063.854] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0063.854] lstrcmpA (lpString1=".", lpString2="Documents and Settings") returned -1 [0063.855] lstrcmpA (lpString1="..", lpString2="Documents and Settings") returned -1 [0063.855] PathFindFileNameA (pszPath="C:\\BOOTSECT.BAK") returned="BOOTSECT.BAK" [0063.855] lstrcatA (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0063.855] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x19fd78, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x10, nFileSizeHigh=0x207d0, nFileSizeLow=0x0, dwReserved0=0x74ac50, dwReserved1=0x40445c, cFileName="\x01", cAlternateFileName="Ìÿ\x19")) returned 0xffffffff [0063.856] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0063.856] lstrcmpA (lpString1=".", lpString2="ESD") returned -1 [0063.856] lstrcmpA (lpString1="..", lpString2="ESD") returned -1 [0063.856] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0063.856] lstrcatA (in: lpString1="C:\\", lpString2="ESD" | out: lpString1="C:\\ESD") returned="C:\\ESD" [0063.856] FindFirstFileA (in: lpFileName="C:\\ESD\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x48, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0063.862] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.862] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 1 [0063.862] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.862] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.862] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 0 [0063.862] FindClose (in: hFindFile=0x759d10 | out: hFindFile=0x759d10) returned 1 [0063.862] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x96715303, ftLastWriteTime.dwHighDateTime=0x1d5c65a, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0063.862] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0 [0063.862] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hiberfil.sys") returned -1 [0063.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hiberfil.sys") returned 1 [0063.862] lstrcmpiA (lpString1="", lpString2="hiberfil.sys") returned -1 [0063.862] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0063.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0063.862] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0063.862] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0063.862] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0063.863] lstrcatA (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0063.863] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0063.863] lstrcmpA (lpString1=".", lpString2="Logs") returned -1 [0063.863] lstrcmpA (lpString1="..", lpString2="Logs") returned -1 [0063.863] PathFindFileNameA (pszPath="C:\\hiberfil.sys") returned="hiberfil.sys" [0063.863] lstrcatA (in: lpString1="C:\\", lpString2="Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs" [0063.863] FindFirstFileA (in: lpFileName="C:\\Logs\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x48, cFileName=".", cAlternateFileName="")) returned 0x759f50 [0063.867] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.867] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 1 [0063.872] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.872] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.872] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x740000, dwReserved1=0x48, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0063.872] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.872] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Application.evtx") returned 1 [0063.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Application.evtx") returned 1 [0063.873] lstrcmpiA (lpString1="", lpString2="Application.evtx") returned -1 [0063.873] PathFindFileNameA (pszPath="C:\\Logs\\*.*") returned="*.*" [0063.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.873] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.873] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.873] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0xffffffff [0063.873] CreateFileA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0063.873] WriteFile (in: hFile=0x204, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.874] SetFileTime (hFile=0x204, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.875] CloseHandle (hObject=0x204) returned 1 [0063.875] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Application.evtx" | out: lpString1="C:\\Logs\\Application.evtx") returned="C:\\Logs\\Application.evtx" [0063.875] lstrlenA (lpString="*.zip") returned 5 [0063.875] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.rar") returned 0 [0063.875] lstrlenA (lpString="*.rar") returned 5 [0063.875] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.7z") returned 0 [0063.875] lstrlenA (lpString="*.7z") returned 4 [0063.875] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.tar") returned 0 [0063.875] lstrlenA (lpString="*.tar") returned 5 [0063.875] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.gzip") returned 0 [0063.875] lstrlenA (lpString="*.gzip") returned 6 [0063.875] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.jpg") returned 0 [0063.875] lstrlenA (lpString="*.jpg") returned 5 [0063.875] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.jpeg") returned 0 [0063.875] lstrlenA (lpString="*.jpeg") returned 6 [0063.875] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.psd") returned 0 [0063.875] lstrlenA (lpString="*.psd") returned 5 [0063.875] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.cdr") returned 0 [0063.875] lstrlenA (lpString="*.cdr") returned 5 [0063.875] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.dwg") returned 0 [0063.875] lstrlenA (lpString="*.dwg") returned 5 [0063.875] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.max") returned 0 [0063.875] lstrlenA (lpString="*.max") returned 5 [0063.875] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.bmp") returned 0 [0063.875] lstrlenA (lpString="*.bmp") returned 5 [0063.875] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.gif") returned 0 [0063.875] lstrlenA (lpString="*.gif") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.png") returned 0 [0063.876] lstrlenA (lpString="*.png") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.doc") returned 0 [0063.876] lstrlenA (lpString="*.doc") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.docx") returned 0 [0063.876] lstrlenA (lpString="*.docx") returned 6 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.xls") returned 0 [0063.876] lstrlenA (lpString="*.xls") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.xlsx") returned 0 [0063.876] lstrlenA (lpString="*.xlsx") returned 6 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.ppt") returned 0 [0063.876] lstrlenA (lpString="*.ppt") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.pptx") returned 0 [0063.876] lstrlenA (lpString="*.pptx") returned 6 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.txt") returned 0 [0063.876] lstrlenA (lpString="*.txt") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.pdf") returned 0 [0063.876] lstrlenA (lpString="*.pdf") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.djvu") returned 0 [0063.876] lstrlenA (lpString="*.djvu") returned 6 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.htm") returned 0 [0063.876] lstrlenA (lpString="*.htm") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.html") returned 0 [0063.876] lstrlenA (lpString="*.html") returned 6 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mdb") returned 0 [0063.876] lstrlenA (lpString="*.mdb") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.cer") returned 0 [0063.876] lstrlenA (lpString="*.cer") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.p12") returned 0 [0063.876] lstrlenA (lpString="*.p12") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.pfx") returned 0 [0063.876] lstrlenA (lpString="*.pfx") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.kwm") returned 0 [0063.876] lstrlenA (lpString="*.kwm") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.pwm") returned 0 [0063.876] lstrlenA (lpString="*.pwm") returned 5 [0063.876] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.1cd") returned 0 [0063.876] lstrlenA (lpString="*.1cd") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.md") returned 0 [0063.877] lstrlenA (lpString="*.md") returned 4 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mdf") returned 0 [0063.877] lstrlenA (lpString="*.mdf") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.dbf") returned 0 [0063.877] lstrlenA (lpString="*.dbf") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.odt") returned 0 [0063.877] lstrlenA (lpString="*.odt") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.vob") returned 0 [0063.877] lstrlenA (lpString="*.vob") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.ifo") returned 0 [0063.877] lstrlenA (lpString="*.ifo") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.lnk") returned 0 [0063.877] lstrlenA (lpString="*.lnk") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.torrent") returned 0 [0063.877] lstrlenA (lpString="*.torrent") returned 9 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mov") returned 0 [0063.877] lstrlenA (lpString="*.mov") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.m2v") returned 0 [0063.877] lstrlenA (lpString="*.m2v") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.3gp") returned 0 [0063.877] lstrlenA (lpString="*.3gp") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mpeg") returned 0 [0063.877] lstrlenA (lpString="*.mpeg") returned 6 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mpg") returned 0 [0063.877] lstrlenA (lpString="*.mpg") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.flv") returned 0 [0063.877] lstrlenA (lpString="*.flv") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.avi") returned 0 [0063.877] lstrlenA (lpString="*.avi") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mp4") returned 0 [0063.877] lstrlenA (lpString="*.mp4") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.wmv") returned 0 [0063.877] lstrlenA (lpString="*.wmv") returned 5 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.divx") returned 0 [0063.877] lstrlenA (lpString="*.divx") returned 6 [0063.877] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mkv") returned 0 [0063.877] lstrlenA (lpString="*.mkv") returned 5 [0063.878] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.mp3") returned 0 [0063.878] lstrlenA (lpString="*.mp3") returned 5 [0063.878] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.wav") returned 0 [0063.878] lstrlenA (lpString="*.wav") returned 5 [0063.878] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.flac") returned 0 [0063.878] lstrlenA (lpString="*.flac") returned 6 [0063.878] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.ape") returned 0 [0063.878] lstrlenA (lpString="*.ape") returned 5 [0063.878] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.wma") returned 0 [0063.878] lstrlenA (lpString="*.wma") returned 5 [0063.878] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.ac3") returned 0 [0063.878] lstrlenA (lpString="*.ac3") returned 5 [0063.878] PathMatchSpecA (pszFile="C:\\Logs\\Application.evtx", pszSpec="*.doc") returned 0 [0063.878] lstrlenA (lpString="*.doc") returned 5 [0063.878] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x1, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0063.878] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.878] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HardwareEvents.evtx") returned -1 [0063.878] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HardwareEvents.evtx") returned 1 [0063.878] lstrcmpiA (lpString1="", lpString2="HardwareEvents.evtx") returned -1 [0063.878] PathFindFileNameA (pszPath="C:\\Logs\\Application.evtx") returned="Application.evtx" [0063.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.878] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.878] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.878] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.878] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HardwareEvents.evtx" | out: lpString1="C:\\Logs\\HardwareEvents.evtx") returned="C:\\Logs\\HardwareEvents.evtx" [0063.878] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.zip") returned 0 [0063.878] lstrlenA (lpString="*.zip") returned 5 [0063.878] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.rar") returned 0 [0063.878] lstrlenA (lpString="*.rar") returned 5 [0063.878] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.7z") returned 0 [0063.878] lstrlenA (lpString="*.7z") returned 4 [0063.878] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.tar") returned 0 [0063.878] lstrlenA (lpString="*.tar") returned 5 [0063.878] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.gzip") returned 0 [0063.879] lstrlenA (lpString="*.gzip") returned 6 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.jpg") returned 0 [0063.879] lstrlenA (lpString="*.jpg") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.jpeg") returned 0 [0063.879] lstrlenA (lpString="*.jpeg") returned 6 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.psd") returned 0 [0063.879] lstrlenA (lpString="*.psd") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.cdr") returned 0 [0063.879] lstrlenA (lpString="*.cdr") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.dwg") returned 0 [0063.879] lstrlenA (lpString="*.dwg") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.max") returned 0 [0063.879] lstrlenA (lpString="*.max") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.bmp") returned 0 [0063.879] lstrlenA (lpString="*.bmp") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.gif") returned 0 [0063.879] lstrlenA (lpString="*.gif") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.png") returned 0 [0063.879] lstrlenA (lpString="*.png") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.doc") returned 0 [0063.879] lstrlenA (lpString="*.doc") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.docx") returned 0 [0063.879] lstrlenA (lpString="*.docx") returned 6 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.xls") returned 0 [0063.879] lstrlenA (lpString="*.xls") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.xlsx") returned 0 [0063.879] lstrlenA (lpString="*.xlsx") returned 6 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.ppt") returned 0 [0063.879] lstrlenA (lpString="*.ppt") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.pptx") returned 0 [0063.879] lstrlenA (lpString="*.pptx") returned 6 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.txt") returned 0 [0063.879] lstrlenA (lpString="*.txt") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.pdf") returned 0 [0063.879] lstrlenA (lpString="*.pdf") returned 5 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.djvu") returned 0 [0063.879] lstrlenA (lpString="*.djvu") returned 6 [0063.879] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.htm") returned 0 [0063.880] lstrlenA (lpString="*.htm") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.html") returned 0 [0063.880] lstrlenA (lpString="*.html") returned 6 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mdb") returned 0 [0063.880] lstrlenA (lpString="*.mdb") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.cer") returned 0 [0063.880] lstrlenA (lpString="*.cer") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.p12") returned 0 [0063.880] lstrlenA (lpString="*.p12") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.pfx") returned 0 [0063.880] lstrlenA (lpString="*.pfx") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.kwm") returned 0 [0063.880] lstrlenA (lpString="*.kwm") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.pwm") returned 0 [0063.880] lstrlenA (lpString="*.pwm") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.1cd") returned 0 [0063.880] lstrlenA (lpString="*.1cd") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.md") returned 0 [0063.880] lstrlenA (lpString="*.md") returned 4 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mdf") returned 0 [0063.880] lstrlenA (lpString="*.mdf") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.dbf") returned 0 [0063.880] lstrlenA (lpString="*.dbf") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.odt") returned 0 [0063.880] lstrlenA (lpString="*.odt") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.vob") returned 0 [0063.880] lstrlenA (lpString="*.vob") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.ifo") returned 0 [0063.880] lstrlenA (lpString="*.ifo") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.lnk") returned 0 [0063.880] lstrlenA (lpString="*.lnk") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.torrent") returned 0 [0063.880] lstrlenA (lpString="*.torrent") returned 9 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mov") returned 0 [0063.880] lstrlenA (lpString="*.mov") returned 5 [0063.880] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.m2v") returned 0 [0063.880] lstrlenA (lpString="*.m2v") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.3gp") returned 0 [0063.881] lstrlenA (lpString="*.3gp") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mpeg") returned 0 [0063.881] lstrlenA (lpString="*.mpeg") returned 6 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mpg") returned 0 [0063.881] lstrlenA (lpString="*.mpg") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.flv") returned 0 [0063.881] lstrlenA (lpString="*.flv") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.avi") returned 0 [0063.881] lstrlenA (lpString="*.avi") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mp4") returned 0 [0063.881] lstrlenA (lpString="*.mp4") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.wmv") returned 0 [0063.881] lstrlenA (lpString="*.wmv") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.divx") returned 0 [0063.881] lstrlenA (lpString="*.divx") returned 6 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mkv") returned 0 [0063.881] lstrlenA (lpString="*.mkv") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.mp3") returned 0 [0063.881] lstrlenA (lpString="*.mp3") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.wav") returned 0 [0063.881] lstrlenA (lpString="*.wav") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.flac") returned 0 [0063.881] lstrlenA (lpString="*.flac") returned 6 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.ape") returned 0 [0063.881] lstrlenA (lpString="*.ape") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.wma") returned 0 [0063.881] lstrlenA (lpString="*.wma") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.ac3") returned 0 [0063.881] lstrlenA (lpString="*.ac3") returned 5 [0063.881] PathMatchSpecA (pszFile="C:\\Logs\\HardwareEvents.evtx", pszSpec="*.doc") returned 0 [0063.881] lstrlenA (lpString="*.doc") returned 5 [0063.881] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0063.881] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.881] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Internet Explorer.evtx") returned -1 [0063.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Internet Explorer.evtx") returned -1 [0063.881] lstrcmpiA (lpString1="", lpString2="Internet Explorer.evtx") returned -1 [0063.881] PathFindFileNameA (pszPath="C:\\Logs\\HardwareEvents.evtx") returned="HardwareEvents.evtx" [0063.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.882] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.882] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.882] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.882] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Internet Explorer.evtx" | out: lpString1="C:\\Logs\\Internet Explorer.evtx") returned="C:\\Logs\\Internet Explorer.evtx" [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.zip") returned 0 [0063.882] lstrlenA (lpString="*.zip") returned 5 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.rar") returned 0 [0063.882] lstrlenA (lpString="*.rar") returned 5 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.7z") returned 0 [0063.882] lstrlenA (lpString="*.7z") returned 4 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.tar") returned 0 [0063.882] lstrlenA (lpString="*.tar") returned 5 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.gzip") returned 0 [0063.882] lstrlenA (lpString="*.gzip") returned 6 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.jpg") returned 0 [0063.882] lstrlenA (lpString="*.jpg") returned 5 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.jpeg") returned 0 [0063.882] lstrlenA (lpString="*.jpeg") returned 6 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.psd") returned 0 [0063.882] lstrlenA (lpString="*.psd") returned 5 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.cdr") returned 0 [0063.882] lstrlenA (lpString="*.cdr") returned 5 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.dwg") returned 0 [0063.882] lstrlenA (lpString="*.dwg") returned 5 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.max") returned 0 [0063.882] lstrlenA (lpString="*.max") returned 5 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.bmp") returned 0 [0063.882] lstrlenA (lpString="*.bmp") returned 5 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.gif") returned 0 [0063.882] lstrlenA (lpString="*.gif") returned 5 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.png") returned 0 [0063.882] lstrlenA (lpString="*.png") returned 5 [0063.882] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.doc") returned 0 [0063.882] lstrlenA (lpString="*.doc") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.docx") returned 0 [0063.883] lstrlenA (lpString="*.docx") returned 6 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.xls") returned 0 [0063.883] lstrlenA (lpString="*.xls") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.xlsx") returned 0 [0063.883] lstrlenA (lpString="*.xlsx") returned 6 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.ppt") returned 0 [0063.883] lstrlenA (lpString="*.ppt") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.pptx") returned 0 [0063.883] lstrlenA (lpString="*.pptx") returned 6 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.txt") returned 0 [0063.883] lstrlenA (lpString="*.txt") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.pdf") returned 0 [0063.883] lstrlenA (lpString="*.pdf") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.djvu") returned 0 [0063.883] lstrlenA (lpString="*.djvu") returned 6 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.htm") returned 0 [0063.883] lstrlenA (lpString="*.htm") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.html") returned 0 [0063.883] lstrlenA (lpString="*.html") returned 6 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mdb") returned 0 [0063.883] lstrlenA (lpString="*.mdb") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.cer") returned 0 [0063.883] lstrlenA (lpString="*.cer") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.p12") returned 0 [0063.883] lstrlenA (lpString="*.p12") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.pfx") returned 0 [0063.883] lstrlenA (lpString="*.pfx") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.kwm") returned 0 [0063.883] lstrlenA (lpString="*.kwm") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.pwm") returned 0 [0063.883] lstrlenA (lpString="*.pwm") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.1cd") returned 0 [0063.883] lstrlenA (lpString="*.1cd") returned 5 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.md") returned 0 [0063.883] lstrlenA (lpString="*.md") returned 4 [0063.883] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mdf") returned 0 [0063.883] lstrlenA (lpString="*.mdf") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.dbf") returned 0 [0063.884] lstrlenA (lpString="*.dbf") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.odt") returned 0 [0063.884] lstrlenA (lpString="*.odt") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.vob") returned 0 [0063.884] lstrlenA (lpString="*.vob") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.ifo") returned 0 [0063.884] lstrlenA (lpString="*.ifo") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.lnk") returned 0 [0063.884] lstrlenA (lpString="*.lnk") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.torrent") returned 0 [0063.884] lstrlenA (lpString="*.torrent") returned 9 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mov") returned 0 [0063.884] lstrlenA (lpString="*.mov") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.m2v") returned 0 [0063.884] lstrlenA (lpString="*.m2v") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.3gp") returned 0 [0063.884] lstrlenA (lpString="*.3gp") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mpeg") returned 0 [0063.884] lstrlenA (lpString="*.mpeg") returned 6 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mpg") returned 0 [0063.884] lstrlenA (lpString="*.mpg") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.flv") returned 0 [0063.884] lstrlenA (lpString="*.flv") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.avi") returned 0 [0063.884] lstrlenA (lpString="*.avi") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mp4") returned 0 [0063.884] lstrlenA (lpString="*.mp4") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.wmv") returned 0 [0063.884] lstrlenA (lpString="*.wmv") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.divx") returned 0 [0063.884] lstrlenA (lpString="*.divx") returned 6 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mkv") returned 0 [0063.884] lstrlenA (lpString="*.mkv") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.mp3") returned 0 [0063.884] lstrlenA (lpString="*.mp3") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.wav") returned 0 [0063.884] lstrlenA (lpString="*.wav") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.flac") returned 0 [0063.885] lstrlenA (lpString="*.flac") returned 6 [0063.885] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.ape") returned 0 [0063.885] lstrlenA (lpString="*.ape") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.wma") returned 0 [0063.885] lstrlenA (lpString="*.wma") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.ac3") returned 0 [0063.885] lstrlenA (lpString="*.ac3") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Logs\\Internet Explorer.evtx", pszSpec="*.doc") returned 0 [0063.885] lstrlenA (lpString="*.doc") returned 5 [0063.885] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0063.885] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.885] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Key Management Service.evtx") returned -1 [0063.885] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Key Management Service.evtx") returned -1 [0063.885] lstrcmpiA (lpString1="", lpString2="Key Management Service.evtx") returned -1 [0063.885] PathFindFileNameA (pszPath="C:\\Logs\\Internet Explorer.evtx") returned="Internet Explorer.evtx" [0063.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.885] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.885] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.885] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.885] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Key Management Service.evtx" | out: lpString1="C:\\Logs\\Key Management Service.evtx") returned="C:\\Logs\\Key Management Service.evtx" [0063.885] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.zip") returned 0 [0063.885] lstrlenA (lpString="*.zip") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.rar") returned 0 [0063.885] lstrlenA (lpString="*.rar") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.7z") returned 0 [0063.885] lstrlenA (lpString="*.7z") returned 4 [0063.885] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.tar") returned 0 [0063.885] lstrlenA (lpString="*.tar") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.gzip") returned 0 [0063.885] lstrlenA (lpString="*.gzip") returned 6 [0063.885] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.jpg") returned 0 [0063.885] lstrlenA (lpString="*.jpg") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.jpeg") returned 0 [0063.886] lstrlenA (lpString="*.jpeg") returned 6 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.psd") returned 0 [0063.886] lstrlenA (lpString="*.psd") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.cdr") returned 0 [0063.886] lstrlenA (lpString="*.cdr") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.dwg") returned 0 [0063.886] lstrlenA (lpString="*.dwg") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.max") returned 0 [0063.886] lstrlenA (lpString="*.max") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.bmp") returned 0 [0063.886] lstrlenA (lpString="*.bmp") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.gif") returned 0 [0063.886] lstrlenA (lpString="*.gif") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.png") returned 0 [0063.886] lstrlenA (lpString="*.png") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.doc") returned 0 [0063.886] lstrlenA (lpString="*.doc") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.docx") returned 0 [0063.886] lstrlenA (lpString="*.docx") returned 6 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.xls") returned 0 [0063.886] lstrlenA (lpString="*.xls") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.xlsx") returned 0 [0063.886] lstrlenA (lpString="*.xlsx") returned 6 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.ppt") returned 0 [0063.886] lstrlenA (lpString="*.ppt") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.pptx") returned 0 [0063.886] lstrlenA (lpString="*.pptx") returned 6 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.txt") returned 0 [0063.886] lstrlenA (lpString="*.txt") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.pdf") returned 0 [0063.886] lstrlenA (lpString="*.pdf") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.djvu") returned 0 [0063.886] lstrlenA (lpString="*.djvu") returned 6 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.htm") returned 0 [0063.886] lstrlenA (lpString="*.htm") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.html") returned 0 [0063.886] lstrlenA (lpString="*.html") returned 6 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.mdb") returned 0 [0063.887] lstrlenA (lpString="*.mdb") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.cer") returned 0 [0063.887] lstrlenA (lpString="*.cer") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.p12") returned 0 [0063.887] lstrlenA (lpString="*.p12") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.pfx") returned 0 [0063.887] lstrlenA (lpString="*.pfx") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.kwm") returned 0 [0063.887] lstrlenA (lpString="*.kwm") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.pwm") returned 0 [0063.887] lstrlenA (lpString="*.pwm") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.1cd") returned 0 [0063.887] lstrlenA (lpString="*.1cd") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.md") returned 0 [0063.887] lstrlenA (lpString="*.md") returned 4 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.mdf") returned 0 [0063.887] lstrlenA (lpString="*.mdf") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.dbf") returned 0 [0063.887] lstrlenA (lpString="*.dbf") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.odt") returned 0 [0063.887] lstrlenA (lpString="*.odt") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.vob") returned 0 [0063.887] lstrlenA (lpString="*.vob") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.ifo") returned 0 [0063.887] lstrlenA (lpString="*.ifo") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.lnk") returned 0 [0063.887] lstrlenA (lpString="*.lnk") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.torrent") returned 0 [0063.887] lstrlenA (lpString="*.torrent") returned 9 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.mov") returned 0 [0063.887] lstrlenA (lpString="*.mov") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.m2v") returned 0 [0063.887] lstrlenA (lpString="*.m2v") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.3gp") returned 0 [0063.887] lstrlenA (lpString="*.3gp") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.mpeg") returned 0 [0063.888] lstrlenA (lpString="*.mpeg") returned 6 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.mpg") returned 0 [0063.888] lstrlenA (lpString="*.mpg") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.flv") returned 0 [0063.888] lstrlenA (lpString="*.flv") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.avi") returned 0 [0063.888] lstrlenA (lpString="*.avi") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.mp4") returned 0 [0063.888] lstrlenA (lpString="*.mp4") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.wmv") returned 0 [0063.888] lstrlenA (lpString="*.wmv") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.divx") returned 0 [0063.888] lstrlenA (lpString="*.divx") returned 6 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.mkv") returned 0 [0063.888] lstrlenA (lpString="*.mkv") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.mp3") returned 0 [0063.888] lstrlenA (lpString="*.mp3") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.wav") returned 0 [0063.888] lstrlenA (lpString="*.wav") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.flac") returned 0 [0063.888] lstrlenA (lpString="*.flac") returned 6 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.ape") returned 0 [0063.888] lstrlenA (lpString="*.ape") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.wma") returned 0 [0063.888] lstrlenA (lpString="*.wma") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.ac3") returned 0 [0063.888] lstrlenA (lpString="*.ac3") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Logs\\Key Management Service.evtx", pszSpec="*.doc") returned 0 [0063.888] lstrlenA (lpString="*.doc") returned 5 [0063.888] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0063.888] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.888] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned -1 [0063.888] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned -1 [0063.888] lstrcmpiA (lpString1="", lpString2="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned -1 [0063.888] PathFindFileNameA (pszPath="C:\\Logs\\Key Management Service.evtx") returned="Key Management Service.evtx" [0063.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.888] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.888] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.889] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.889] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Client-Licensing-Platform%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" [0063.889] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.zip") returned 0 [0063.889] lstrlenA (lpString="*.zip") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.rar") returned 0 [0063.889] lstrlenA (lpString="*.rar") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.7z") returned 0 [0063.889] lstrlenA (lpString="*.7z") returned 4 [0063.889] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.tar") returned 0 [0063.889] lstrlenA (lpString="*.tar") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.gzip") returned 0 [0063.889] lstrlenA (lpString="*.gzip") returned 6 [0063.889] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.jpg") returned 0 [0063.889] lstrlenA (lpString="*.jpg") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.jpeg") returned 0 [0063.889] lstrlenA (lpString="*.jpeg") returned 6 [0063.889] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.psd") returned 0 [0063.889] lstrlenA (lpString="*.psd") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.cdr") returned 0 [0063.889] lstrlenA (lpString="*.cdr") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.dwg") returned 0 [0063.889] lstrlenA (lpString="*.dwg") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.max") returned 0 [0063.889] lstrlenA (lpString="*.max") returned 5 [0063.890] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.bmp") returned 0 [0063.890] lstrlenA (lpString="*.bmp") returned 5 [0063.890] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.gif") returned 0 [0063.890] lstrlenA (lpString="*.gif") returned 5 [0063.890] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.png") returned 0 [0063.890] lstrlenA (lpString="*.png") returned 5 [0063.890] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.doc") returned 0 [0063.890] lstrlenA (lpString="*.doc") returned 5 [0063.890] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.docx") returned 0 [0063.890] lstrlenA (lpString="*.docx") returned 6 [0063.890] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.xls") returned 0 [0063.891] lstrlenA (lpString="*.xls") returned 5 [0063.891] PathMatchSpecA (pszFile="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", pszSpec="*.xlsx") returned 0 [0063.891] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0063.891] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.891] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned -1 [0063.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned -1 [0063.891] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned -1 [0063.891] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned="Microsoft-Client-Licensing-Platform%4Admin.evtx" [0063.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.891] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.891] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.891] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.891] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" [0063.891] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0063.891] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.891] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned -1 [0063.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned -1 [0063.891] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned -1 [0063.891] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" [0063.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.892] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.892] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.892] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.892] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" [0063.892] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0063.892] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.892] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned -1 [0063.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned -1 [0063.892] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned -1 [0063.892] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" [0063.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.892] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.892] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.892] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.892] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4EXE and DLL.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" [0063.892] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0063.892] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.892] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned -1 [0063.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned -1 [0063.892] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned -1 [0063.892] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned="Microsoft-Windows-AppLocker%4EXE and DLL.evtx" [0063.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.892] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.892] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.892] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.893] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4MSI and Script.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" [0063.893] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0063.893] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.893] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned -1 [0063.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned -1 [0063.893] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned -1 [0063.893] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned="Microsoft-Windows-AppLocker%4MSI and Script.evtx" [0063.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.893] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.893] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.893] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.893] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" [0063.893] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0063.893] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.893] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned -1 [0063.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned -1 [0063.893] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned -1 [0063.893] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" [0063.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.893] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.893] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.893] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.893] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" [0063.893] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0063.893] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.894] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned -1 [0063.894] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned -1 [0063.894] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned -1 [0063.894] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" [0063.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.894] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.894] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.894] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.894] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppModel-Runtime%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" [0063.894] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0063.894] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.894] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-AppReadiness%4Admin.evtx") returned -1 [0063.894] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-AppReadiness%4Admin.evtx") returned -1 [0063.894] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppReadiness%4Admin.evtx") returned -1 [0063.894] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned="Microsoft-Windows-AppModel-Runtime%4Admin.evtx" [0063.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.894] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.894] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.894] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.894] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppReadiness%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" [0063.894] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0063.894] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.894] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-AppReadiness%4Operational.evtx") returned -1 [0063.894] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-AppReadiness%4Operational.evtx") returned -1 [0063.894] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppReadiness%4Operational.evtx") returned -1 [0063.894] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned="Microsoft-Windows-AppReadiness%4Admin.evtx" [0063.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.894] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.894] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.895] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.895] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppReadiness%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" [0063.895] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0063.895] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.895] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned -1 [0063.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned -1 [0063.895] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned -1 [0063.895] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned="Microsoft-Windows-AppReadiness%4Operational.evtx" [0063.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.895] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.895] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.895] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.895] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppXDeployment%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" [0063.895] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0063.895] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.895] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned -1 [0063.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned -1 [0063.895] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned -1 [0063.895] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned="Microsoft-Windows-AppXDeployment%4Operational.evtx" [0063.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.895] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.895] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.895] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.895] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" [0063.895] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0063.895] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.896] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned -1 [0063.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned -1 [0063.896] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned -1 [0063.896] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" [0063.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.896] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.896] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.896] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.896] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" [0063.896] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0063.896] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.896] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned -1 [0063.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned -1 [0063.896] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned -1 [0063.896] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" [0063.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.896] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.896] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.896] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.896] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppxPackaging%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" [0063.896] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0063.896] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.896] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned -1 [0063.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned -1 [0063.896] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned -1 [0063.896] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned="Microsoft-Windows-AppxPackaging%4Operational.evtx" [0063.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.896] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.896] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.897] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.897] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" [0063.897] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0063.897] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.897] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Bits-Client%4Operational.evtx") returned -1 [0063.897] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Bits-Client%4Operational.evtx") returned -1 [0063.897] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Bits-Client%4Operational.evtx") returned -1 [0063.897] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" [0063.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.897] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.897] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.897] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.897] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Bits-Client%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" [0063.897] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0063.897] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.897] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned -1 [0063.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned -1 [0063.898] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned -1 [0063.898] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned="Microsoft-Windows-Bits-Client%4Operational.evtx" [0063.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.898] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.898] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.898] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.898] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-CodeIntegrity%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" [0063.898] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0063.898] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.898] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned -1 [0063.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned -1 [0063.898] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned -1 [0063.898] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned="Microsoft-Windows-CodeIntegrity%4Operational.evtx" [0063.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.898] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.898] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.898] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.898] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" [0063.898] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0063.898] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.898] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned -1 [0063.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned -1 [0063.898] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned -1 [0063.898] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" [0063.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.898] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.898] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.899] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.899] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" [0063.899] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0063.899] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.899] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned -1 [0063.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned -1 [0063.899] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned -1 [0063.899] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" [0063.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.899] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.899] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.899] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.899] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" [0063.899] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0063.899] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.899] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned -1 [0063.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned -1 [0063.899] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned -1 [0063.899] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" [0063.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.899] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.899] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.899] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.899] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" [0063.899] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0063.899] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.900] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned -1 [0063.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned -1 [0063.900] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned -1 [0063.900] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" [0063.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.900] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.900] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.900] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.900] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-DeviceSetupManager%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" [0063.900] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0063.900] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.900] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned -1 [0063.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned -1 [0063.900] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned -1 [0063.900] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned="Microsoft-Windows-DeviceSetupManager%4Admin.evtx" [0063.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.900] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.900] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.900] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.900] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-DeviceSetupManager%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" [0063.900] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0063.900] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.900] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned -1 [0063.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned -1 [0063.900] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned -1 [0063.900] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned="Microsoft-Windows-DeviceSetupManager%4Operational.evtx" [0063.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.900] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.901] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.901] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.901] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Dhcp-Client%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" [0063.901] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0063.901] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.901] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned -1 [0063.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned -1 [0063.901] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned -1 [0063.901] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned="Microsoft-Windows-Dhcp-Client%4Admin.evtx" [0063.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.901] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.901] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.901] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.901] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" [0063.901] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0063.901] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.901] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned -1 [0063.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned -1 [0063.901] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned -1 [0063.901] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" [0063.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.901] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.901] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.901] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.901] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" [0063.901] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0063.902] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.902] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned -1 [0063.902] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned -1 [0063.902] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned -1 [0063.902] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" [0063.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.902] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.902] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.902] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.902] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" [0063.902] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0063.902] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.902] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned -1 [0063.902] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned -1 [0063.902] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned -1 [0063.902] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" [0063.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.902] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.902] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.902] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.902] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-GroupPolicy%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" [0063.902] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0063.902] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.902] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned -1 [0063.902] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned -1 [0063.902] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned -1 [0063.902] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned="Microsoft-Windows-GroupPolicy%4Operational.evtx" [0063.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.902] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.903] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.903] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.903] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-HotspotAuth%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" [0063.903] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0063.903] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned -1 [0063.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned -1 [0063.903] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned -1 [0063.903] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned="Microsoft-Windows-HotspotAuth%4Operational.evtx" [0063.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.903] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.903] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.903] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.903] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" [0063.903] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0063.903] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-International%4Operational.evtx") returned -1 [0063.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-International%4Operational.evtx") returned -1 [0063.903] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-International%4Operational.evtx") returned -1 [0063.903] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" [0063.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.903] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.903] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.903] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.903] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-International%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" [0063.904] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0063.904] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.904] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned -1 [0063.904] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned -1 [0063.904] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned -1 [0063.904] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned="Microsoft-Windows-International%4Operational.evtx" [0063.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.904] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.904] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.904] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.904] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-Boot%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" [0063.904] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0063.904] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.904] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned -1 [0063.904] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned -1 [0063.904] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned -1 [0063.904] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned="Microsoft-Windows-Kernel-Boot%4Operational.evtx" [0063.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.904] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.904] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.904] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.904] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" [0063.904] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0063.904] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.904] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned -1 [0063.904] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned -1 [0063.904] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned -1 [0063.904] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" [0063.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.905] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.905] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.905] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.905] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-PnP%4Configuration.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" [0063.905] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0063.905] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.905] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned -1 [0063.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned -1 [0063.905] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned -1 [0063.908] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned="Microsoft-Windows-Kernel-PnP%4Configuration.evtx" [0063.908] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.908] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.908] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.909] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.909] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" [0063.909] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0063.909] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.909] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned -1 [0063.909] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned -1 [0063.909] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned -1 [0063.909] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" [0063.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.909] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.909] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.909] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.909] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" [0063.909] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0063.910] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.910] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned -1 [0063.910] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned -1 [0063.910] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned -1 [0063.910] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" [0063.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.910] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.910] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.910] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.910] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" [0063.910] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0063.910] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.910] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned -1 [0063.910] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned -1 [0063.910] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned -1 [0063.910] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" [0063.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.910] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.910] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.910] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.910] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-WHEA%4Errors.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" [0063.910] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0063.910] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.910] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned -1 [0063.910] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned -1 [0063.910] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned -1 [0063.910] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned="Microsoft-Windows-Kernel-WHEA%4Errors.evtx" [0063.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.911] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.911] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.911] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.911] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-WHEA%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" [0063.911] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0063.911] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.911] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Known Folders API Service.evtx") returned -1 [0063.911] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Known Folders API Service.evtx") returned -1 [0063.911] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Known Folders API Service.evtx") returned -1 [0063.911] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned="Microsoft-Windows-Kernel-WHEA%4Operational.evtx" [0063.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.911] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.911] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.911] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.911] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Known Folders API Service.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" [0063.911] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0063.911] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.911] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-LiveId%4Operational.evtx") returned -1 [0063.911] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-LiveId%4Operational.evtx") returned -1 [0063.911] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-LiveId%4Operational.evtx") returned -1 [0063.911] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned="Microsoft-Windows-Known Folders API Service.evtx" [0063.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.911] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.911] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.911] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.911] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-LiveId%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" [0063.912] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0063.912] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.912] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-MUI%4Admin.evtx") returned -1 [0063.912] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-MUI%4Admin.evtx") returned -1 [0063.912] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-MUI%4Admin.evtx") returned -1 [0063.912] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned="Microsoft-Windows-LiveId%4Operational.evtx" [0063.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.912] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.912] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.912] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.912] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-MUI%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" [0063.912] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0063.912] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.912] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-MUI%4Operational.evtx") returned -1 [0063.912] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-MUI%4Operational.evtx") returned -1 [0063.912] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-MUI%4Operational.evtx") returned -1 [0063.912] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned="Microsoft-Windows-MUI%4Admin.evtx" [0063.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.912] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.912] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.912] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.912] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-MUI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" [0063.912] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0063.912] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.912] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-NCSI%4Operational.evtx") returned -1 [0063.912] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-NCSI%4Operational.evtx") returned -1 [0063.912] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-NCSI%4Operational.evtx") returned -1 [0063.912] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned="Microsoft-Windows-MUI%4Operational.evtx" [0063.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.913] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.913] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.913] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.913] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-NCSI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" [0063.913] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0063.913] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.913] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned -1 [0063.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned -1 [0063.913] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned -1 [0063.913] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned="Microsoft-Windows-NCSI%4Operational.evtx" [0063.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.913] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.913] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.913] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.913] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-NetworkProfile%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" [0063.913] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0063.913] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.913] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Ntfs%4Operational.evtx") returned -1 [0063.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Ntfs%4Operational.evtx") returned -1 [0063.913] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Ntfs%4Operational.evtx") returned -1 [0063.913] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned="Microsoft-Windows-NetworkProfile%4Operational.evtx" [0063.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.913] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.913] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.913] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.913] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Ntfs%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" [0063.914] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0063.914] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.914] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Ntfs%4WHC.evtx") returned -1 [0063.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Ntfs%4WHC.evtx") returned -1 [0063.914] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Ntfs%4WHC.evtx") returned -1 [0063.914] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned="Microsoft-Windows-Ntfs%4Operational.evtx" [0063.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.914] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.914] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.914] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.914] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Ntfs%4WHC.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" [0063.914] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0063.914] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.914] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned -1 [0063.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned -1 [0063.914] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned -1 [0063.914] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned="Microsoft-Windows-Ntfs%4WHC.evtx" [0063.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.914] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.914] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.914] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.914] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" [0063.914] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0063.914] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.914] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned -1 [0063.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned -1 [0063.914] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned -1 [0063.915] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" [0063.915] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.915] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.915] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.915] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.915] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-ReadyBoost%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" [0063.915] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0063.915] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.915] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned -1 [0063.915] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned -1 [0063.915] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned -1 [0063.915] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned="Microsoft-Windows-ReadyBoost%4Operational.evtx" [0063.915] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.915] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.915] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.915] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.915] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" [0063.915] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0063.915] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.915] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-SettingSync%4Debug.evtx") returned -1 [0063.915] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-SettingSync%4Debug.evtx") returned -1 [0063.915] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SettingSync%4Debug.evtx") returned -1 [0063.915] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" [0063.915] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.915] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.915] lstrcatA (in: lpString1="C:\\Logs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Logs\\HOW TO DECRYPT FILES.txt") returned="C:\\Logs\\HOW TO DECRYPT FILES.txt" [0063.915] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.916] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0063.916] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.916] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-SettingSync%4Operational.evtx") returned -1 [0063.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-SettingSync%4Operational.evtx") returned -1 [0063.916] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SettingSync%4Operational.evtx") returned -1 [0063.916] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned="Microsoft-Windows-SettingSync%4Debug.evtx" [0063.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.916] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.916] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.916] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0063.916] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.916] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned -1 [0063.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned -1 [0063.916] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned -1 [0063.916] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned="Microsoft-Windows-SettingSync%4Operational.evtx" [0063.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.916] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.916] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.916] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0063.916] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.916] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Shell-Core%4Operational.evtx") returned -1 [0063.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Shell-Core%4Operational.evtx") returned -1 [0063.916] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Shell-Core%4Operational.evtx") returned -1 [0063.916] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned="Microsoft-Windows-Shell-Core%4ActionCenter.evtx" [0063.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.916] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.917] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.917] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0063.917] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.917] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned -1 [0063.917] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned -1 [0063.917] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned -1 [0063.917] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned="Microsoft-Windows-Shell-Core%4Operational.evtx" [0063.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.917] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.917] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.917] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0063.917] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.917] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-SMBClient%4Operational.evtx") returned -1 [0063.917] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-SMBClient%4Operational.evtx") returned -1 [0063.917] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SMBClient%4Operational.evtx") returned -1 [0063.917] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned="Microsoft-Windows-SmbClient%4Connectivity.evtx" [0063.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.917] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.917] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.917] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0063.917] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.917] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-SmbClient%4Security.evtx") returned -1 [0063.917] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-SmbClient%4Security.evtx") returned -1 [0063.917] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SmbClient%4Security.evtx") returned -1 [0063.917] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned="Microsoft-Windows-SMBClient%4Operational.evtx" [0063.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.918] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.918] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.918] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0063.918] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.918] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-SMBServer%4Audit.evtx") returned -1 [0063.918] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-SMBServer%4Audit.evtx") returned -1 [0063.918] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SMBServer%4Audit.evtx") returned -1 [0063.918] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned="Microsoft-Windows-SmbClient%4Security.evtx" [0063.918] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.918] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.918] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.918] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0063.918] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.918] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned -1 [0063.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned -1 [0063.919] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned -1 [0063.919] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned="Microsoft-Windows-SMBServer%4Audit.evtx" [0063.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.919] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.919] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.919] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0063.919] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.919] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-SMBServer%4Operational.evtx") returned -1 [0063.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-SMBServer%4Operational.evtx") returned -1 [0063.919] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SMBServer%4Operational.evtx") returned -1 [0063.919] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned="Microsoft-Windows-SMBServer%4Connectivity.evtx" [0063.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.919] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.919] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.919] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0063.919] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.919] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-SMBServer%4Security.evtx") returned -1 [0063.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-SMBServer%4Security.evtx") returned -1 [0063.919] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-SMBServer%4Security.evtx") returned -1 [0063.919] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned="Microsoft-Windows-SMBServer%4Operational.evtx" [0063.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.919] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.919] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.919] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0063.920] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.920] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-Store%4Operational.evtx") returned -1 [0063.920] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-Store%4Operational.evtx") returned -1 [0063.920] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-Store%4Operational.evtx") returned -1 [0063.920] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned="Microsoft-Windows-SMBServer%4Security.evtx" [0063.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.920] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.920] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.920] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0063.920] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.920] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned -1 [0063.920] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned -1 [0063.920] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned -1 [0063.920] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned="Microsoft-Windows-Store%4Operational.evtx" [0063.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.920] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.920] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.920] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0063.920] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.920] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned="Microsoft-Windows-TaskScheduler%4Maintenance.evtx" [0063.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.920] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.920] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.921] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0063.921] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.921] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" [0063.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.921] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.921] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.921] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0063.921] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.921] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" [0063.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.921] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.922] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.922] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0063.922] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.922] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" [0063.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.922] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.922] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.922] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0063.922] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.922] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" [0063.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.922] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.922] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.922] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0063.922] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.925] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned="Microsoft-Windows-TWinUI%4Operational.evtx" [0063.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.926] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.926] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.926] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0063.926] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.926] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned="Microsoft-Windows-User Profile Service%4Operational.evtx" [0063.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.926] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.926] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.926] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0063.926] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.926] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned="Microsoft-Windows-UserPnp%4ActionCenter.evtx" [0063.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.926] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.926] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.926] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0063.926] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.926] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned="Microsoft-Windows-UserPnp%4DeviceInstall.evtx" [0063.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.926] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.927] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.927] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0063.927] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.927] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" [0063.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.927] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.927] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.927] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0063.927] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.927] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned="Microsoft-Windows-Wcmsvc%4Operational.evtx" [0063.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.927] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.927] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.927] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0063.927] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.927] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned="Microsoft-Windows-Windows Defender%4Operational.evtx" [0063.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.927] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.927] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.927] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0063.927] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.928] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned="Microsoft-Windows-Windows Defender%4WHC.evtx" [0063.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.928] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.928] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.928] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0063.928] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.928] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" [0063.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.928] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.928] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.928] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0063.928] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.928] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" [0063.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.928] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.928] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.928] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0063.929] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.929] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" [0063.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.929] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.929] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.929] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0063.929] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.929] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned="Microsoft-Windows-Winlogon%4Operational.evtx" [0063.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.929] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.929] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.929] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0063.929] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.929] PathFindFileNameA (pszPath="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned="Microsoft-Windows-WMI-Activity%4Operational.evtx" [0063.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.929] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.929] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.929] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0063.929] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.929] PathFindFileNameA (pszPath="C:\\Logs\\Security.evtx") returned="Security.evtx" [0063.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.929] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.929] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.930] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0063.930] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.930] PathFindFileNameA (pszPath="C:\\Logs\\Setup.evtx") returned="Setup.evtx" [0063.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.930] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.930] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.930] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0063.930] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0063.930] PathFindFileNameA (pszPath="C:\\Logs\\System.evtx") returned="System.evtx" [0063.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0063.930] PathAddBackslashA (in: pszPath="C:\\Logs\\" | out: pszPath="C:\\Logs\\") returned="" [0063.930] GetFileAttributesA (lpFileName="C:\\Logs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\logs\\how to decrypt files.txt")) returned 0x20 [0063.930] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0063.930] FindClose (in: hFindFile=0x759f50 | out: hFindFile=0x759f50) returned 1 [0063.930] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x98f4eb01, ftLastWriteTime.dwHighDateTime=0x1d5c65a, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0063.930] PeekMessageA (in: lpMsg=0x19fe0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fe0c) returned 0 [0063.930] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0063.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0063.930] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0063.930] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0063.931] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0063.931] lstrcmpA (lpString1=".", lpString2="PerfLogs") returned -1 [0063.931] lstrcmpA (lpString1="..", lpString2="PerfLogs") returned -1 [0063.931] PathFindFileNameA (pszPath="C:\\pagefile.sys") returned="pagefile.sys" [0063.931] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x48, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0063.932] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.932] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 1 [0063.932] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.932] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.932] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 0 [0063.932] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0063.932] FindNextFileA (in: hFindFile=0x759a50, lpFindFileData=0x19fe30 | out: lpFindFileData=0x19fe30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd5ebf15, ftLastAccessTime.dwHighDateTime=0x1d5c65a, ftLastWriteTime.dwLowDateTime=0xfd5ebf15, ftLastWriteTime.dwHighDateTime=0x1d5c65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0063.932] lstrcmpA (lpString1=".", lpString2="Program Files") returned -1 [0063.932] lstrcmpA (lpString1="..", lpString2="Program Files") returned -1 [0063.932] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0063.932] FindFirstFileA (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd5ebf15, ftLastAccessTime.dwHighDateTime=0x1d5c65a, ftLastWriteTime.dwLowDateTime=0xfd5ebf15, ftLastWriteTime.dwHighDateTime=0x1d5c65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x48, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0063.932] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.932] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd5ebf15, ftLastAccessTime.dwHighDateTime=0x1d5c65a, ftLastWriteTime.dwLowDateTime=0xfd5ebf15, ftLastWriteTime.dwHighDateTime=0x1d5c65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x48, cFileName="..", cAlternateFileName="")) returned 1 [0063.932] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.932] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.933] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19fce0 | out: lpFindFileData=0x19fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf74e8b69, ftLastAccessTime.dwHighDateTime=0x1d5c65a, ftLastWriteTime.dwLowDateTime=0xf74e8b69, ftLastWriteTime.dwHighDateTime=0x1d5c65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x48, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0063.933] lstrcmpA (lpString1=".", lpString2="Common Files") returned -1 [0063.933] lstrcmpA (lpString1="..", lpString2="Common Files") returned -1 [0063.933] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0063.933] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf74e8b69, ftLastAccessTime.dwHighDateTime=0x1d5c65a, ftLastWriteTime.dwLowDateTime=0xf74e8b69, ftLastWriteTime.dwHighDateTime=0x1d5c65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x760e78, cFileName=".", cAlternateFileName="")) returned 0x759f50 [0063.933] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.933] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf74e8b69, ftLastAccessTime.dwHighDateTime=0x1d5c65a, ftLastWriteTime.dwLowDateTime=0xf74e8b69, ftLastWriteTime.dwHighDateTime=0x1d5c65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x760e78, cFileName="..", cAlternateFileName="")) returned 1 [0063.933] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.933] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.933] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4363960, ftCreationTime.dwHighDateTime=0x1d59227, ftLastAccessTime.dwLowDateTime=0xb7246150, ftLastAccessTime.dwHighDateTime=0x1d57788, ftLastWriteTime.dwLowDateTime=0xb7246150, ftLastWriteTime.dwHighDateTime=0x1d57788, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xfffffffe, dwReserved1=0x760e78, cFileName="centralcreditcard.exe", cAlternateFileName="CENTRA~1.EXE")) returned 1 [0063.933] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0063.933] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0063.933] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\" | out: lpString1="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0063.933] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\" | out: pszPath="C:\\Program Files\\Common Files\\") returned="" [0063.933] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\how to decrypt files.txt")) returned 0xffffffff [0063.933] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.942] SetFileTime (hFile=0x208, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.942] CloseHandle (hObject=0x208) returned 1 [0063.942] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19fb90 | out: lpFindFileData=0x19fb90*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0063.942] lstrcmpA (lpString1=".", lpString2="DESIGNER") returned -1 [0063.942] lstrcmpA (lpString1="..", lpString2="DESIGNER") returned -1 [0063.942] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\centralcreditcard.exe") returned="centralcreditcard.exe" [0063.942] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74ebc0, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0063.943] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.943] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74ebc0, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 1 [0063.943] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.944] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.944] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x74ebc0, dwReserved1=0x80, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0063.944] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0063.944] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\DESIGNER\\*.*") returned="*.*" [0063.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\DESIGNER\\" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\") returned="C:\\Program Files\\Common Files\\DESIGNER\\" [0063.944] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\DESIGNER\\" | out: pszPath="C:\\Program Files\\Common Files\\DESIGNER\\") returned="" [0063.944] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\designer\\how to decrypt files.txt")) returned 0xffffffff [0063.944] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\designer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0063.945] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.945] WriteFile (in: hFile=0x20c, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.946] SetFileTime (hFile=0x20c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.946] CloseHandle (hObject=0x20c) returned 1 [0063.946] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\", lpString2="MSADDNDR.OLB" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" [0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.zip") returned 0 [0063.946] lstrlenA (lpString="*.zip") returned 5 [0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.rar") returned 0 [0063.946] lstrlenA (lpString="*.rar") returned 5 [0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.7z") returned 0 [0063.946] lstrlenA (lpString="*.7z") returned 4 [0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.tar") returned 0 [0063.946] lstrlenA (lpString="*.tar") returned 5 [0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.gzip") returned 0 [0063.946] lstrlenA (lpString="*.gzip") returned 6 [0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.jpg") returned 0 [0063.946] lstrlenA (lpString="*.jpg") returned 5 [0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.jpeg") returned 0 [0063.946] lstrlenA (lpString="*.jpeg") returned 6 [0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.psd") returned 0 [0063.946] lstrlenA (lpString="*.psd") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.cdr") returned 0 [0063.947] lstrlenA (lpString="*.cdr") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.dwg") returned 0 [0063.947] lstrlenA (lpString="*.dwg") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.max") returned 0 [0063.947] lstrlenA (lpString="*.max") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.bmp") returned 0 [0063.947] lstrlenA (lpString="*.bmp") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.gif") returned 0 [0063.947] lstrlenA (lpString="*.gif") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.png") returned 0 [0063.947] lstrlenA (lpString="*.png") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.doc") returned 0 [0063.947] lstrlenA (lpString="*.doc") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.docx") returned 0 [0063.947] lstrlenA (lpString="*.docx") returned 6 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.xls") returned 0 [0063.947] lstrlenA (lpString="*.xls") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.xlsx") returned 0 [0063.947] lstrlenA (lpString="*.xlsx") returned 6 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.ppt") returned 0 [0063.947] lstrlenA (lpString="*.ppt") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.pptx") returned 0 [0063.947] lstrlenA (lpString="*.pptx") returned 6 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.txt") returned 0 [0063.947] lstrlenA (lpString="*.txt") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.pdf") returned 0 [0063.947] lstrlenA (lpString="*.pdf") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.djvu") returned 0 [0063.947] lstrlenA (lpString="*.djvu") returned 6 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.htm") returned 0 [0063.947] lstrlenA (lpString="*.htm") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.html") returned 0 [0063.947] lstrlenA (lpString="*.html") returned 6 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.mdb") returned 0 [0063.947] lstrlenA (lpString="*.mdb") returned 5 [0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.cer") returned 0 [0063.948] lstrlenA (lpString="*.cer") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.p12") returned 0 [0063.948] lstrlenA (lpString="*.p12") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.pfx") returned 0 [0063.948] lstrlenA (lpString="*.pfx") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.kwm") returned 0 [0063.948] lstrlenA (lpString="*.kwm") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.pwm") returned 0 [0063.948] lstrlenA (lpString="*.pwm") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.1cd") returned 0 [0063.948] lstrlenA (lpString="*.1cd") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.md") returned 0 [0063.948] lstrlenA (lpString="*.md") returned 4 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.mdf") returned 0 [0063.948] lstrlenA (lpString="*.mdf") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.dbf") returned 0 [0063.948] lstrlenA (lpString="*.dbf") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.odt") returned 0 [0063.948] lstrlenA (lpString="*.odt") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.vob") returned 0 [0063.948] lstrlenA (lpString="*.vob") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.ifo") returned 0 [0063.948] lstrlenA (lpString="*.ifo") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.lnk") returned 0 [0063.948] lstrlenA (lpString="*.lnk") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.torrent") returned 0 [0063.948] lstrlenA (lpString="*.torrent") returned 9 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.mov") returned 0 [0063.948] lstrlenA (lpString="*.mov") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.m2v") returned 0 [0063.948] lstrlenA (lpString="*.m2v") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.3gp") returned 0 [0063.948] lstrlenA (lpString="*.3gp") returned 5 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.mpeg") returned 0 [0063.948] lstrlenA (lpString="*.mpeg") returned 6 [0063.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.mpg") returned 0 [0063.948] lstrlenA (lpString="*.mpg") returned 5 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.flv") returned 0 [0063.949] lstrlenA (lpString="*.flv") returned 5 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.avi") returned 0 [0063.949] lstrlenA (lpString="*.avi") returned 5 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.mp4") returned 0 [0063.949] lstrlenA (lpString="*.mp4") returned 5 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.wmv") returned 0 [0063.949] lstrlenA (lpString="*.wmv") returned 5 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.divx") returned 0 [0063.949] lstrlenA (lpString="*.divx") returned 6 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.mkv") returned 0 [0063.949] lstrlenA (lpString="*.mkv") returned 5 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.mp3") returned 0 [0063.949] lstrlenA (lpString="*.mp3") returned 5 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.wav") returned 0 [0063.949] lstrlenA (lpString="*.wav") returned 5 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.flac") returned 0 [0063.949] lstrlenA (lpString="*.flac") returned 6 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.ape") returned 0 [0063.949] lstrlenA (lpString="*.ape") returned 5 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.wma") returned 0 [0063.949] lstrlenA (lpString="*.wma") returned 5 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.ac3") returned 0 [0063.949] lstrlenA (lpString="*.ac3") returned 5 [0063.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", pszSpec="*.doc") returned 0 [0063.949] lstrlenA (lpString="*.doc") returned 5 [0063.951] lstrcmpA (lpString1=".", lpString2="microsoft shared") returned -1 [0063.951] lstrcmpA (lpString1="..", lpString2="microsoft shared") returned -1 [0063.951] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0063.951] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="microsoft shared" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared") returned="C:\\Program Files\\Common Files\\microsoft shared" [0063.951] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared") returned 46 [0063.951] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759d10 [0063.951] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.951] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.952] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.952] lstrcmpA (lpString1=".", lpString2="ClickToRun") returned -1 [0063.952] lstrcmpA (lpString1="..", lpString2="ClickToRun") returned -1 [0063.952] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0063.952] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\", lpString2="ClickToRun" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun" [0063.952] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun") returned 57 [0063.952] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x762e88, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0063.952] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.955] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.955] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.955] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.955] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-core-file-l1-2-0.dll") returned 1 [0063.955] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-core-file-l1-2-0.dll") returned 1 [0063.955] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-file-l1-2-0.dll") returned -1 [0063.955] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*.*") returned="*.*" [0063.955] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.955] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.955] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.955] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0xffffffff [0063.955] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0063.956] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0063.956] WriteFile (in: hFile=0x210, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0063.957] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.957] CloseHandle (hObject=0x210) returned 1 [0063.958] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-core-file-l1-2-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.zip") returned 0 [0063.958] lstrlenA (lpString="*.zip") returned 5 [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.rar") returned 0 [0063.958] lstrlenA (lpString="*.rar") returned 5 [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.7z") returned 0 [0063.958] lstrlenA (lpString="*.7z") returned 4 [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.tar") returned 0 [0063.958] lstrlenA (lpString="*.tar") returned 5 [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.gzip") returned 0 [0063.958] lstrlenA (lpString="*.gzip") returned 6 [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.jpg") returned 0 [0063.958] lstrlenA (lpString="*.jpg") returned 5 [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.jpeg") returned 0 [0063.958] lstrlenA (lpString="*.jpeg") returned 6 [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.psd") returned 0 [0063.958] lstrlenA (lpString="*.psd") returned 5 [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.cdr") returned 0 [0063.958] lstrlenA (lpString="*.cdr") returned 5 [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.dwg") returned 0 [0063.958] lstrlenA (lpString="*.dwg") returned 5 [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.max") returned 0 [0063.958] lstrlenA (lpString="*.max") returned 5 [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.bmp") returned 0 [0063.958] lstrlenA (lpString="*.bmp") returned 5 [0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.gif") returned 0 [0063.959] lstrlenA (lpString="*.gif") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.png") returned 0 [0063.959] lstrlenA (lpString="*.png") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.doc") returned 0 [0063.959] lstrlenA (lpString="*.doc") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.docx") returned 0 [0063.959] lstrlenA (lpString="*.docx") returned 6 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.xls") returned 0 [0063.959] lstrlenA (lpString="*.xls") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.xlsx") returned 0 [0063.959] lstrlenA (lpString="*.xlsx") returned 6 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.ppt") returned 0 [0063.959] lstrlenA (lpString="*.ppt") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.pptx") returned 0 [0063.959] lstrlenA (lpString="*.pptx") returned 6 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.txt") returned 0 [0063.959] lstrlenA (lpString="*.txt") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.pdf") returned 0 [0063.959] lstrlenA (lpString="*.pdf") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.djvu") returned 0 [0063.959] lstrlenA (lpString="*.djvu") returned 6 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.htm") returned 0 [0063.959] lstrlenA (lpString="*.htm") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.html") returned 0 [0063.959] lstrlenA (lpString="*.html") returned 6 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mdb") returned 0 [0063.959] lstrlenA (lpString="*.mdb") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.cer") returned 0 [0063.959] lstrlenA (lpString="*.cer") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.p12") returned 0 [0063.959] lstrlenA (lpString="*.p12") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.pfx") returned 0 [0063.959] lstrlenA (lpString="*.pfx") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.kwm") returned 0 [0063.959] lstrlenA (lpString="*.kwm") returned 5 [0063.959] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.pwm") returned 0 [0063.959] lstrlenA (lpString="*.pwm") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.1cd") returned 0 [0063.960] lstrlenA (lpString="*.1cd") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.md") returned 0 [0063.960] lstrlenA (lpString="*.md") returned 4 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mdf") returned 0 [0063.960] lstrlenA (lpString="*.mdf") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.dbf") returned 0 [0063.960] lstrlenA (lpString="*.dbf") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.odt") returned 0 [0063.960] lstrlenA (lpString="*.odt") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.vob") returned 0 [0063.960] lstrlenA (lpString="*.vob") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.ifo") returned 0 [0063.960] lstrlenA (lpString="*.ifo") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.lnk") returned 0 [0063.960] lstrlenA (lpString="*.lnk") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.torrent") returned 0 [0063.960] lstrlenA (lpString="*.torrent") returned 9 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mov") returned 0 [0063.960] lstrlenA (lpString="*.mov") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.m2v") returned 0 [0063.960] lstrlenA (lpString="*.m2v") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.3gp") returned 0 [0063.960] lstrlenA (lpString="*.3gp") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mpeg") returned 0 [0063.960] lstrlenA (lpString="*.mpeg") returned 6 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mpg") returned 0 [0063.960] lstrlenA (lpString="*.mpg") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.flv") returned 0 [0063.960] lstrlenA (lpString="*.flv") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.avi") returned 0 [0063.960] lstrlenA (lpString="*.avi") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mp4") returned 0 [0063.960] lstrlenA (lpString="*.mp4") returned 5 [0063.960] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.wmv") returned 0 [0063.960] lstrlenA (lpString="*.wmv") returned 5 [0063.961] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.divx") returned 0 [0063.961] lstrlenA (lpString="*.divx") returned 6 [0063.961] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mkv") returned 0 [0063.961] lstrlenA (lpString="*.mkv") returned 5 [0063.961] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.mp3") returned 0 [0063.961] lstrlenA (lpString="*.mp3") returned 5 [0063.961] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.wav") returned 0 [0063.961] lstrlenA (lpString="*.wav") returned 5 [0063.961] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.flac") returned 0 [0063.961] lstrlenA (lpString="*.flac") returned 6 [0063.961] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.ape") returned 0 [0063.961] lstrlenA (lpString="*.ape") returned 5 [0063.961] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.wma") returned 0 [0063.961] lstrlenA (lpString="*.wma") returned 5 [0063.961] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.ac3") returned 0 [0063.961] lstrlenA (lpString="*.ac3") returned 5 [0063.961] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", pszSpec="*.doc") returned 0 [0063.961] lstrlenA (lpString="*.doc") returned 5 [0063.961] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x1, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0063.961] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-core-file-l2-1-0.dll") returned 1 [0063.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-core-file-l2-1-0.dll") returned 1 [0063.961] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-file-l2-1-0.dll") returned -1 [0063.961] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned="api-ms-win-core-file-l1-2-0.dll" [0063.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.961] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.961] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.961] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-core-file-l2-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" [0063.961] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.zip") returned 0 [0063.961] lstrlenA (lpString="*.zip") returned 5 [0063.961] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.rar") returned 0 [0063.962] lstrlenA (lpString="*.rar") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.7z") returned 0 [0063.962] lstrlenA (lpString="*.7z") returned 4 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.tar") returned 0 [0063.962] lstrlenA (lpString="*.tar") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.gzip") returned 0 [0063.962] lstrlenA (lpString="*.gzip") returned 6 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.jpg") returned 0 [0063.962] lstrlenA (lpString="*.jpg") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.jpeg") returned 0 [0063.962] lstrlenA (lpString="*.jpeg") returned 6 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.psd") returned 0 [0063.962] lstrlenA (lpString="*.psd") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.cdr") returned 0 [0063.962] lstrlenA (lpString="*.cdr") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.dwg") returned 0 [0063.962] lstrlenA (lpString="*.dwg") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.max") returned 0 [0063.962] lstrlenA (lpString="*.max") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.bmp") returned 0 [0063.962] lstrlenA (lpString="*.bmp") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.gif") returned 0 [0063.962] lstrlenA (lpString="*.gif") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.png") returned 0 [0063.962] lstrlenA (lpString="*.png") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.doc") returned 0 [0063.962] lstrlenA (lpString="*.doc") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.docx") returned 0 [0063.962] lstrlenA (lpString="*.docx") returned 6 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.xls") returned 0 [0063.962] lstrlenA (lpString="*.xls") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.xlsx") returned 0 [0063.962] lstrlenA (lpString="*.xlsx") returned 6 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.ppt") returned 0 [0063.962] lstrlenA (lpString="*.ppt") returned 5 [0063.962] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.pptx") returned 0 [0063.963] lstrlenA (lpString="*.pptx") returned 6 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.txt") returned 0 [0063.963] lstrlenA (lpString="*.txt") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.pdf") returned 0 [0063.963] lstrlenA (lpString="*.pdf") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.djvu") returned 0 [0063.963] lstrlenA (lpString="*.djvu") returned 6 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.htm") returned 0 [0063.963] lstrlenA (lpString="*.htm") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.html") returned 0 [0063.963] lstrlenA (lpString="*.html") returned 6 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mdb") returned 0 [0063.963] lstrlenA (lpString="*.mdb") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.cer") returned 0 [0063.963] lstrlenA (lpString="*.cer") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.p12") returned 0 [0063.963] lstrlenA (lpString="*.p12") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.pfx") returned 0 [0063.963] lstrlenA (lpString="*.pfx") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.kwm") returned 0 [0063.963] lstrlenA (lpString="*.kwm") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.pwm") returned 0 [0063.963] lstrlenA (lpString="*.pwm") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.1cd") returned 0 [0063.963] lstrlenA (lpString="*.1cd") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.md") returned 0 [0063.963] lstrlenA (lpString="*.md") returned 4 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mdf") returned 0 [0063.963] lstrlenA (lpString="*.mdf") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.dbf") returned 0 [0063.963] lstrlenA (lpString="*.dbf") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.odt") returned 0 [0063.963] lstrlenA (lpString="*.odt") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.vob") returned 0 [0063.963] lstrlenA (lpString="*.vob") returned 5 [0063.963] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.ifo") returned 0 [0063.964] lstrlenA (lpString="*.ifo") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.lnk") returned 0 [0063.964] lstrlenA (lpString="*.lnk") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.torrent") returned 0 [0063.964] lstrlenA (lpString="*.torrent") returned 9 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mov") returned 0 [0063.964] lstrlenA (lpString="*.mov") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.m2v") returned 0 [0063.964] lstrlenA (lpString="*.m2v") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.3gp") returned 0 [0063.964] lstrlenA (lpString="*.3gp") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mpeg") returned 0 [0063.964] lstrlenA (lpString="*.mpeg") returned 6 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mpg") returned 0 [0063.964] lstrlenA (lpString="*.mpg") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.flv") returned 0 [0063.964] lstrlenA (lpString="*.flv") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.avi") returned 0 [0063.964] lstrlenA (lpString="*.avi") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mp4") returned 0 [0063.964] lstrlenA (lpString="*.mp4") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.wmv") returned 0 [0063.964] lstrlenA (lpString="*.wmv") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.divx") returned 0 [0063.964] lstrlenA (lpString="*.divx") returned 6 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mkv") returned 0 [0063.964] lstrlenA (lpString="*.mkv") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.mp3") returned 0 [0063.964] lstrlenA (lpString="*.mp3") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.wav") returned 0 [0063.964] lstrlenA (lpString="*.wav") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.flac") returned 0 [0063.964] lstrlenA (lpString="*.flac") returned 6 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.ape") returned 0 [0063.964] lstrlenA (lpString="*.ape") returned 5 [0063.964] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.wma") returned 0 [0063.964] lstrlenA (lpString="*.wma") returned 5 [0063.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.ac3") returned 0 [0063.965] lstrlenA (lpString="*.ac3") returned 5 [0063.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", pszSpec="*.doc") returned 0 [0063.965] lstrlenA (lpString="*.doc") returned 5 [0063.965] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0063.965] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-core-localization-l1-2-0.dll") returned 1 [0063.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-core-localization-l1-2-0.dll") returned 1 [0063.965] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-localization-l1-2-0.dll") returned -1 [0063.965] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned="api-ms-win-core-file-l2-1-0.dll" [0063.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.965] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.965] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.965] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.965] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-core-localization-l1-2-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" [0063.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.zip") returned 0 [0063.965] lstrlenA (lpString="*.zip") returned 5 [0063.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.rar") returned 0 [0063.965] lstrlenA (lpString="*.rar") returned 5 [0063.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.7z") returned 0 [0063.965] lstrlenA (lpString="*.7z") returned 4 [0063.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.tar") returned 0 [0063.965] lstrlenA (lpString="*.tar") returned 5 [0063.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.gzip") returned 0 [0063.965] lstrlenA (lpString="*.gzip") returned 6 [0063.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.jpg") returned 0 [0063.965] lstrlenA (lpString="*.jpg") returned 5 [0063.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.jpeg") returned 0 [0063.965] lstrlenA (lpString="*.jpeg") returned 6 [0063.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.psd") returned 0 [0063.965] lstrlenA (lpString="*.psd") returned 5 [0063.965] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.cdr") returned 0 [0063.966] lstrlenA (lpString="*.cdr") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.dwg") returned 0 [0063.966] lstrlenA (lpString="*.dwg") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.max") returned 0 [0063.966] lstrlenA (lpString="*.max") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.bmp") returned 0 [0063.966] lstrlenA (lpString="*.bmp") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.gif") returned 0 [0063.966] lstrlenA (lpString="*.gif") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.png") returned 0 [0063.966] lstrlenA (lpString="*.png") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.doc") returned 0 [0063.966] lstrlenA (lpString="*.doc") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.docx") returned 0 [0063.966] lstrlenA (lpString="*.docx") returned 6 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.xls") returned 0 [0063.966] lstrlenA (lpString="*.xls") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.xlsx") returned 0 [0063.966] lstrlenA (lpString="*.xlsx") returned 6 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.ppt") returned 0 [0063.966] lstrlenA (lpString="*.ppt") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.pptx") returned 0 [0063.966] lstrlenA (lpString="*.pptx") returned 6 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.txt") returned 0 [0063.966] lstrlenA (lpString="*.txt") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.pdf") returned 0 [0063.966] lstrlenA (lpString="*.pdf") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.djvu") returned 0 [0063.966] lstrlenA (lpString="*.djvu") returned 6 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.htm") returned 0 [0063.966] lstrlenA (lpString="*.htm") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.html") returned 0 [0063.966] lstrlenA (lpString="*.html") returned 6 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mdb") returned 0 [0063.966] lstrlenA (lpString="*.mdb") returned 5 [0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.cer") returned 0 [0063.967] lstrlenA (lpString="*.cer") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.p12") returned 0 [0063.967] lstrlenA (lpString="*.p12") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.pfx") returned 0 [0063.967] lstrlenA (lpString="*.pfx") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.kwm") returned 0 [0063.967] lstrlenA (lpString="*.kwm") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.pwm") returned 0 [0063.967] lstrlenA (lpString="*.pwm") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.1cd") returned 0 [0063.967] lstrlenA (lpString="*.1cd") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.md") returned 0 [0063.967] lstrlenA (lpString="*.md") returned 4 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mdf") returned 0 [0063.967] lstrlenA (lpString="*.mdf") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.dbf") returned 0 [0063.967] lstrlenA (lpString="*.dbf") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.odt") returned 0 [0063.967] lstrlenA (lpString="*.odt") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.vob") returned 0 [0063.967] lstrlenA (lpString="*.vob") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.ifo") returned 0 [0063.967] lstrlenA (lpString="*.ifo") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.lnk") returned 0 [0063.967] lstrlenA (lpString="*.lnk") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.torrent") returned 0 [0063.967] lstrlenA (lpString="*.torrent") returned 9 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mov") returned 0 [0063.967] lstrlenA (lpString="*.mov") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.m2v") returned 0 [0063.967] lstrlenA (lpString="*.m2v") returned 5 [0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.3gp") returned 0 [0063.967] lstrlenA (lpString="*.3gp") returned 5 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mpeg") returned 0 [0063.972] lstrlenA (lpString="*.mpeg") returned 6 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mpg") returned 0 [0063.972] lstrlenA (lpString="*.mpg") returned 5 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.flv") returned 0 [0063.972] lstrlenA (lpString="*.flv") returned 5 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.avi") returned 0 [0063.972] lstrlenA (lpString="*.avi") returned 5 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mp4") returned 0 [0063.972] lstrlenA (lpString="*.mp4") returned 5 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.wmv") returned 0 [0063.972] lstrlenA (lpString="*.wmv") returned 5 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.divx") returned 0 [0063.972] lstrlenA (lpString="*.divx") returned 6 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mkv") returned 0 [0063.972] lstrlenA (lpString="*.mkv") returned 5 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.mp3") returned 0 [0063.972] lstrlenA (lpString="*.mp3") returned 5 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.wav") returned 0 [0063.972] lstrlenA (lpString="*.wav") returned 5 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.flac") returned 0 [0063.972] lstrlenA (lpString="*.flac") returned 6 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.ape") returned 0 [0063.972] lstrlenA (lpString="*.ape") returned 5 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.wma") returned 0 [0063.972] lstrlenA (lpString="*.wma") returned 5 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.ac3") returned 0 [0063.972] lstrlenA (lpString="*.ac3") returned 5 [0063.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", pszSpec="*.doc") returned 0 [0063.972] lstrlenA (lpString="*.doc") returned 5 [0063.972] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0063.972] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-core-processthreads-l1-1-1.dll") returned 1 [0063.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-core-processthreads-l1-1-1.dll") returned 1 [0063.973] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-processthreads-l1-1-1.dll") returned -1 [0063.973] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned="api-ms-win-core-localization-l1-2-0.dll" [0063.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.973] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.973] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.973] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.973] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-core-processthreads-l1-1-1.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.zip") returned 0 [0063.973] lstrlenA (lpString="*.zip") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.rar") returned 0 [0063.973] lstrlenA (lpString="*.rar") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.7z") returned 0 [0063.973] lstrlenA (lpString="*.7z") returned 4 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.tar") returned 0 [0063.973] lstrlenA (lpString="*.tar") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.gzip") returned 0 [0063.973] lstrlenA (lpString="*.gzip") returned 6 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.jpg") returned 0 [0063.973] lstrlenA (lpString="*.jpg") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.jpeg") returned 0 [0063.973] lstrlenA (lpString="*.jpeg") returned 6 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.psd") returned 0 [0063.973] lstrlenA (lpString="*.psd") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.cdr") returned 0 [0063.973] lstrlenA (lpString="*.cdr") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.dwg") returned 0 [0063.973] lstrlenA (lpString="*.dwg") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.max") returned 0 [0063.973] lstrlenA (lpString="*.max") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.bmp") returned 0 [0063.974] lstrlenA (lpString="*.bmp") returned 5 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.gif") returned 0 [0063.974] lstrlenA (lpString="*.gif") returned 5 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.png") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.doc") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.docx") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.xls") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.xlsx") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.ppt") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.pptx") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.txt") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.pdf") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.djvu") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.htm") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.html") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.mdb") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.cer") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.p12") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.pfx") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.kwm") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.pwm") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.1cd") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.md") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.mdf") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.dbf") returned 0 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.odt") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.vob") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.ifo") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.lnk") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.torrent") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.mov") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.m2v") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.3gp") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.mpeg") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.mpg") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.flv") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.avi") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.mp4") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.wmv") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.divx") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.mkv") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.mp3") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.wav") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.flac") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.ape") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.wma") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.ac3") returned 0 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", pszSpec="*.doc") returned 0 [0063.975] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0063.975] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.975] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-core-synch-l1-2-0.dll") returned 1 [0063.975] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-core-synch-l1-2-0.dll") returned 1 [0063.975] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-synch-l1-2-0.dll") returned -1 [0063.976] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned="api-ms-win-core-processthreads-l1-1-1.dll" [0063.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.976] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.976] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.976] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-core-synch-l1-2-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.zip") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.rar") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.7z") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.tar") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.gzip") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.jpg") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.jpeg") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.psd") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.cdr") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.dwg") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.max") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.bmp") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.gif") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.png") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.doc") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.docx") returned 0 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", pszSpec="*.xls") returned 0 [0063.977] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0063.977] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.977] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-core-timezone-l1-1-0.dll") returned 1 [0063.977] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-core-timezone-l1-1-0.dll") returned 1 [0063.977] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-timezone-l1-1-0.dll") returned -1 [0063.977] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned="api-ms-win-core-synch-l1-2-0.dll" [0063.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.977] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.977] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.977] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.977] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-core-timezone-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" [0063.977] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0063.977] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.977] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-core-xstate-l2-1-0.dll") returned 1 [0063.977] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-core-xstate-l2-1-0.dll") returned 1 [0063.977] lstrcmpiA (lpString1="", lpString2="api-ms-win-core-xstate-l2-1-0.dll") returned -1 [0063.977] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned="api-ms-win-core-timezone-l1-1-0.dll" [0063.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.977] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.977] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.977] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.977] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-core-xstate-l2-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" [0063.978] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0063.978] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.978] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-conio-l1-1-0.dll") returned 1 [0063.978] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-conio-l1-1-0.dll") returned 1 [0063.978] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-conio-l1-1-0.dll") returned -1 [0063.978] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned="api-ms-win-core-xstate-l2-1-0.dll" [0063.978] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.978] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.978] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.978] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.978] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-conio-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" [0063.978] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0063.978] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.978] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-convert-l1-1-0.dll") returned 1 [0063.978] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-convert-l1-1-0.dll") returned 1 [0063.978] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-convert-l1-1-0.dll") returned -1 [0063.978] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned="api-ms-win-crt-conio-l1-1-0.dll" [0063.978] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.978] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.978] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.978] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.978] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-convert-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" [0063.978] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0063.978] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.978] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-environment-l1-1-0.dll") returned 1 [0063.978] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-environment-l1-1-0.dll") returned 1 [0063.978] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-environment-l1-1-0.dll") returned -1 [0063.979] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned="api-ms-win-crt-convert-l1-1-0.dll" [0063.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.979] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.979] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.979] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-environment-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" [0063.979] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0063.979] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.979] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-filesystem-l1-1-0.dll") returned 1 [0063.979] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-filesystem-l1-1-0.dll") returned 1 [0063.979] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-filesystem-l1-1-0.dll") returned -1 [0063.979] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned="api-ms-win-crt-environment-l1-1-0.dll" [0063.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.979] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.979] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.979] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-filesystem-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" [0063.979] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0063.979] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.979] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-heap-l1-1-0.dll") returned 1 [0063.979] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-heap-l1-1-0.dll") returned 1 [0063.979] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-heap-l1-1-0.dll") returned -1 [0063.979] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned="api-ms-win-crt-filesystem-l1-1-0.dll" [0063.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.979] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.979] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.980] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-heap-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" [0063.980] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0063.980] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.980] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-locale-l1-1-0.dll") returned 1 [0063.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-locale-l1-1-0.dll") returned 1 [0063.980] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-locale-l1-1-0.dll") returned -1 [0063.980] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned="api-ms-win-crt-heap-l1-1-0.dll" [0063.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.980] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.980] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.980] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-locale-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" [0063.980] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0063.980] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.980] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-math-l1-1-0.dll") returned 1 [0063.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-math-l1-1-0.dll") returned 1 [0063.980] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-math-l1-1-0.dll") returned -1 [0063.980] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned="api-ms-win-crt-locale-l1-1-0.dll" [0063.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.980] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.980] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.980] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-math-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" [0063.980] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0063.981] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.981] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-multibyte-l1-1-0.dll") returned 1 [0063.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-multibyte-l1-1-0.dll") returned 1 [0063.981] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-multibyte-l1-1-0.dll") returned -1 [0063.981] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned="api-ms-win-crt-math-l1-1-0.dll" [0063.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.981] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.981] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.981] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-multibyte-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" [0063.981] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0063.981] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.981] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-private-l1-1-0.dll") returned 1 [0063.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-private-l1-1-0.dll") returned 1 [0063.981] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-private-l1-1-0.dll") returned -1 [0063.981] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned="api-ms-win-crt-multibyte-l1-1-0.dll" [0063.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.981] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.981] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.981] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-private-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" [0063.981] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0063.981] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.981] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-process-l1-1-0.dll") returned 1 [0063.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-process-l1-1-0.dll") returned 1 [0063.981] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-process-l1-1-0.dll") returned -1 [0063.981] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned="api-ms-win-crt-private-l1-1-0.dll" [0063.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.982] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.982] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.982] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-process-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" [0063.982] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0063.982] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-runtime-l1-1-0.dll") returned 1 [0063.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-runtime-l1-1-0.dll") returned 1 [0063.982] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-runtime-l1-1-0.dll") returned -1 [0063.982] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned="api-ms-win-crt-process-l1-1-0.dll" [0063.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.982] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.982] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.982] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-runtime-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" [0063.982] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0063.982] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-stdio-l1-1-0.dll") returned 1 [0063.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-stdio-l1-1-0.dll") returned 1 [0063.982] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-stdio-l1-1-0.dll") returned -1 [0063.982] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned="api-ms-win-crt-runtime-l1-1-0.dll" [0063.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.982] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.982] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.983] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-stdio-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" [0063.983] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0063.983] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.983] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-string-l1-1-0.dll") returned 1 [0063.983] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-string-l1-1-0.dll") returned 1 [0063.983] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-string-l1-1-0.dll") returned -1 [0063.983] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned="api-ms-win-crt-stdio-l1-1-0.dll" [0063.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.983] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.983] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.983] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.983] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-string-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" [0063.984] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0063.984] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.984] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-time-l1-1-0.dll") returned 1 [0063.984] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-time-l1-1-0.dll") returned 1 [0063.984] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-time-l1-1-0.dll") returned -1 [0063.984] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned="api-ms-win-crt-string-l1-1-0.dll" [0063.984] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.984] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.984] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.984] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.984] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-time-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" [0063.984] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0063.985] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="api-ms-win-crt-utility-l1-1-0.dll") returned 1 [0063.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="api-ms-win-crt-utility-l1-1-0.dll") returned 1 [0063.985] lstrcmpiA (lpString1="", lpString2="api-ms-win-crt-utility-l1-1-0.dll") returned -1 [0063.985] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned="api-ms-win-crt-time-l1-1-0.dll" [0063.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.985] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.985] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.985] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="api-ms-win-crt-utility-l1-1-0.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" [0063.985] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0063.985] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ApiClient.dll") returned 1 [0063.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ApiClient.dll") returned 1 [0063.985] lstrcmpiA (lpString1="", lpString2="ApiClient.dll") returned -1 [0063.985] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned="api-ms-win-crt-utility-l1-1-0.dll" [0063.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.985] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.985] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.985] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="ApiClient.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" [0063.985] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0063.985] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppVCatalog.dll") returned 1 [0063.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppVCatalog.dll") returned 1 [0063.985] lstrcmpiA (lpString1="", lpString2="AppVCatalog.dll") returned -1 [0063.985] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned="ApiClient.dll" [0063.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.986] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.986] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.986] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.986] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppVCatalog.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" [0063.986] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0063.986] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="appvcleaner.exe") returned 1 [0063.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="appvcleaner.exe") returned 1 [0063.986] lstrcmpiA (lpString1="", lpString2="appvcleaner.exe") returned -1 [0063.986] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned="AppVCatalog.dll" [0063.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.986] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.986] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.986] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.986] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="appvcleaner.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" [0063.986] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0063.986] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppVFileSystemMetadata.dll") returned 1 [0063.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppVFileSystemMetadata.dll") returned 1 [0063.986] lstrcmpiA (lpString1="", lpString2="AppVFileSystemMetadata.dll") returned -1 [0063.986] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned="appvcleaner.exe" [0063.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.987] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.987] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.987] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.987] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppVFileSystemMetadata.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" [0063.987] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0063.987] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.987] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppVIntegration.dll") returned 1 [0063.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppVIntegration.dll") returned 1 [0063.987] lstrcmpiA (lpString1="", lpString2="AppVIntegration.dll") returned -1 [0063.987] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned="AppVFileSystemMetadata.dll" [0063.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.987] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.987] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.987] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.987] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppVIntegration.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" [0063.987] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0063.987] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.987] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppVIsvApi.dll") returned 1 [0063.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppVIsvApi.dll") returned 1 [0063.987] lstrcmpiA (lpString1="", lpString2="AppVIsvApi.dll") returned -1 [0063.987] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned="AppVIntegration.dll" [0063.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.987] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.987] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.987] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.988] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppVIsvApi.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" [0063.988] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0063.988] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppvIsvStream32.dll") returned 1 [0063.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppvIsvStream32.dll") returned 1 [0063.988] lstrcmpiA (lpString1="", lpString2="AppvIsvStream32.dll") returned -1 [0063.988] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned="AppVIsvApi.dll" [0063.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.988] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.988] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.988] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppvIsvStream32.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" [0063.988] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0063.988] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppvIsvStream64.dll") returned 1 [0063.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppvIsvStream64.dll") returned 1 [0063.988] lstrcmpiA (lpString1="", lpString2="AppvIsvStream64.dll") returned -1 [0063.988] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned="AppvIsvStream32.dll" [0063.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.988] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.988] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.988] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppvIsvStream64.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" [0063.988] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0063.988] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.989] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppVIsvStreamingManager.dll") returned 1 [0063.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppVIsvStreamingManager.dll") returned 1 [0063.989] lstrcmpiA (lpString1="", lpString2="AppVIsvStreamingManager.dll") returned -1 [0063.989] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned="AppvIsvStream64.dll" [0063.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.989] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.989] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.989] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppVIsvStreamingManager.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" [0063.989] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0063.989] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.989] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppVIsvSubsystemController.dll") returned 1 [0063.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppVIsvSubsystemController.dll") returned 1 [0063.989] lstrcmpiA (lpString1="", lpString2="AppVIsvSubsystemController.dll") returned -1 [0063.989] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned="AppVIsvStreamingManager.dll" [0063.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.989] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.989] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.989] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppVIsvSubsystemController.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" [0063.989] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0063.989] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.989] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppvIsvSubsystems32.dll") returned 1 [0063.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppvIsvSubsystems32.dll") returned 1 [0063.989] lstrcmpiA (lpString1="", lpString2="AppvIsvSubsystems32.dll") returned -1 [0063.989] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned="AppVIsvSubsystemController.dll" [0063.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.990] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.990] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppvIsvSubsystems32.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" [0063.990] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0063.990] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppvIsvSubsystems64.dll") returned 1 [0063.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppvIsvSubsystems64.dll") returned 1 [0063.990] lstrcmpiA (lpString1="", lpString2="AppvIsvSubsystems64.dll") returned -1 [0063.990] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned="AppvIsvSubsystems32.dll" [0063.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.990] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.990] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppvIsvSubsystems64.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" [0063.990] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0063.990] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppVIsvVirtualization.dll") returned 1 [0063.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppVIsvVirtualization.dll") returned 1 [0063.990] lstrcmpiA (lpString1="", lpString2="AppVIsvVirtualization.dll") returned -1 [0063.990] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned="AppvIsvSubsystems64.dll" [0063.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.990] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.990] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppVIsvVirtualization.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" [0063.991] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0063.991] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.991] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppVManifest.dll") returned 1 [0063.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppVManifest.dll") returned 1 [0063.991] lstrcmpiA (lpString1="", lpString2="AppVManifest.dll") returned -1 [0063.991] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned="AppVIsvVirtualization.dll" [0063.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.991] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.991] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppVManifest.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" [0063.991] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0063.991] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.991] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppVOrchestration.dll") returned 1 [0063.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppVOrchestration.dll") returned 1 [0063.991] lstrcmpiA (lpString1="", lpString2="AppVOrchestration.dll") returned -1 [0063.991] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned="AppVManifest.dll" [0063.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.991] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.991] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppVOrchestration.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" [0063.991] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0063.991] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.991] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppVPolicy.dll") returned 1 [0063.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppVPolicy.dll") returned 1 [0063.992] lstrcmpiA (lpString1="", lpString2="AppVPolicy.dll") returned -1 [0063.992] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned="AppVOrchestration.dll" [0063.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.992] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.992] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppVPolicy.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" [0063.992] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0063.992] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.992] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppVScripting.dll") returned 1 [0063.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppVScripting.dll") returned 1 [0063.992] lstrcmpiA (lpString1="", lpString2="AppVScripting.dll") returned -1 [0063.992] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned="AppVPolicy.dll" [0063.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.992] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.992] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppVScripting.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" [0063.992] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0063.992] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.992] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppVShNotify.exe") returned 1 [0063.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppVShNotify.exe") returned 1 [0063.992] lstrcmpiA (lpString1="", lpString2="AppVShNotify.exe") returned -1 [0063.992] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned="AppVScripting.dll" [0063.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.992] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.993] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="AppVShNotify.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" [0063.993] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14115400, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0063.993] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.993] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C2R32.dll") returned 1 [0063.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C2R32.dll") returned 1 [0063.993] lstrcmpiA (lpString1="", lpString2="C2R32.dll") returned -1 [0063.993] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned="AppVShNotify.exe" [0063.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.993] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.993] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.993] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="C2R32.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" [0063.993] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0063.993] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.993] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C2R64.dll") returned 1 [0063.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C2R64.dll") returned 1 [0063.993] lstrcmpiA (lpString1="", lpString2="C2R64.dll") returned -1 [0063.993] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned="C2R32.dll" [0063.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.993] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.993] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.993] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="C2R64.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" [0063.993] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8ee04f00, ftLastWriteTime.dwHighDateTime=0x1d0d67f, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml", cAlternateFileName="C2RHEA~1.XML")) returned 1 [0063.993] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.993] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C2RHeartbeatConfig.xml") returned 1 [0063.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C2RHeartbeatConfig.xml") returned 1 [0063.994] lstrcmpiA (lpString1="", lpString2="C2RHeartbeatConfig.xml") returned -1 [0063.994] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned="C2R64.dll" [0063.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.994] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.994] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.994] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="C2RHeartbeatConfig.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" [0063.994] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb3841600, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1 [0063.994] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C2RUI.en-us.dll") returned 1 [0063.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C2RUI.en-us.dll") returned 1 [0063.994] lstrcmpiA (lpString1="", lpString2="C2RUI.en-us.dll") returned -1 [0063.994] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned="C2RHeartbeatConfig.xml" [0063.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.994] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.994] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.994] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="C2RUI.en-us.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" [0063.994] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0063.994] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="concrt140.dll") returned 1 [0063.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="concrt140.dll") returned 1 [0063.994] lstrcmpiA (lpString1="", lpString2="concrt140.dll") returned -1 [0063.994] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned="C2RUI.en-us.dll" [0063.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.995] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.995] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="concrt140.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" [0063.995] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46742519, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x75f1db39, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x46742519, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0063.995] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.995] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0063.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0063.995] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1 [0063.995] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.995] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="i640.hash") returned -1 [0063.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="i640.hash") returned -1 [0063.995] lstrcmpiA (lpString1="", lpString2="i640.hash") returned -1 [0063.995] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned="concrt140.dll" [0063.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.995] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.995] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="i640.hash" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" [0063.995] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1 [0063.995] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.995] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="i641033.hash") returned -1 [0063.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="i641033.hash") returned -1 [0063.995] lstrcmpiA (lpString1="", lpString2="i641033.hash") returned -1 [0063.995] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned="i640.hash" [0063.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.995] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.996] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="i641033.hash" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" [0063.996] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0063.996] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.996] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IntegratedOffice.exe") returned -1 [0063.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IntegratedOffice.exe") returned -1 [0063.996] lstrcmpiA (lpString1="", lpString2="IntegratedOffice.exe") returned -1 [0063.996] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned="i641033.hash" [0063.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.996] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.996] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.996] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="IntegratedOffice.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" [0063.996] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1 [0063.996] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.996] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MavInject32.exe") returned -1 [0063.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MavInject32.exe") returned -1 [0063.996] lstrcmpiA (lpString1="", lpString2="MavInject32.exe") returned -1 [0063.996] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned="IntegratedOffice.exe" [0063.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.996] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.996] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.996] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="MavInject32.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" [0063.996] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0063.996] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.996] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mso20win32client.dll") returned -1 [0063.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mso20win32client.dll") returned -1 [0063.997] lstrcmpiA (lpString1="", lpString2="mso20win32client.dll") returned -1 [0063.997] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned="MavInject32.exe" [0063.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.997] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.997] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.997] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.997] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="mso20win32client.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" [0063.997] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0063.997] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.997] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mso30win32client.dll") returned -1 [0063.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mso30win32client.dll") returned -1 [0063.997] lstrcmpiA (lpString1="", lpString2="mso30win32client.dll") returned -1 [0063.997] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned="mso20win32client.dll" [0063.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.997] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.997] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.997] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.997] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="mso30win32client.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" [0063.997] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0063.997] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.997] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mso40uires.dll") returned -1 [0063.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mso40uires.dll") returned -1 [0063.997] lstrcmpiA (lpString1="", lpString2="mso40uires.dll") returned -1 [0063.997] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned="mso30win32client.dll" [0063.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.997] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.997] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.998] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.998] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="mso40uires.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" [0063.998] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1 [0063.998] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.998] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mso40uiwin32client.dll") returned -1 [0063.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mso40uiwin32client.dll") returned -1 [0063.998] lstrcmpiA (lpString1="", lpString2="mso40uiwin32client.dll") returned -1 [0063.998] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned="mso40uires.dll" [0063.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.998] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.998] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.998] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.998] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="mso40uiwin32client.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" [0063.998] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11fdc400, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1 [0063.998] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.998] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msointl30.en-us.dll") returned -1 [0063.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msointl30.en-us.dll") returned -1 [0063.998] lstrcmpiA (lpString1="", lpString2="msointl30.en-us.dll") returned -1 [0063.998] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned="mso40uiwin32client.dll" [0063.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.998] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0063.998] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0063.998] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0063.998] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="msointl30.en-us.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" [0063.998] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0063.999] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0063.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msvcp120.dll") returned -1 [0063.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msvcp120.dll") returned -1 [0063.999] lstrcmpiA (lpString1="", lpString2="msvcp120.dll") returned -1 [0063.999] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned="msointl30.en-us.dll" [0063.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0063.999] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0064.000] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0064.000] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0064.000] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="msvcp120.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" [0064.000] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0064.000] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.000] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msvcp140.dll") returned -1 [0064.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msvcp140.dll") returned -1 [0064.000] lstrcmpiA (lpString1="", lpString2="msvcp140.dll") returned -1 [0064.000] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned="msvcp120.dll" [0064.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0064.000] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0064.000] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0064.000] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0064.000] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="msvcp140.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" [0064.000] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0064.000] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.000] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msvcr120.dll") returned -1 [0064.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msvcr120.dll") returned -1 [0064.000] lstrcmpiA (lpString1="", lpString2="msvcr120.dll") returned -1 [0064.000] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned="msvcp140.dll" [0064.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0064.000] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0064.000] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0064.000] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0064.000] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="msvcr120.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" [0064.001] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0064.001] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeC2RClient.exe") returned -1 [0064.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeC2RClient.exe") returned -1 [0064.001] lstrcmpiA (lpString1="", lpString2="OfficeC2RClient.exe") returned -1 [0064.001] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned="msvcr120.dll" [0064.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0064.001] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0064.001] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0064.001] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0064.001] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="OfficeC2RClient.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" [0064.001] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1 [0064.001] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeC2RCom.dll") returned -1 [0064.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeC2RCom.dll") returned -1 [0064.001] lstrcmpiA (lpString1="", lpString2="OfficeC2RCom.dll") returned -1 [0064.001] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned="OfficeC2RClient.exe" [0064.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0064.001] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0064.001] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0064.001] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0064.001] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="OfficeC2RCom.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" [0064.001] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1 [0064.001] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeClickToRun.exe") returned -1 [0064.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeClickToRun.exe") returned -1 [0064.002] lstrcmpiA (lpString1="", lpString2="OfficeClickToRun.exe") returned -1 [0064.002] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned="OfficeC2RCom.dll" [0064.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0064.002] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0064.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0064.002] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0064.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="OfficeClickToRun.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" [0064.002] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f141b52, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0064.002] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.002] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeUpdateSchedule.xml") returned -1 [0064.002] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeUpdateSchedule.xml") returned -1 [0064.002] lstrcmpiA (lpString1="", lpString2="OfficeUpdateSchedule.xml") returned -1 [0064.002] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0064.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0064.002] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0064.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0064.002] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0064.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="OfficeUpdateSchedule.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" [0064.002] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3fa7ec8f, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml", cAlternateFileName="SERVIC~1.XML")) returned 1 [0064.002] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.002] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceWatcherSchedule.xml") returned -1 [0064.002] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceWatcherSchedule.xml") returned -1 [0064.002] lstrcmpiA (lpString1="", lpString2="ServiceWatcherSchedule.xml") returned -1 [0064.002] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned="OfficeUpdateSchedule.xml" [0064.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0064.002] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0064.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0064.003] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0064.003] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="ServiceWatcherSchedule.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" [0064.003] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1 [0064.003] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StreamServer.dll") returned -1 [0064.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StreamServer.dll") returned -1 [0064.003] lstrcmpiA (lpString1="", lpString2="StreamServer.dll") returned -1 [0064.003] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned="ServiceWatcherSchedule.xml" [0064.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0064.003] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0064.003] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0064.003] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0064.003] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="StreamServer.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" [0064.003] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0064.003] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ucrtbase.dll") returned -1 [0064.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ucrtbase.dll") returned -1 [0064.003] lstrcmpiA (lpString1="", lpString2="ucrtbase.dll") returned -1 [0064.003] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned="StreamServer.dll" [0064.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0064.003] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0064.003] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0064.003] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0064.003] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="ucrtbase.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" [0064.003] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0064.004] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.004] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vccorlib140.dll") returned -1 [0064.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vccorlib140.dll") returned -1 [0064.004] lstrcmpiA (lpString1="", lpString2="vccorlib140.dll") returned -1 [0064.004] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned="ucrtbase.dll" [0064.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0064.004] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0064.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0064.004] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0064.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="vccorlib140.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" [0064.004] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0064.004] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.004] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vcruntime140.dll") returned -1 [0064.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vcruntime140.dll") returned -1 [0064.004] lstrcmpiA (lpString1="", lpString2="vcruntime140.dll") returned -1 [0064.004] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned="vccorlib140.dll" [0064.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" [0064.004] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned="" [0064.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" [0064.004] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\how to decrypt files.txt")) returned 0x20 [0064.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", lpString2="vcruntime140.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" [0064.004] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0064.004] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0064.005] FindNextFileA (in: hFindFile=0x759d10, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x752268, cFileName="ink", cAlternateFileName="")) returned 1 [0064.005] lstrcmpA (lpString1=".", lpString2="ink") returned -1 [0064.005] lstrcmpA (lpString1="..", lpString2="ink") returned -1 [0064.005] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\", lpString2="ink" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink" [0064.005] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e90 [0064.009] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.009] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.009] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.009] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.009] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0064.009] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Alphabet.xml") returned 1 [0064.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Alphabet.xml") returned 1 [0064.009] lstrcmpiA (lpString1="", lpString2="Alphabet.xml") returned -1 [0064.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.009] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.009] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.009] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0xffffffff [0064.010] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0064.010] WriteFile (in: hFile=0x210, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.011] SetFileTime (hFile=0x210, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.011] CloseHandle (hObject=0x210) returned 1 [0064.011] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="Alphabet.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" [0064.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.zip") returned 0 [0064.011] lstrlenA (lpString="*.zip") returned 5 [0064.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.rar") returned 0 [0064.011] lstrlenA (lpString="*.rar") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.7z") returned 0 [0064.012] lstrlenA (lpString="*.7z") returned 4 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.tar") returned 0 [0064.012] lstrlenA (lpString="*.tar") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.gzip") returned 0 [0064.012] lstrlenA (lpString="*.gzip") returned 6 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.jpg") returned 0 [0064.012] lstrlenA (lpString="*.jpg") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.jpeg") returned 0 [0064.012] lstrlenA (lpString="*.jpeg") returned 6 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.psd") returned 0 [0064.012] lstrlenA (lpString="*.psd") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.cdr") returned 0 [0064.012] lstrlenA (lpString="*.cdr") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.dwg") returned 0 [0064.012] lstrlenA (lpString="*.dwg") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.max") returned 0 [0064.012] lstrlenA (lpString="*.max") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.bmp") returned 0 [0064.012] lstrlenA (lpString="*.bmp") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.gif") returned 0 [0064.012] lstrlenA (lpString="*.gif") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.png") returned 0 [0064.012] lstrlenA (lpString="*.png") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.doc") returned 0 [0064.012] lstrlenA (lpString="*.doc") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.docx") returned 0 [0064.012] lstrlenA (lpString="*.docx") returned 6 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.xls") returned 0 [0064.012] lstrlenA (lpString="*.xls") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.xlsx") returned 0 [0064.012] lstrlenA (lpString="*.xlsx") returned 6 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.ppt") returned 0 [0064.012] lstrlenA (lpString="*.ppt") returned 5 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.pptx") returned 0 [0064.012] lstrlenA (lpString="*.pptx") returned 6 [0064.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.txt") returned 0 [0064.013] lstrlenA (lpString="*.txt") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.pdf") returned 0 [0064.013] lstrlenA (lpString="*.pdf") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.djvu") returned 0 [0064.013] lstrlenA (lpString="*.djvu") returned 6 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.htm") returned 0 [0064.013] lstrlenA (lpString="*.htm") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.html") returned 0 [0064.013] lstrlenA (lpString="*.html") returned 6 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mdb") returned 0 [0064.013] lstrlenA (lpString="*.mdb") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.cer") returned 0 [0064.013] lstrlenA (lpString="*.cer") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.p12") returned 0 [0064.013] lstrlenA (lpString="*.p12") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.pfx") returned 0 [0064.013] lstrlenA (lpString="*.pfx") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.kwm") returned 0 [0064.013] lstrlenA (lpString="*.kwm") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.pwm") returned 0 [0064.013] lstrlenA (lpString="*.pwm") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.1cd") returned 0 [0064.013] lstrlenA (lpString="*.1cd") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.md") returned 0 [0064.013] lstrlenA (lpString="*.md") returned 4 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mdf") returned 0 [0064.013] lstrlenA (lpString="*.mdf") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.dbf") returned 0 [0064.013] lstrlenA (lpString="*.dbf") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.odt") returned 0 [0064.013] lstrlenA (lpString="*.odt") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.vob") returned 0 [0064.013] lstrlenA (lpString="*.vob") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.ifo") returned 0 [0064.013] lstrlenA (lpString="*.ifo") returned 5 [0064.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.lnk") returned 0 [0064.013] lstrlenA (lpString="*.lnk") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.torrent") returned 0 [0064.014] lstrlenA (lpString="*.torrent") returned 9 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mov") returned 0 [0064.014] lstrlenA (lpString="*.mov") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.m2v") returned 0 [0064.014] lstrlenA (lpString="*.m2v") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.3gp") returned 0 [0064.014] lstrlenA (lpString="*.3gp") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mpeg") returned 0 [0064.014] lstrlenA (lpString="*.mpeg") returned 6 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mpg") returned 0 [0064.014] lstrlenA (lpString="*.mpg") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.flv") returned 0 [0064.014] lstrlenA (lpString="*.flv") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.avi") returned 0 [0064.014] lstrlenA (lpString="*.avi") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mp4") returned 0 [0064.014] lstrlenA (lpString="*.mp4") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.wmv") returned 0 [0064.014] lstrlenA (lpString="*.wmv") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.divx") returned 0 [0064.014] lstrlenA (lpString="*.divx") returned 6 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mkv") returned 0 [0064.014] lstrlenA (lpString="*.mkv") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.mp3") returned 0 [0064.014] lstrlenA (lpString="*.mp3") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.wav") returned 0 [0064.014] lstrlenA (lpString="*.wav") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.flac") returned 0 [0064.014] lstrlenA (lpString="*.flac") returned 6 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.ape") returned 0 [0064.014] lstrlenA (lpString="*.ape") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.wma") returned 0 [0064.014] lstrlenA (lpString="*.wma") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.ac3") returned 0 [0064.014] lstrlenA (lpString="*.ac3") returned 5 [0064.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", pszSpec="*.doc") returned 0 [0064.015] lstrlenA (lpString="*.doc") returned 5 [0064.015] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0064.015] lstrcmpA (lpString1=".", lpString2="ar-SA") returned -1 [0064.015] lstrcmpA (lpString1="..", lpString2="ar-SA") returned -1 [0064.015] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ar-SA" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA" [0064.015] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA") returned 56 [0064.015] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x752a80, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0064.019] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.019] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x752a80, dwReserved1=0xa8, cFileName="..", cAlternateFileName="")) returned 1 [0064.020] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.020] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.020] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x752a80, dwReserved1=0xa8, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.020] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.020] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\" [0064.020] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\") returned="" [0064.020] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" [0064.020] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\how to decrypt files.txt")) returned 0xffffffff [0064.020] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.021] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.021] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.022] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.022] CloseHandle (hObject=0x214) returned 1 [0064.023] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.023] lstrlenA (lpString="*.zip") returned 5 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.023] lstrlenA (lpString="*.rar") returned 5 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.023] lstrlenA (lpString="*.7z") returned 4 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.023] lstrlenA (lpString="*.tar") returned 5 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.023] lstrlenA (lpString="*.gzip") returned 6 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.023] lstrlenA (lpString="*.jpg") returned 5 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.023] lstrlenA (lpString="*.jpeg") returned 6 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.023] lstrlenA (lpString="*.psd") returned 5 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.023] lstrlenA (lpString="*.cdr") returned 5 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.023] lstrlenA (lpString="*.dwg") returned 5 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.023] lstrlenA (lpString="*.max") returned 5 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.023] lstrlenA (lpString="*.bmp") returned 5 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.023] lstrlenA (lpString="*.gif") returned 5 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.023] lstrlenA (lpString="*.png") returned 5 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.023] lstrlenA (lpString="*.doc") returned 5 [0064.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.023] lstrlenA (lpString="*.docx") returned 6 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.024] lstrlenA (lpString="*.xls") returned 5 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.024] lstrlenA (lpString="*.xlsx") returned 6 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.024] lstrlenA (lpString="*.ppt") returned 5 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.024] lstrlenA (lpString="*.pptx") returned 6 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.024] lstrlenA (lpString="*.txt") returned 5 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.024] lstrlenA (lpString="*.pdf") returned 5 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.024] lstrlenA (lpString="*.djvu") returned 6 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.024] lstrlenA (lpString="*.htm") returned 5 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.024] lstrlenA (lpString="*.html") returned 6 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.024] lstrlenA (lpString="*.mdb") returned 5 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.024] lstrlenA (lpString="*.cer") returned 5 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.024] lstrlenA (lpString="*.p12") returned 5 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.024] lstrlenA (lpString="*.pfx") returned 5 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.024] lstrlenA (lpString="*.kwm") returned 5 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.024] lstrlenA (lpString="*.pwm") returned 5 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.024] lstrlenA (lpString="*.1cd") returned 5 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.024] lstrlenA (lpString="*.md") returned 4 [0064.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.024] lstrlenA (lpString="*.mdf") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.025] lstrlenA (lpString="*.dbf") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.025] lstrlenA (lpString="*.odt") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.025] lstrlenA (lpString="*.vob") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.025] lstrlenA (lpString="*.ifo") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.025] lstrlenA (lpString="*.lnk") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.025] lstrlenA (lpString="*.torrent") returned 9 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.025] lstrlenA (lpString="*.mov") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.025] lstrlenA (lpString="*.m2v") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.025] lstrlenA (lpString="*.3gp") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.025] lstrlenA (lpString="*.mpeg") returned 6 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.025] lstrlenA (lpString="*.mpg") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.025] lstrlenA (lpString="*.flv") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.025] lstrlenA (lpString="*.avi") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.025] lstrlenA (lpString="*.mp4") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.025] lstrlenA (lpString="*.wmv") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.025] lstrlenA (lpString="*.divx") returned 6 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.025] lstrlenA (lpString="*.mkv") returned 5 [0064.025] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.025] lstrlenA (lpString="*.mp3") returned 5 [0064.026] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.026] lstrlenA (lpString="*.wav") returned 5 [0064.026] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.026] lstrlenA (lpString="*.flac") returned 6 [0064.026] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.026] lstrlenA (lpString="*.ape") returned 5 [0064.026] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.026] lstrlenA (lpString="*.wma") returned 5 [0064.026] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.026] lstrlenA (lpString="*.ac3") returned 5 [0064.026] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.026] lstrlenA (lpString="*.doc") returned 5 [0064.026] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x752a80, dwReserved1=0xa8, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.026] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0064.026] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0064.026] lstrcmpA (lpString1=".", lpString2="bg-BG") returned -1 [0064.026] lstrcmpA (lpString1="..", lpString2="bg-BG") returned -1 [0064.026] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.026] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="bg-BG" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG" [0064.026] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG") returned 56 [0064.026] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0064.026] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.027] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.027] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.027] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.027] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.027] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.027] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.027] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*.*") returned="*.*" [0064.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\" [0064.027] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\") returned="" [0064.027] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" [0064.027] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\how to decrypt files.txt")) returned 0xffffffff [0064.027] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.027] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.027] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.028] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.028] CloseHandle (hObject=0x214) returned 1 [0064.029] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.029] lstrlenA (lpString="*.zip") returned 5 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.029] lstrlenA (lpString="*.rar") returned 5 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.029] lstrlenA (lpString="*.7z") returned 4 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.029] lstrlenA (lpString="*.tar") returned 5 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.029] lstrlenA (lpString="*.gzip") returned 6 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.029] lstrlenA (lpString="*.jpg") returned 5 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.029] lstrlenA (lpString="*.jpeg") returned 6 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.029] lstrlenA (lpString="*.psd") returned 5 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.029] lstrlenA (lpString="*.cdr") returned 5 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.029] lstrlenA (lpString="*.dwg") returned 5 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.029] lstrlenA (lpString="*.max") returned 5 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.029] lstrlenA (lpString="*.bmp") returned 5 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.029] lstrlenA (lpString="*.gif") returned 5 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.029] lstrlenA (lpString="*.png") returned 5 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.029] lstrlenA (lpString="*.doc") returned 5 [0064.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.029] lstrlenA (lpString="*.docx") returned 6 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.030] lstrlenA (lpString="*.xls") returned 5 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.030] lstrlenA (lpString="*.xlsx") returned 6 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.030] lstrlenA (lpString="*.ppt") returned 5 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.030] lstrlenA (lpString="*.pptx") returned 6 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.030] lstrlenA (lpString="*.txt") returned 5 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.030] lstrlenA (lpString="*.pdf") returned 5 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.030] lstrlenA (lpString="*.djvu") returned 6 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.030] lstrlenA (lpString="*.htm") returned 5 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.030] lstrlenA (lpString="*.html") returned 6 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.030] lstrlenA (lpString="*.mdb") returned 5 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.030] lstrlenA (lpString="*.cer") returned 5 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.030] lstrlenA (lpString="*.p12") returned 5 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.030] lstrlenA (lpString="*.pfx") returned 5 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.030] lstrlenA (lpString="*.kwm") returned 5 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.030] lstrlenA (lpString="*.pwm") returned 5 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.030] lstrlenA (lpString="*.1cd") returned 5 [0064.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.031] lstrlenA (lpString="*.md") returned 4 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.031] lstrlenA (lpString="*.mdf") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.031] lstrlenA (lpString="*.dbf") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.031] lstrlenA (lpString="*.odt") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.031] lstrlenA (lpString="*.vob") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.031] lstrlenA (lpString="*.ifo") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.031] lstrlenA (lpString="*.lnk") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.031] lstrlenA (lpString="*.torrent") returned 9 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.031] lstrlenA (lpString="*.mov") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.031] lstrlenA (lpString="*.m2v") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.031] lstrlenA (lpString="*.3gp") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.031] lstrlenA (lpString="*.mpeg") returned 6 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.031] lstrlenA (lpString="*.mpg") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.031] lstrlenA (lpString="*.flv") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.031] lstrlenA (lpString="*.avi") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.031] lstrlenA (lpString="*.mp4") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.031] lstrlenA (lpString="*.wmv") returned 5 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.031] lstrlenA (lpString="*.divx") returned 6 [0064.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.031] lstrlenA (lpString="*.mkv") returned 5 [0064.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.032] lstrlenA (lpString="*.mp3") returned 5 [0064.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.032] lstrlenA (lpString="*.wav") returned 5 [0064.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.032] lstrlenA (lpString="*.flac") returned 6 [0064.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.032] lstrlenA (lpString="*.ape") returned 5 [0064.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.032] lstrlenA (lpString="*.wma") returned 5 [0064.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.032] lstrlenA (lpString="*.ac3") returned 5 [0064.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.032] lstrlenA (lpString="*.doc") returned 5 [0064.032] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.032] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0064.032] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0064.032] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Content.xml") returned 1 [0064.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Content.xml") returned 1 [0064.032] lstrcmpiA (lpString1="", lpString2="Content.xml") returned -1 [0064.032] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="Content.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" [0064.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.zip") returned 0 [0064.032] lstrlenA (lpString="*.zip") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.rar") returned 0 [0064.033] lstrlenA (lpString="*.rar") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.7z") returned 0 [0064.033] lstrlenA (lpString="*.7z") returned 4 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.tar") returned 0 [0064.033] lstrlenA (lpString="*.tar") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.gzip") returned 0 [0064.033] lstrlenA (lpString="*.gzip") returned 6 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.jpg") returned 0 [0064.033] lstrlenA (lpString="*.jpg") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.jpeg") returned 0 [0064.033] lstrlenA (lpString="*.jpeg") returned 6 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.psd") returned 0 [0064.033] lstrlenA (lpString="*.psd") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.cdr") returned 0 [0064.033] lstrlenA (lpString="*.cdr") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.dwg") returned 0 [0064.033] lstrlenA (lpString="*.dwg") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.max") returned 0 [0064.033] lstrlenA (lpString="*.max") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.bmp") returned 0 [0064.033] lstrlenA (lpString="*.bmp") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.gif") returned 0 [0064.033] lstrlenA (lpString="*.gif") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.png") returned 0 [0064.033] lstrlenA (lpString="*.png") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.doc") returned 0 [0064.033] lstrlenA (lpString="*.doc") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.docx") returned 0 [0064.033] lstrlenA (lpString="*.docx") returned 6 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.xls") returned 0 [0064.033] lstrlenA (lpString="*.xls") returned 5 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.xlsx") returned 0 [0064.033] lstrlenA (lpString="*.xlsx") returned 6 [0064.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.ppt") returned 0 [0064.033] lstrlenA (lpString="*.ppt") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.pptx") returned 0 [0064.034] lstrlenA (lpString="*.pptx") returned 6 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.txt") returned 0 [0064.034] lstrlenA (lpString="*.txt") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.pdf") returned 0 [0064.034] lstrlenA (lpString="*.pdf") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.djvu") returned 0 [0064.034] lstrlenA (lpString="*.djvu") returned 6 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.htm") returned 0 [0064.034] lstrlenA (lpString="*.htm") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.html") returned 0 [0064.034] lstrlenA (lpString="*.html") returned 6 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mdb") returned 0 [0064.034] lstrlenA (lpString="*.mdb") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.cer") returned 0 [0064.034] lstrlenA (lpString="*.cer") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.p12") returned 0 [0064.034] lstrlenA (lpString="*.p12") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.pfx") returned 0 [0064.034] lstrlenA (lpString="*.pfx") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.kwm") returned 0 [0064.034] lstrlenA (lpString="*.kwm") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.pwm") returned 0 [0064.034] lstrlenA (lpString="*.pwm") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.1cd") returned 0 [0064.034] lstrlenA (lpString="*.1cd") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.md") returned 0 [0064.034] lstrlenA (lpString="*.md") returned 4 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mdf") returned 0 [0064.034] lstrlenA (lpString="*.mdf") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.dbf") returned 0 [0064.034] lstrlenA (lpString="*.dbf") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.odt") returned 0 [0064.034] lstrlenA (lpString="*.odt") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.vob") returned 0 [0064.034] lstrlenA (lpString="*.vob") returned 5 [0064.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.ifo") returned 0 [0064.035] lstrlenA (lpString="*.ifo") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.lnk") returned 0 [0064.035] lstrlenA (lpString="*.lnk") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.torrent") returned 0 [0064.035] lstrlenA (lpString="*.torrent") returned 9 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mov") returned 0 [0064.035] lstrlenA (lpString="*.mov") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.m2v") returned 0 [0064.035] lstrlenA (lpString="*.m2v") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.3gp") returned 0 [0064.035] lstrlenA (lpString="*.3gp") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mpeg") returned 0 [0064.035] lstrlenA (lpString="*.mpeg") returned 6 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mpg") returned 0 [0064.035] lstrlenA (lpString="*.mpg") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.flv") returned 0 [0064.035] lstrlenA (lpString="*.flv") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.avi") returned 0 [0064.035] lstrlenA (lpString="*.avi") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mp4") returned 0 [0064.035] lstrlenA (lpString="*.mp4") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.wmv") returned 0 [0064.035] lstrlenA (lpString="*.wmv") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.divx") returned 0 [0064.035] lstrlenA (lpString="*.divx") returned 6 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mkv") returned 0 [0064.035] lstrlenA (lpString="*.mkv") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.mp3") returned 0 [0064.035] lstrlenA (lpString="*.mp3") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.wav") returned 0 [0064.035] lstrlenA (lpString="*.wav") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.flac") returned 0 [0064.035] lstrlenA (lpString="*.flac") returned 6 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.ape") returned 0 [0064.035] lstrlenA (lpString="*.ape") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.wma") returned 0 [0064.035] lstrlenA (lpString="*.wma") returned 5 [0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.ac3") returned 0 [0064.036] lstrlenA (lpString="*.ac3") returned 5 [0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", pszSpec="*.doc") returned 0 [0064.036] lstrlenA (lpString="*.doc") returned 5 [0064.036] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0064.036] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0064.036] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0064.036] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned="Content.xml" [0064.036] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="cs-CZ" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ" [0064.036] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ") returned 56 [0064.036] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x759990 [0064.036] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.036] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xa8, cFileName="..", cAlternateFileName="")) returned 1 [0064.036] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.036] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.036] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x740000, dwReserved1=0xa8, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.036] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.036] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.036] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.036] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*.*") returned="*.*" [0064.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\" [0064.036] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\") returned="" [0064.036] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0064.037] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff [0064.037] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.037] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.037] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.038] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.038] CloseHandle (hObject=0x214) returned 1 [0064.038] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" [0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.038] lstrlenA (lpString="*.zip") returned 5 [0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.038] lstrlenA (lpString="*.rar") returned 5 [0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.038] lstrlenA (lpString="*.7z") returned 4 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.039] lstrlenA (lpString="*.tar") returned 5 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.039] lstrlenA (lpString="*.gzip") returned 6 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.039] lstrlenA (lpString="*.jpg") returned 5 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.039] lstrlenA (lpString="*.jpeg") returned 6 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.039] lstrlenA (lpString="*.psd") returned 5 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.039] lstrlenA (lpString="*.cdr") returned 5 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.039] lstrlenA (lpString="*.dwg") returned 5 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.039] lstrlenA (lpString="*.max") returned 5 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.041] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x740000, dwReserved1=0xa8, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.041] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0064.041] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0064.041] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0064.041] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0064.041] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.041] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="da-DK" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK" [0064.041] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0064.041] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.041] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.041] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.042] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.042] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.042] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.042] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.042] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.042] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*.*") returned="*.*" [0064.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\" [0064.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\") returned="" [0064.042] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" [0064.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\how to decrypt files.txt")) returned 0xffffffff [0064.042] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.042] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.043] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.043] CloseHandle (hObject=0x214) returned 1 [0064.043] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" [0064.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.044] lstrlenA (lpString="*.zip") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.044] lstrlenA (lpString="*.rar") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.044] lstrlenA (lpString="*.7z") returned 4 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.044] lstrlenA (lpString="*.tar") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.044] lstrlenA (lpString="*.gzip") returned 6 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.044] lstrlenA (lpString="*.jpg") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.044] lstrlenA (lpString="*.jpeg") returned 6 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.044] lstrlenA (lpString="*.psd") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.044] lstrlenA (lpString="*.cdr") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.044] lstrlenA (lpString="*.dwg") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.044] lstrlenA (lpString="*.max") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.044] lstrlenA (lpString="*.bmp") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.044] lstrlenA (lpString="*.gif") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.044] lstrlenA (lpString="*.png") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.044] lstrlenA (lpString="*.doc") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.044] lstrlenA (lpString="*.docx") returned 6 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.044] lstrlenA (lpString="*.xls") returned 5 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.044] lstrlenA (lpString="*.xlsx") returned 6 [0064.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.044] lstrlenA (lpString="*.ppt") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.045] lstrlenA (lpString="*.pptx") returned 6 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.045] lstrlenA (lpString="*.txt") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.045] lstrlenA (lpString="*.pdf") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.045] lstrlenA (lpString="*.djvu") returned 6 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.045] lstrlenA (lpString="*.htm") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.045] lstrlenA (lpString="*.html") returned 6 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.045] lstrlenA (lpString="*.mdb") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.045] lstrlenA (lpString="*.cer") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.045] lstrlenA (lpString="*.p12") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.045] lstrlenA (lpString="*.pfx") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.045] lstrlenA (lpString="*.kwm") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.045] lstrlenA (lpString="*.pwm") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.045] lstrlenA (lpString="*.1cd") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.045] lstrlenA (lpString="*.md") returned 4 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.045] lstrlenA (lpString="*.mdf") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.045] lstrlenA (lpString="*.dbf") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.045] lstrlenA (lpString="*.odt") returned 5 [0064.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.052] lstrlenA (lpString="*.vob") returned 5 [0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.052] lstrlenA (lpString="*.ifo") returned 5 [0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.052] lstrlenA (lpString="*.lnk") returned 5 [0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.052] lstrlenA (lpString="*.torrent") returned 9 [0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.052] lstrlenA (lpString="*.mov") returned 5 [0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.052] lstrlenA (lpString="*.m2v") returned 5 [0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.052] lstrlenA (lpString="*.3gp") returned 5 [0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.052] lstrlenA (lpString="*.mpeg") returned 6 [0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.052] lstrlenA (lpString="*.mpg") returned 5 [0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.052] lstrlenA (lpString="*.flv") returned 5 [0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.052] lstrlenA (lpString="*.avi") returned 5 [0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.052] lstrlenA (lpString="*.mp4") returned 5 [0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.053] lstrlenA (lpString="*.wmv") returned 5 [0064.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.053] lstrlenA (lpString="*.divx") returned 6 [0064.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.053] lstrlenA (lpString="*.mkv") returned 5 [0064.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.053] lstrlenA (lpString="*.mp3") returned 5 [0064.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.053] lstrlenA (lpString="*.wav") returned 5 [0064.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.053] lstrlenA (lpString="*.flac") returned 6 [0064.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.053] lstrlenA (lpString="*.ape") returned 5 [0064.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.053] lstrlenA (lpString="*.wma") returned 5 [0064.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.053] lstrlenA (lpString="*.ac3") returned 5 [0064.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.053] lstrlenA (lpString="*.doc") returned 5 [0064.053] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.053] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0064.053] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0064.053] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0064.053] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0064.053] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.053] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="de-DE" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE" [0064.053] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE") returned 56 [0064.053] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0064.055] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.055] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.055] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.055] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.055] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.055] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.055] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.055] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*.*") returned="*.*" [0064.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\" [0064.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\") returned="" [0064.055] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" [0064.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\how to decrypt files.txt")) returned 0xffffffff [0064.055] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.056] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.056] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.057] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.057] CloseHandle (hObject=0x214) returned 1 [0064.057] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.058] lstrlenA (lpString="*.zip") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.058] lstrlenA (lpString="*.rar") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.058] lstrlenA (lpString="*.7z") returned 4 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.058] lstrlenA (lpString="*.tar") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.058] lstrlenA (lpString="*.gzip") returned 6 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.058] lstrlenA (lpString="*.jpg") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.058] lstrlenA (lpString="*.jpeg") returned 6 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.058] lstrlenA (lpString="*.psd") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.058] lstrlenA (lpString="*.cdr") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.058] lstrlenA (lpString="*.dwg") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.058] lstrlenA (lpString="*.max") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.058] lstrlenA (lpString="*.bmp") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.058] lstrlenA (lpString="*.gif") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.058] lstrlenA (lpString="*.png") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.058] lstrlenA (lpString="*.doc") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.058] lstrlenA (lpString="*.docx") returned 6 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.058] lstrlenA (lpString="*.xls") returned 5 [0064.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.058] lstrlenA (lpString="*.xlsx") returned 6 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.059] lstrlenA (lpString="*.ppt") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.059] lstrlenA (lpString="*.pptx") returned 6 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.059] lstrlenA (lpString="*.txt") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.059] lstrlenA (lpString="*.pdf") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.059] lstrlenA (lpString="*.djvu") returned 6 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.059] lstrlenA (lpString="*.htm") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.059] lstrlenA (lpString="*.html") returned 6 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.059] lstrlenA (lpString="*.mdb") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.059] lstrlenA (lpString="*.cer") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.059] lstrlenA (lpString="*.p12") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.059] lstrlenA (lpString="*.pfx") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.059] lstrlenA (lpString="*.kwm") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.059] lstrlenA (lpString="*.pwm") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.059] lstrlenA (lpString="*.1cd") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.059] lstrlenA (lpString="*.md") returned 4 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.059] lstrlenA (lpString="*.mdf") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.059] lstrlenA (lpString="*.dbf") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.059] lstrlenA (lpString="*.odt") returned 5 [0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.060] lstrlenA (lpString="*.vob") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.060] lstrlenA (lpString="*.ifo") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.060] lstrlenA (lpString="*.lnk") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.060] lstrlenA (lpString="*.torrent") returned 9 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.060] lstrlenA (lpString="*.mov") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.060] lstrlenA (lpString="*.m2v") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.060] lstrlenA (lpString="*.3gp") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.060] lstrlenA (lpString="*.mpeg") returned 6 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.060] lstrlenA (lpString="*.mpg") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.060] lstrlenA (lpString="*.flv") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.060] lstrlenA (lpString="*.avi") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.060] lstrlenA (lpString="*.mp4") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.060] lstrlenA (lpString="*.wmv") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.060] lstrlenA (lpString="*.divx") returned 6 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.060] lstrlenA (lpString="*.mkv") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.060] lstrlenA (lpString="*.mp3") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.060] lstrlenA (lpString="*.wav") returned 5 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.060] lstrlenA (lpString="*.flac") returned 6 [0064.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.061] lstrlenA (lpString="*.ape") returned 5 [0064.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.061] lstrlenA (lpString="*.wma") returned 5 [0064.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.061] lstrlenA (lpString="*.ac3") returned 5 [0064.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.061] lstrlenA (lpString="*.doc") returned 5 [0064.061] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.061] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0064.061] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0064.061] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1 [0064.061] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1 [0064.061] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.061] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="el-GR" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR" [0064.061] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR") returned 56 [0064.062] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0064.062] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.062] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.062] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.062] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.062] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.062] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.063] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.063] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*.*") returned="*.*" [0064.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\" [0064.063] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\") returned="" [0064.063] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" [0064.063] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\how to decrypt files.txt")) returned 0xffffffff [0064.063] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.063] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.063] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.064] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.064] CloseHandle (hObject=0x214) returned 1 [0064.064] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" [0064.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.064] lstrlenA (lpString="*.zip") returned 5 [0064.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.065] lstrlenA (lpString="*.rar") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.065] lstrlenA (lpString="*.7z") returned 4 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.065] lstrlenA (lpString="*.tar") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.065] lstrlenA (lpString="*.gzip") returned 6 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.065] lstrlenA (lpString="*.jpg") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.065] lstrlenA (lpString="*.jpeg") returned 6 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.065] lstrlenA (lpString="*.psd") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.065] lstrlenA (lpString="*.cdr") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.065] lstrlenA (lpString="*.dwg") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.065] lstrlenA (lpString="*.max") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.065] lstrlenA (lpString="*.bmp") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.065] lstrlenA (lpString="*.gif") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.065] lstrlenA (lpString="*.png") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.065] lstrlenA (lpString="*.doc") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.065] lstrlenA (lpString="*.docx") returned 6 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.065] lstrlenA (lpString="*.xls") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.065] lstrlenA (lpString="*.xlsx") returned 6 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.065] lstrlenA (lpString="*.ppt") returned 5 [0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.066] lstrlenA (lpString="*.pptx") returned 6 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.066] lstrlenA (lpString="*.txt") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.066] lstrlenA (lpString="*.pdf") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.066] lstrlenA (lpString="*.djvu") returned 6 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.066] lstrlenA (lpString="*.htm") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.066] lstrlenA (lpString="*.html") returned 6 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.066] lstrlenA (lpString="*.mdb") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.066] lstrlenA (lpString="*.cer") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.066] lstrlenA (lpString="*.p12") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.066] lstrlenA (lpString="*.pfx") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.066] lstrlenA (lpString="*.kwm") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.066] lstrlenA (lpString="*.pwm") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.066] lstrlenA (lpString="*.1cd") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.066] lstrlenA (lpString="*.md") returned 4 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.066] lstrlenA (lpString="*.mdf") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.066] lstrlenA (lpString="*.dbf") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.066] lstrlenA (lpString="*.odt") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.066] lstrlenA (lpString="*.vob") returned 5 [0064.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.066] lstrlenA (lpString="*.ifo") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.067] lstrlenA (lpString="*.lnk") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.067] lstrlenA (lpString="*.torrent") returned 9 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.067] lstrlenA (lpString="*.mov") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.067] lstrlenA (lpString="*.m2v") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.067] lstrlenA (lpString="*.3gp") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.067] lstrlenA (lpString="*.mpeg") returned 6 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.067] lstrlenA (lpString="*.mpg") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.067] lstrlenA (lpString="*.flv") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.067] lstrlenA (lpString="*.avi") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.067] lstrlenA (lpString="*.mp4") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.067] lstrlenA (lpString="*.wmv") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.067] lstrlenA (lpString="*.divx") returned 6 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.067] lstrlenA (lpString="*.mkv") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.067] lstrlenA (lpString="*.mp3") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.067] lstrlenA (lpString="*.wav") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.067] lstrlenA (lpString="*.flac") returned 6 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.067] lstrlenA (lpString="*.ape") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.067] lstrlenA (lpString="*.wma") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.068] lstrlenA (lpString="*.ac3") returned 5 [0064.068] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.068] lstrlenA (lpString="*.doc") returned 5 [0064.068] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.068] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0064.068] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0064.068] lstrcmpA (lpString1=".", lpString2="en-GB") returned -1 [0064.068] lstrcmpA (lpString1="..", lpString2="en-GB") returned -1 [0064.068] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.068] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="en-GB" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB" [0064.068] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB") returned 56 [0064.068] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0064.068] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.068] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.068] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.068] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.068] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.068] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.068] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.068] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.069] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*.*") returned="*.*" [0064.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\" [0064.069] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\") returned="" [0064.069] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\HOW TO DECRYPT FILES.txt" [0064.069] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\how to decrypt files.txt")) returned 0xffffffff [0064.069] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.069] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.069] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.070] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.070] CloseHandle (hObject=0x214) returned 1 [0064.071] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.071] lstrlenA (lpString="*.zip") returned 5 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.071] lstrlenA (lpString="*.rar") returned 5 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.071] lstrlenA (lpString="*.7z") returned 4 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.071] lstrlenA (lpString="*.tar") returned 5 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.071] lstrlenA (lpString="*.gzip") returned 6 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.071] lstrlenA (lpString="*.jpg") returned 5 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.071] lstrlenA (lpString="*.jpeg") returned 6 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.071] lstrlenA (lpString="*.psd") returned 5 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.071] lstrlenA (lpString="*.cdr") returned 5 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.071] lstrlenA (lpString="*.dwg") returned 5 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.071] lstrlenA (lpString="*.max") returned 5 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.071] lstrlenA (lpString="*.bmp") returned 5 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.071] lstrlenA (lpString="*.gif") returned 5 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.071] lstrlenA (lpString="*.png") returned 5 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.071] lstrlenA (lpString="*.doc") returned 5 [0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.072] lstrlenA (lpString="*.docx") returned 6 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.072] lstrlenA (lpString="*.xls") returned 5 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.072] lstrlenA (lpString="*.xlsx") returned 6 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.072] lstrlenA (lpString="*.ppt") returned 5 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.072] lstrlenA (lpString="*.pptx") returned 6 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.072] lstrlenA (lpString="*.txt") returned 5 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.072] lstrlenA (lpString="*.pdf") returned 5 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.072] lstrlenA (lpString="*.djvu") returned 6 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.072] lstrlenA (lpString="*.htm") returned 5 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.072] lstrlenA (lpString="*.html") returned 6 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.072] lstrlenA (lpString="*.mdb") returned 5 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.072] lstrlenA (lpString="*.cer") returned 5 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.072] lstrlenA (lpString="*.p12") returned 5 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.072] lstrlenA (lpString="*.pfx") returned 5 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.072] lstrlenA (lpString="*.kwm") returned 5 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.072] lstrlenA (lpString="*.pwm") returned 5 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.072] lstrlenA (lpString="*.1cd") returned 5 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.072] lstrlenA (lpString="*.md") returned 4 [0064.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.072] lstrlenA (lpString="*.mdf") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.073] lstrlenA (lpString="*.dbf") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.073] lstrlenA (lpString="*.odt") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.073] lstrlenA (lpString="*.vob") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.073] lstrlenA (lpString="*.ifo") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.073] lstrlenA (lpString="*.lnk") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.073] lstrlenA (lpString="*.torrent") returned 9 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.073] lstrlenA (lpString="*.mov") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.073] lstrlenA (lpString="*.m2v") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.073] lstrlenA (lpString="*.3gp") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.073] lstrlenA (lpString="*.mpeg") returned 6 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.073] lstrlenA (lpString="*.mpg") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.073] lstrlenA (lpString="*.flv") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.073] lstrlenA (lpString="*.avi") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.073] lstrlenA (lpString="*.mp4") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.073] lstrlenA (lpString="*.wmv") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.073] lstrlenA (lpString="*.divx") returned 6 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.073] lstrlenA (lpString="*.mkv") returned 5 [0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.073] lstrlenA (lpString="*.mp3") returned 5 [0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.074] lstrlenA (lpString="*.wav") returned 5 [0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.074] lstrlenA (lpString="*.flac") returned 6 [0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.074] lstrlenA (lpString="*.ape") returned 5 [0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.074] lstrlenA (lpString="*.wma") returned 5 [0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.074] lstrlenA (lpString="*.ac3") returned 5 [0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.074] lstrlenA (lpString="*.doc") returned 5 [0064.074] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.074] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0064.074] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="en-US", cAlternateFileName="")) returned 1 [0064.074] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0064.074] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0064.074] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.074] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US" [0064.074] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US") returned 56 [0064.074] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0064.087] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.087] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.088] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.088] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.088] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x1, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0064.088] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.088] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-correct.avi") returned 1 [0064.088] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-correct.avi") returned 1 [0064.088] lstrcmpiA (lpString1="", lpString2="boxed-correct.avi") returned -1 [0064.088] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*.*") returned="*.*" [0064.088] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.088] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.088] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.088] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0064.088] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.089] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.090] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.091] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.091] CloseHandle (hObject=0x214) returned 1 [0064.091] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" [0064.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.zip") returned 0 [0064.091] lstrlenA (lpString="*.zip") returned 5 [0064.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.rar") returned 0 [0064.091] lstrlenA (lpString="*.rar") returned 5 [0064.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.7z") returned 0 [0064.091] lstrlenA (lpString="*.7z") returned 4 [0064.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.tar") returned 0 [0064.091] lstrlenA (lpString="*.tar") returned 5 [0064.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.gzip") returned 0 [0064.091] lstrlenA (lpString="*.gzip") returned 6 [0064.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.jpg") returned 0 [0064.091] lstrlenA (lpString="*.jpg") returned 5 [0064.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.jpeg") returned 0 [0064.091] lstrlenA (lpString="*.jpeg") returned 6 [0064.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.psd") returned 0 [0064.092] lstrlenA (lpString="*.psd") returned 5 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.cdr") returned 0 [0064.092] lstrlenA (lpString="*.cdr") returned 5 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.dwg") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.max") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.bmp") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.gif") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.png") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.doc") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.docx") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.xls") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.xlsx") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.ppt") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pptx") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.txt") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pdf") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.djvu") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.htm") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.html") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mdb") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.cer") returned 0 [0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.p12") returned 0 [0064.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pfx") returned 0 [0064.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.kwm") returned 0 [0064.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pwm") returned 0 [0064.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.1cd") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.md") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mdf") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.dbf") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.odt") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.vob") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.ifo") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.lnk") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.torrent") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mov") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.m2v") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.3gp") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mpeg") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mpg") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.flv") returned 0 [0064.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.avi") returned 1 [0064.094] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" [0064.094] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" [0064.094] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi." [0064.094] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.", lpString2="EnCiPhErEd" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.EnCiPhErEd") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.EnCiPhErEd" [0064.094] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.290] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0064.290] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-delete.avi") returned 1 [0064.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-delete.avi") returned 1 [0064.290] lstrcmpiA (lpString1="", lpString2="boxed-delete.avi") returned -1 [0064.290] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned="boxed-correct.avi" [0064.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.290] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.290] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.290] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.290] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" [0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.zip") returned 0 [0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.rar") returned 0 [0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.7z") returned 0 [0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.tar") returned 0 [0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.gzip") returned 0 [0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.jpg") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.jpeg") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.psd") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.cdr") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.dwg") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.max") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.bmp") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.gif") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.png") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.doc") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.docx") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.xls") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.xlsx") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.ppt") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pptx") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.txt") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pdf") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.djvu") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.htm") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.html") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mdb") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.cer") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.p12") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pfx") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.kwm") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pwm") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.1cd") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.md") returned 0 [0064.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mdf") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.dbf") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.odt") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.vob") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.ifo") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.lnk") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.torrent") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mov") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.m2v") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.3gp") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mpeg") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mpg") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.flv") returned 0 [0064.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.avi") returned 1 [0064.292] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" [0064.292] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" [0064.292] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi." [0064.292] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.", lpString2="EnCiPhErEd" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.EnCiPhErEd") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.EnCiPhErEd" [0064.292] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.292] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0064.292] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.292] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-join.avi") returned 1 [0064.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-join.avi") returned 1 [0064.292] lstrcmpiA (lpString1="", lpString2="boxed-join.avi") returned -1 [0064.292] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned="boxed-delete.avi" [0064.292] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.292] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.292] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.293] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.293] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.zip") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.rar") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.7z") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.tar") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.gzip") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.jpg") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.jpeg") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.psd") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.cdr") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.dwg") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.max") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.bmp") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.gif") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.png") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.doc") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.docx") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.xls") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.xlsx") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.ppt") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pptx") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.txt") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pdf") returned 0 [0064.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.djvu") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.htm") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.html") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mdb") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.cer") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.p12") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pfx") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.kwm") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pwm") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.1cd") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.md") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mdf") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.dbf") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.odt") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.vob") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.ifo") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.lnk") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.torrent") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mov") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.m2v") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.3gp") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mpeg") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mpg") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.flv") returned 0 [0064.294] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.avi") returned 1 [0064.294] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" [0064.294] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" [0064.294] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi." [0064.294] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.", lpString2="EnCiPhErEd" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.EnCiPhErEd") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.EnCiPhErEd" [0064.295] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.354] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0064.354] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.355] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-split.avi") returned 1 [0064.355] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-split.avi") returned 1 [0064.355] lstrcmpiA (lpString1="", lpString2="boxed-split.avi") returned -1 [0064.355] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned="boxed-join.avi" [0064.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.355] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.355] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.355] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.355] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.zip") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.rar") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.7z") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.tar") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.gzip") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.jpg") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.jpeg") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.psd") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.cdr") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.dwg") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.max") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.bmp") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.gif") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.png") returned 0 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.doc") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.docx") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.xls") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.xlsx") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.ppt") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pptx") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.txt") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pdf") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.djvu") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.htm") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.html") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mdb") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.cer") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.p12") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pfx") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.kwm") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pwm") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.1cd") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.md") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mdf") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.dbf") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.odt") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.vob") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.ifo") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.lnk") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.torrent") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mov") returned 0 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.m2v") returned 0 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.3gp") returned 0 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mpeg") returned 0 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mpg") returned 0 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.flv") returned 0 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.avi") returned 1 [0064.357] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" [0064.357] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" [0064.357] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi." [0064.357] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.", lpString2="EnCiPhErEd" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.EnCiPhErEd") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.EnCiPhErEd" [0064.357] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.357] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0064.357] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.357] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="correct.avi") returned 1 [0064.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="correct.avi") returned 1 [0064.357] lstrcmpiA (lpString1="", lpString2="correct.avi") returned -1 [0064.357] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned="boxed-split.avi" [0064.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.357] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.357] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.357] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.357] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.zip") returned 0 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.rar") returned 0 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.7z") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.tar") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.gzip") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.jpg") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.jpeg") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.psd") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.cdr") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.dwg") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.max") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.bmp") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.gif") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.png") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.doc") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.docx") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.xls") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.xlsx") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.ppt") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.pptx") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.txt") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.pdf") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.djvu") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.htm") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.html") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.mdb") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.cer") returned 0 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.p12") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.pfx") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.kwm") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.pwm") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.1cd") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.md") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.mdf") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.dbf") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.odt") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.vob") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.ifo") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.lnk") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.torrent") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.mov") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.m2v") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.3gp") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.mpeg") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.mpg") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.flv") returned 0 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", pszSpec="*.avi") returned 1 [0064.359] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" [0064.359] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" [0064.359] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi." [0064.359] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.", lpString2="EnCiPhErEd" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.EnCiPhErEd") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.EnCiPhErEd" [0064.360] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.360] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0064.360] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.361] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="delete.avi") returned 1 [0064.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="delete.avi") returned 1 [0064.361] lstrcmpiA (lpString1="", lpString2="delete.avi") returned -1 [0064.361] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned="correct.avi" [0064.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.361] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.361] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.361] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.361] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.zip") returned 0 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.rar") returned 0 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.7z") returned 0 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.tar") returned 0 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.gzip") returned 0 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.jpg") returned 0 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.jpeg") returned 0 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.psd") returned 0 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.cdr") returned 0 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.dwg") returned 0 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.max") returned 0 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.bmp") returned 0 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.gif") returned 0 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", pszSpec="*.png") returned 0 [0064.362] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" [0064.362] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" [0064.362] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi." [0064.362] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.", lpString2="EnCiPhErEd" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.EnCiPhErEd") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.EnCiPhErEd" [0064.362] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.362] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0064.362] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.362] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FlickLearningWizard.exe.mui") returned -1 [0064.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickLearningWizard.exe.mui") returned 1 [0064.363] lstrcmpiA (lpString1="", lpString2="FlickLearningWizard.exe.mui") returned -1 [0064.363] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned="delete.avi" [0064.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.363] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.363] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.363] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.363] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="FlickLearningWizard.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" [0064.363] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0064.363] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.363] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkObj.dll.mui") returned -1 [0064.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkObj.dll.mui") returned -1 [0064.363] lstrcmpiA (lpString1="", lpString2="InkObj.dll.mui") returned -1 [0064.363] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="FlickLearningWizard.exe.mui" [0064.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.363] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.363] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.363] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.363] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="InkObj.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" [0064.363] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0064.363] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.363] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InputPersonalization.exe.mui") returned -1 [0064.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InputPersonalization.exe.mui") returned -1 [0064.363] lstrcmpiA (lpString1="", lpString2="InputPersonalization.exe.mui") returned -1 [0064.363] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned="InkObj.dll.mui" [0064.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.364] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.364] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.364] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.364] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="InputPersonalization.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" [0064.364] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0064.364] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.364] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0064.364] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0064.364] lstrcmpiA (lpString1="", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0064.364] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="InputPersonalization.exe.mui" [0064.364] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.364] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.364] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.364] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.364] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="IPSEventLogMsg.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" [0064.364] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0064.364] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.364] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0064.364] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0064.364] lstrcmpiA (lpString1="", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0064.364] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="IPSEventLogMsg.dll.mui" [0064.364] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.364] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.364] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.364] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.364] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="IpsMigrationPlugin.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" [0064.365] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0064.365] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.365] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="join.avi") returned -1 [0064.365] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="join.avi") returned -1 [0064.365] lstrcmpiA (lpString1="", lpString2="join.avi") returned -1 [0064.365] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="IpsMigrationPlugin.dll.mui" [0064.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.365] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.365] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.365] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.365] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="join.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" [0064.365] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" [0064.365] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" [0064.365] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi." [0064.365] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.", lpString2="EnCiPhErEd" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.EnCiPhErEd") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.EnCiPhErEd" [0064.365] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.365] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0064.365] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.365] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="micaut.dll.mui") returned -1 [0064.365] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="micaut.dll.mui") returned -1 [0064.365] lstrcmpiA (lpString1="", lpString2="micaut.dll.mui") returned -1 [0064.365] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned="join.avi" [0064.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.366] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.366] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.366] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.366] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="micaut.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" [0064.366] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0064.366] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.366] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mip.exe.mui") returned -1 [0064.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mip.exe.mui") returned -1 [0064.366] lstrcmpiA (lpString1="", lpString2="mip.exe.mui") returned -1 [0064.366] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned="micaut.dll.mui" [0064.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.366] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.366] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.366] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.366] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="mip.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" [0064.366] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0064.366] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.366] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mshwLatin.dll.mui") returned -1 [0064.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwLatin.dll.mui") returned -1 [0064.366] lstrcmpiA (lpString1="", lpString2="mshwLatin.dll.mui") returned -1 [0064.366] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned="mip.exe.mui" [0064.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.366] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.366] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.366] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.367] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="mshwLatin.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" [0064.367] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0064.367] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.367] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtscom.dll.mui") returned -1 [0064.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtscom.dll.mui") returned -1 [0064.367] lstrcmpiA (lpString1="", lpString2="rtscom.dll.mui") returned -1 [0064.367] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned="mshwLatin.dll.mui" [0064.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.367] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.367] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.367] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.367] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="rtscom.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" [0064.367] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0064.367] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.367] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShapeCollector.exe.mui") returned -1 [0064.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShapeCollector.exe.mui") returned -1 [0064.367] lstrcmpiA (lpString1="", lpString2="ShapeCollector.exe.mui") returned -1 [0064.367] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned="rtscom.dll.mui" [0064.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.367] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.367] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.367] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.367] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="ShapeCollector.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" [0064.367] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0064.367] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.367] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="split.avi") returned -1 [0064.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="split.avi") returned -1 [0064.368] lstrcmpiA (lpString1="", lpString2="split.avi") returned -1 [0064.368] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="ShapeCollector.exe.mui" [0064.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.368] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.368] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.368] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.368] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="split.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" [0064.368] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" [0064.368] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" [0064.368] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi." [0064.368] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.", lpString2="EnCiPhErEd" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.EnCiPhErEd") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.EnCiPhErEd" [0064.368] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.368] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0064.368] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.368] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tabskb.dll.mui") returned -1 [0064.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tabskb.dll.mui") returned -1 [0064.368] lstrcmpiA (lpString1="", lpString2="tabskb.dll.mui") returned -1 [0064.368] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned="split.avi" [0064.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.368] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.368] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.368] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.368] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="tabskb.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" [0064.369] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0064.369] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.369] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TabTip.exe.mui") returned -1 [0064.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TabTip.exe.mui") returned -1 [0064.369] lstrcmpiA (lpString1="", lpString2="TabTip.exe.mui") returned -1 [0064.369] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned="tabskb.dll.mui" [0064.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.369] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.369] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.369] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.369] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="TabTip.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" [0064.369] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0064.369] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.369] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipRes.dll.mui") returned -1 [0064.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipRes.dll.mui") returned -1 [0064.369] lstrcmpiA (lpString1="", lpString2="TipRes.dll.mui") returned -1 [0064.369] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned="TabTip.exe.mui" [0064.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.369] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.369] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.369] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.369] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="TipRes.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" [0064.369] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.369] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.369] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.370] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.370] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.370] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned="TipRes.dll.mui" [0064.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.370] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.370] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.370] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.370] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" [0064.370] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0064.370] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.370] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipTsf.dll.mui") returned -1 [0064.370] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipTsf.dll.mui") returned -1 [0064.370] lstrcmpiA (lpString1="", lpString2="TipTsf.dll.mui") returned -1 [0064.370] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned="tipresx.dll.mui" [0064.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" [0064.370] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0064.370] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0064.370] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0064.370] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="TipTsf.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" [0064.370] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0064.370] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0064.370] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x742dd8, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0064.370] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1 [0064.371] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1 [0064.371] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.371] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="es-ES" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES" [0064.371] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0064.371] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.371] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.372] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.372] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.372] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.372] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.372] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.372] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.372] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*.*") returned="*.*" [0064.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\" [0064.372] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\") returned="" [0064.372] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\HOW TO DECRYPT FILES.txt" [0064.372] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\how to decrypt files.txt")) returned 0xffffffff [0064.372] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.372] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.374] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.374] CloseHandle (hObject=0x214) returned 1 [0064.374] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" [0064.375] lstrlenA (lpString="*.zip") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.375] lstrlenA (lpString="*.rar") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.375] lstrlenA (lpString="*.7z") returned 4 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.375] lstrlenA (lpString="*.tar") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.375] lstrlenA (lpString="*.gzip") returned 6 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.375] lstrlenA (lpString="*.jpg") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.375] lstrlenA (lpString="*.jpeg") returned 6 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.375] lstrlenA (lpString="*.psd") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.375] lstrlenA (lpString="*.cdr") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.375] lstrlenA (lpString="*.dwg") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.375] lstrlenA (lpString="*.max") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.375] lstrlenA (lpString="*.bmp") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.375] lstrlenA (lpString="*.gif") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.375] lstrlenA (lpString="*.png") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.375] lstrlenA (lpString="*.doc") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.375] lstrlenA (lpString="*.docx") returned 6 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.375] lstrlenA (lpString="*.xls") returned 5 [0064.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.376] lstrlenA (lpString="*.xlsx") returned 6 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.376] lstrlenA (lpString="*.ppt") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.376] lstrlenA (lpString="*.pptx") returned 6 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.376] lstrlenA (lpString="*.txt") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.376] lstrlenA (lpString="*.pdf") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.376] lstrlenA (lpString="*.djvu") returned 6 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.376] lstrlenA (lpString="*.htm") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.376] lstrlenA (lpString="*.html") returned 6 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.376] lstrlenA (lpString="*.mdb") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.376] lstrlenA (lpString="*.cer") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.376] lstrlenA (lpString="*.p12") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.376] lstrlenA (lpString="*.pfx") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.376] lstrlenA (lpString="*.kwm") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.376] lstrlenA (lpString="*.pwm") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.376] lstrlenA (lpString="*.1cd") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.376] lstrlenA (lpString="*.md") returned 4 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.376] lstrlenA (lpString="*.mdf") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.376] lstrlenA (lpString="*.dbf") returned 5 [0064.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.376] lstrlenA (lpString="*.odt") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.377] lstrlenA (lpString="*.vob") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.377] lstrlenA (lpString="*.ifo") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.377] lstrlenA (lpString="*.lnk") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.377] lstrlenA (lpString="*.torrent") returned 9 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.377] lstrlenA (lpString="*.mov") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.377] lstrlenA (lpString="*.m2v") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.377] lstrlenA (lpString="*.3gp") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.377] lstrlenA (lpString="*.mpeg") returned 6 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.377] lstrlenA (lpString="*.mpg") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.377] lstrlenA (lpString="*.flv") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.377] lstrlenA (lpString="*.avi") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.377] lstrlenA (lpString="*.mp4") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.377] lstrlenA (lpString="*.wmv") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.377] lstrlenA (lpString="*.divx") returned 6 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.377] lstrlenA (lpString="*.mkv") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.377] lstrlenA (lpString="*.mp3") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.377] lstrlenA (lpString="*.wav") returned 5 [0064.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.377] lstrlenA (lpString="*.flac") returned 6 [0064.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.378] lstrlenA (lpString="*.ape") returned 5 [0064.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.378] lstrlenA (lpString="*.wma") returned 5 [0064.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.378] lstrlenA (lpString="*.ac3") returned 5 [0064.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.378] lstrlenA (lpString="*.doc") returned 5 [0064.378] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.378] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0064.378] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x742dd8, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0064.378] lstrcmpA (lpString1=".", lpString2="es-MX") returned -1 [0064.378] lstrcmpA (lpString1="..", lpString2="es-MX") returned -1 [0064.378] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.378] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="es-MX" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX" [0064.378] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX") returned 56 [0064.378] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759ed0 [0064.378] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.378] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.378] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.378] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.378] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.378] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.378] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.379] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.379] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*.*") returned="*.*" [0064.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\" [0064.379] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\") returned="" [0064.379] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\HOW TO DECRYPT FILES.txt" [0064.379] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\how to decrypt files.txt")) returned 0xffffffff [0064.379] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.379] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.379] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.380] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.380] CloseHandle (hObject=0x214) returned 1 [0064.380] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" [0064.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.380] lstrlenA (lpString="*.zip") returned 5 [0064.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.380] lstrlenA (lpString="*.rar") returned 5 [0064.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.381] lstrlenA (lpString="*.7z") returned 4 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.381] lstrlenA (lpString="*.tar") returned 5 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.381] lstrlenA (lpString="*.gzip") returned 6 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.381] lstrlenA (lpString="*.jpg") returned 5 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.381] lstrlenA (lpString="*.jpeg") returned 6 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.381] lstrlenA (lpString="*.psd") returned 5 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.381] lstrlenA (lpString="*.cdr") returned 5 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.381] lstrlenA (lpString="*.dwg") returned 5 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.381] lstrlenA (lpString="*.max") returned 5 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.381] lstrlenA (lpString="*.bmp") returned 5 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.381] lstrlenA (lpString="*.gif") returned 5 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.381] lstrlenA (lpString="*.png") returned 5 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.381] lstrlenA (lpString="*.doc") returned 5 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.381] lstrlenA (lpString="*.docx") returned 6 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.381] lstrlenA (lpString="*.xls") returned 5 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.381] lstrlenA (lpString="*.xlsx") returned 6 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.381] lstrlenA (lpString="*.ppt") returned 5 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.381] lstrlenA (lpString="*.pptx") returned 6 [0064.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.381] lstrlenA (lpString="*.txt") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.382] lstrlenA (lpString="*.pdf") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.382] lstrlenA (lpString="*.djvu") returned 6 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.382] lstrlenA (lpString="*.htm") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.382] lstrlenA (lpString="*.html") returned 6 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.382] lstrlenA (lpString="*.mdb") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.382] lstrlenA (lpString="*.cer") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.382] lstrlenA (lpString="*.p12") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.382] lstrlenA (lpString="*.pfx") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.382] lstrlenA (lpString="*.kwm") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.382] lstrlenA (lpString="*.pwm") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.382] lstrlenA (lpString="*.1cd") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.382] lstrlenA (lpString="*.md") returned 4 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.382] lstrlenA (lpString="*.mdf") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.382] lstrlenA (lpString="*.dbf") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.382] lstrlenA (lpString="*.odt") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.382] lstrlenA (lpString="*.vob") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.382] lstrlenA (lpString="*.ifo") returned 5 [0064.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.382] lstrlenA (lpString="*.lnk") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.383] lstrlenA (lpString="*.torrent") returned 9 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.383] lstrlenA (lpString="*.mov") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.383] lstrlenA (lpString="*.m2v") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.383] lstrlenA (lpString="*.3gp") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.383] lstrlenA (lpString="*.mpeg") returned 6 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.383] lstrlenA (lpString="*.mpg") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.383] lstrlenA (lpString="*.flv") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.383] lstrlenA (lpString="*.avi") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.383] lstrlenA (lpString="*.mp4") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.383] lstrlenA (lpString="*.wmv") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.383] lstrlenA (lpString="*.divx") returned 6 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.383] lstrlenA (lpString="*.mkv") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.383] lstrlenA (lpString="*.mp3") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.383] lstrlenA (lpString="*.wav") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.383] lstrlenA (lpString="*.flac") returned 6 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.383] lstrlenA (lpString="*.ape") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.383] lstrlenA (lpString="*.wma") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.383] lstrlenA (lpString="*.ac3") returned 5 [0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.384] lstrlenA (lpString="*.doc") returned 5 [0064.384] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.384] FindClose (in: hFindFile=0x759ed0 | out: hFindFile=0x759ed0) returned 1 [0064.384] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x742dd8, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0064.384] lstrcmpA (lpString1=".", lpString2="et-EE") returned -1 [0064.384] lstrcmpA (lpString1="..", lpString2="et-EE") returned -1 [0064.384] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.384] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="et-EE" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE" [0064.384] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE") returned 56 [0064.384] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0064.384] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.384] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.384] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.384] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.384] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.384] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.384] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.384] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*.*") returned="*.*" [0064.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\" [0064.384] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\") returned="" [0064.384] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\HOW TO DECRYPT FILES.txt" [0064.384] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\how to decrypt files.txt")) returned 0xffffffff [0064.385] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.385] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.385] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.386] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.386] CloseHandle (hObject=0x214) returned 1 [0064.386] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" [0064.386] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.386] lstrlenA (lpString="*.zip") returned 5 [0064.386] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.386] lstrlenA (lpString="*.rar") returned 5 [0064.386] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.386] lstrlenA (lpString="*.7z") returned 4 [0064.386] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.386] lstrlenA (lpString="*.tar") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.387] lstrlenA (lpString="*.gzip") returned 6 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.387] lstrlenA (lpString="*.jpg") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.387] lstrlenA (lpString="*.jpeg") returned 6 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.387] lstrlenA (lpString="*.psd") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.387] lstrlenA (lpString="*.cdr") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.387] lstrlenA (lpString="*.dwg") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.387] lstrlenA (lpString="*.max") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.387] lstrlenA (lpString="*.bmp") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.387] lstrlenA (lpString="*.gif") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.387] lstrlenA (lpString="*.png") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.387] lstrlenA (lpString="*.doc") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.387] lstrlenA (lpString="*.docx") returned 6 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.387] lstrlenA (lpString="*.xls") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.387] lstrlenA (lpString="*.xlsx") returned 6 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.387] lstrlenA (lpString="*.ppt") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.387] lstrlenA (lpString="*.pptx") returned 6 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.387] lstrlenA (lpString="*.txt") returned 5 [0064.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.387] lstrlenA (lpString="*.pdf") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.388] lstrlenA (lpString="*.djvu") returned 6 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.388] lstrlenA (lpString="*.htm") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.388] lstrlenA (lpString="*.html") returned 6 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.388] lstrlenA (lpString="*.mdb") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.388] lstrlenA (lpString="*.cer") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.388] lstrlenA (lpString="*.p12") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.388] lstrlenA (lpString="*.pfx") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.388] lstrlenA (lpString="*.kwm") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.388] lstrlenA (lpString="*.pwm") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.388] lstrlenA (lpString="*.1cd") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.388] lstrlenA (lpString="*.md") returned 4 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.388] lstrlenA (lpString="*.mdf") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.388] lstrlenA (lpString="*.dbf") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.388] lstrlenA (lpString="*.odt") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.388] lstrlenA (lpString="*.vob") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.388] lstrlenA (lpString="*.ifo") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.388] lstrlenA (lpString="*.lnk") returned 5 [0064.388] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.388] lstrlenA (lpString="*.torrent") returned 9 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.389] lstrlenA (lpString="*.mov") returned 5 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.389] lstrlenA (lpString="*.m2v") returned 5 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.389] lstrlenA (lpString="*.3gp") returned 5 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.389] lstrlenA (lpString="*.mpeg") returned 6 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.389] lstrlenA (lpString="*.mpg") returned 5 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.389] lstrlenA (lpString="*.flv") returned 5 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.389] lstrlenA (lpString="*.avi") returned 5 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.389] lstrlenA (lpString="*.mp4") returned 5 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.389] lstrlenA (lpString="*.wmv") returned 5 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.389] lstrlenA (lpString="*.divx") returned 6 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.389] lstrlenA (lpString="*.mkv") returned 5 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.389] lstrlenA (lpString="*.mp3") returned 5 [0064.389] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.389] lstrlenA (lpString="*.wav") returned 5 [0064.390] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.390] lstrlenA (lpString="*.flac") returned 6 [0064.390] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.390] lstrlenA (lpString="*.ape") returned 5 [0064.390] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.390] lstrlenA (lpString="*.wma") returned 5 [0064.390] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.390] lstrlenA (lpString="*.ac3") returned 5 [0064.390] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.390] lstrlenA (lpString="*.doc") returned 5 [0064.390] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.391] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0064.391] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x752268, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0064.391] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1 [0064.391] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1 [0064.391] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.391] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="fi-FI" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI" [0064.391] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI") returned 56 [0064.391] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0064.391] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.391] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.391] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.391] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.391] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.391] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.391] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.391] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.391] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*.*") returned="*.*" [0064.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\" [0064.391] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\") returned="" [0064.392] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\HOW TO DECRYPT FILES.txt" [0064.392] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\how to decrypt files.txt")) returned 0xffffffff [0064.392] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.395] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.395] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.396] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.396] CloseHandle (hObject=0x214) returned 1 [0064.397] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" [0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.397] lstrlenA (lpString="*.zip") returned 5 [0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.397] lstrlenA (lpString="*.rar") returned 5 [0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.397] lstrlenA (lpString="*.7z") returned 4 [0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.397] lstrlenA (lpString="*.tar") returned 5 [0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.397] lstrlenA (lpString="*.gzip") returned 6 [0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.397] lstrlenA (lpString="*.jpg") returned 5 [0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.397] lstrlenA (lpString="*.jpeg") returned 6 [0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.397] lstrlenA (lpString="*.psd") returned 5 [0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.397] lstrlenA (lpString="*.cdr") returned 5 [0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.397] lstrlenA (lpString="*.dwg") returned 5 [0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.397] lstrlenA (lpString="*.max") returned 5 [0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.397] lstrlenA (lpString="*.bmp") returned 5 [0064.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.402] lstrlenA (lpString="*.gif") returned 5 [0064.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.402] lstrlenA (lpString="*.png") returned 5 [0064.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.402] lstrlenA (lpString="*.doc") returned 5 [0064.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.402] lstrlenA (lpString="*.docx") returned 6 [0064.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.403] lstrlenA (lpString="*.xls") returned 5 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.403] lstrlenA (lpString="*.xlsx") returned 6 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.403] lstrlenA (lpString="*.ppt") returned 5 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.403] lstrlenA (lpString="*.pptx") returned 6 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.403] lstrlenA (lpString="*.txt") returned 5 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.403] lstrlenA (lpString="*.pdf") returned 5 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.403] lstrlenA (lpString="*.djvu") returned 6 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.403] lstrlenA (lpString="*.htm") returned 5 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.403] lstrlenA (lpString="*.html") returned 6 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.403] lstrlenA (lpString="*.mdb") returned 5 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.403] lstrlenA (lpString="*.cer") returned 5 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.403] lstrlenA (lpString="*.p12") returned 5 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.403] lstrlenA (lpString="*.pfx") returned 5 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.403] lstrlenA (lpString="*.kwm") returned 5 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.403] lstrlenA (lpString="*.pwm") returned 5 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.403] lstrlenA (lpString="*.1cd") returned 5 [0064.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.404] lstrlenA (lpString="*.md") returned 4 [0064.404] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.404] lstrlenA (lpString="*.mdf") returned 5 [0064.404] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.404] lstrlenA (lpString="*.dbf") returned 5 [0064.404] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.404] lstrlenA (lpString="*.odt") returned 5 [0064.404] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.404] lstrlenA (lpString="*.vob") returned 5 [0064.404] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.404] lstrlenA (lpString="*.ifo") returned 5 [0064.404] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.404] lstrlenA (lpString="*.lnk") returned 5 [0064.404] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.404] lstrlenA (lpString="*.torrent") returned 9 [0064.404] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.404] lstrlenA (lpString="*.mov") returned 5 [0064.404] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.404] lstrlenA (lpString="*.m2v") returned 5 [0064.404] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.404] lstrlenA (lpString="*.3gp") returned 5 [0064.404] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.404] lstrlenA (lpString="*.mpeg") returned 6 [0064.404] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.405] lstrlenA (lpString="*.mpg") returned 5 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.405] lstrlenA (lpString="*.flv") returned 5 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.405] lstrlenA (lpString="*.avi") returned 5 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.405] lstrlenA (lpString="*.mp4") returned 5 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.405] lstrlenA (lpString="*.wmv") returned 5 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.405] lstrlenA (lpString="*.divx") returned 6 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.405] lstrlenA (lpString="*.mkv") returned 5 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.406] lstrlenA (lpString="*.mp3") returned 5 [0064.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.406] lstrlenA (lpString="*.wav") returned 5 [0064.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.406] lstrlenA (lpString="*.flac") returned 6 [0064.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.406] lstrlenA (lpString="*.ape") returned 5 [0064.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.406] lstrlenA (lpString="*.wma") returned 5 [0064.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.406] lstrlenA (lpString="*.ac3") returned 5 [0064.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.406] lstrlenA (lpString="*.doc") returned 5 [0064.406] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.406] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0064.406] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x75e210, dwReserved1=0x752268, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0064.406] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.407] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FlickAnimation.avi") returned -1 [0064.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickAnimation.avi") returned 1 [0064.407] lstrcmpiA (lpString1="", lpString2="FlickAnimation.avi") returned -1 [0064.407] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.407] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.407] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.407] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.407] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="FlickAnimation.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" [0064.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.zip") returned 0 [0064.407] lstrlenA (lpString="*.zip") returned 5 [0064.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.rar") returned 0 [0064.407] lstrlenA (lpString="*.rar") returned 5 [0064.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.7z") returned 0 [0064.407] lstrlenA (lpString="*.7z") returned 4 [0064.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.tar") returned 0 [0064.407] lstrlenA (lpString="*.tar") returned 5 [0064.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.gzip") returned 0 [0064.407] lstrlenA (lpString="*.gzip") returned 6 [0064.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.jpg") returned 0 [0064.407] lstrlenA (lpString="*.jpg") returned 5 [0064.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.jpeg") returned 0 [0064.407] lstrlenA (lpString="*.jpeg") returned 6 [0064.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.psd") returned 0 [0064.407] lstrlenA (lpString="*.psd") returned 5 [0064.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.cdr") returned 0 [0064.407] lstrlenA (lpString="*.cdr") returned 5 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.dwg") returned 0 [0064.408] lstrlenA (lpString="*.dwg") returned 5 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.max") returned 0 [0064.408] lstrlenA (lpString="*.max") returned 5 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.bmp") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.gif") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.png") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.doc") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.docx") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.xls") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.xlsx") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.ppt") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.pptx") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.txt") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.pdf") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.djvu") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.htm") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.html") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.mdb") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.cer") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.p12") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.pfx") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.kwm") returned 0 [0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.pwm") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.1cd") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.md") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.mdf") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.dbf") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.odt") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.vob") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.ifo") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.lnk") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.torrent") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.mov") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.m2v") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.3gp") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.mpeg") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.mpg") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.flv") returned 0 [0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", pszSpec="*.avi") returned 1 [0064.410] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" [0064.410] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" [0064.410] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi." [0064.410] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.", lpString2="EnCiPhErEd" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.EnCiPhErEd") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.EnCiPhErEd" [0064.410] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.452] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0064.452] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.452] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FlickLearningWizard.exe") returned -1 [0064.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickLearningWizard.exe") returned 1 [0064.452] lstrcmpiA (lpString1="", lpString2="FlickLearningWizard.exe") returned -1 [0064.452] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned="FlickAnimation.avi" [0064.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.452] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.452] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.452] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.452] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="FlickLearningWizard.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.zip") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.rar") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.7z") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.tar") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.gzip") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.jpg") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.jpeg") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.psd") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.cdr") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.dwg") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.max") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.bmp") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.gif") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.png") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.doc") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.docx") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.xls") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.xlsx") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.ppt") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.pptx") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.txt") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.pdf") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.djvu") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.htm") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.html") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mdb") returned 0 [0064.453] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.cer") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.p12") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.pfx") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.kwm") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.pwm") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.1cd") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.md") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mdf") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.dbf") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.odt") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.vob") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.ifo") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.lnk") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.torrent") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mov") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.m2v") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.3gp") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mpeg") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mpg") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.flv") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.avi") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mp4") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.wmv") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.divx") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mkv") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.mp3") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.wav") returned 0 [0064.454] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.flac") returned 0 [0064.455] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.ape") returned 0 [0064.455] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.wma") returned 0 [0064.455] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.ac3") returned 0 [0064.455] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", pszSpec="*.doc") returned 0 [0064.455] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0064.455] lstrcmpA (lpString1=".", lpString2="fr-CA") returned -1 [0064.455] lstrcmpA (lpString1="..", lpString2="fr-CA") returned -1 [0064.455] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned="FlickLearningWizard.exe" [0064.455] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="fr-CA" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA" [0064.455] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0064.456] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.456] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xa8, cFileName="..", cAlternateFileName="")) returned 1 [0064.456] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.456] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.456] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x740000, dwReserved1=0xa8, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.456] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.456] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.456] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.456] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*.*") returned="*.*" [0064.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\" [0064.456] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\") returned="" [0064.456] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\HOW TO DECRYPT FILES.txt" [0064.456] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\how to decrypt files.txt")) returned 0xffffffff [0064.456] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.456] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.458] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.458] CloseHandle (hObject=0x214) returned 1 [0064.458] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" [0064.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.458] lstrlenA (lpString="*.zip") returned 5 [0064.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.458] lstrlenA (lpString="*.rar") returned 5 [0064.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.458] lstrlenA (lpString="*.7z") returned 4 [0064.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.458] lstrlenA (lpString="*.tar") returned 5 [0064.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.458] lstrlenA (lpString="*.gzip") returned 6 [0064.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.458] lstrlenA (lpString="*.jpg") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.459] lstrlenA (lpString="*.jpeg") returned 6 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.459] lstrlenA (lpString="*.psd") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.459] lstrlenA (lpString="*.cdr") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.459] lstrlenA (lpString="*.dwg") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.459] lstrlenA (lpString="*.max") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.459] lstrlenA (lpString="*.bmp") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.459] lstrlenA (lpString="*.gif") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.459] lstrlenA (lpString="*.png") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.459] lstrlenA (lpString="*.doc") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.459] lstrlenA (lpString="*.docx") returned 6 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.459] lstrlenA (lpString="*.xls") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.459] lstrlenA (lpString="*.xlsx") returned 6 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.459] lstrlenA (lpString="*.ppt") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.459] lstrlenA (lpString="*.pptx") returned 6 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.459] lstrlenA (lpString="*.txt") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.459] lstrlenA (lpString="*.pdf") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.459] lstrlenA (lpString="*.djvu") returned 6 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.459] lstrlenA (lpString="*.htm") returned 5 [0064.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.459] lstrlenA (lpString="*.html") returned 6 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.460] lstrlenA (lpString="*.mdb") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.460] lstrlenA (lpString="*.cer") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.460] lstrlenA (lpString="*.p12") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.460] lstrlenA (lpString="*.pfx") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.460] lstrlenA (lpString="*.kwm") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.460] lstrlenA (lpString="*.pwm") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.460] lstrlenA (lpString="*.1cd") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.460] lstrlenA (lpString="*.md") returned 4 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.460] lstrlenA (lpString="*.mdf") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.460] lstrlenA (lpString="*.dbf") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.460] lstrlenA (lpString="*.odt") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.460] lstrlenA (lpString="*.vob") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.460] lstrlenA (lpString="*.ifo") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.460] lstrlenA (lpString="*.lnk") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.460] lstrlenA (lpString="*.torrent") returned 9 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.460] lstrlenA (lpString="*.mov") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.460] lstrlenA (lpString="*.m2v") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.460] lstrlenA (lpString="*.3gp") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.460] lstrlenA (lpString="*.mpeg") returned 6 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.461] lstrlenA (lpString="*.mpg") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.461] lstrlenA (lpString="*.flv") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.461] lstrlenA (lpString="*.avi") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.461] lstrlenA (lpString="*.mp4") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.461] lstrlenA (lpString="*.wmv") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.461] lstrlenA (lpString="*.divx") returned 6 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.461] lstrlenA (lpString="*.mkv") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.461] lstrlenA (lpString="*.mp3") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.461] lstrlenA (lpString="*.wav") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.461] lstrlenA (lpString="*.flac") returned 6 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.461] lstrlenA (lpString="*.ape") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.461] lstrlenA (lpString="*.wma") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.461] lstrlenA (lpString="*.ac3") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.461] lstrlenA (lpString="*.doc") returned 5 [0064.461] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x740000, dwReserved1=0xa8, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.461] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0064.461] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x752268, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0064.461] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1 [0064.462] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1 [0064.462] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.462] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="fr-FR" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR" [0064.462] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR") returned 56 [0064.462] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759990 [0064.462] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.462] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.462] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.462] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.462] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.462] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.462] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.462] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.462] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*.*") returned="*.*" [0064.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\" [0064.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\") returned="" [0064.462] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\HOW TO DECRYPT FILES.txt" [0064.462] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\how to decrypt files.txt")) returned 0xffffffff [0064.462] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.463] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.463] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.464] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.464] CloseHandle (hObject=0x214) returned 1 [0064.464] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" [0064.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.464] lstrlenA (lpString="*.zip") returned 5 [0064.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.464] lstrlenA (lpString="*.rar") returned 5 [0064.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.464] lstrlenA (lpString="*.7z") returned 4 [0064.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.464] lstrlenA (lpString="*.tar") returned 5 [0064.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.464] lstrlenA (lpString="*.gzip") returned 6 [0064.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.464] lstrlenA (lpString="*.jpg") returned 5 [0064.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.464] lstrlenA (lpString="*.jpeg") returned 6 [0064.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.464] lstrlenA (lpString="*.psd") returned 5 [0064.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.464] lstrlenA (lpString="*.cdr") returned 5 [0064.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.464] lstrlenA (lpString="*.dwg") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.465] lstrlenA (lpString="*.max") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.465] lstrlenA (lpString="*.bmp") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.465] lstrlenA (lpString="*.gif") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.465] lstrlenA (lpString="*.png") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.465] lstrlenA (lpString="*.doc") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.465] lstrlenA (lpString="*.docx") returned 6 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.465] lstrlenA (lpString="*.xls") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.465] lstrlenA (lpString="*.xlsx") returned 6 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.465] lstrlenA (lpString="*.ppt") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.465] lstrlenA (lpString="*.pptx") returned 6 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.465] lstrlenA (lpString="*.txt") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.465] lstrlenA (lpString="*.pdf") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.465] lstrlenA (lpString="*.djvu") returned 6 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.465] lstrlenA (lpString="*.htm") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.465] lstrlenA (lpString="*.html") returned 6 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.465] lstrlenA (lpString="*.mdb") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.465] lstrlenA (lpString="*.cer") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.465] lstrlenA (lpString="*.p12") returned 5 [0064.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.466] lstrlenA (lpString="*.pfx") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.466] lstrlenA (lpString="*.kwm") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.466] lstrlenA (lpString="*.pwm") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.466] lstrlenA (lpString="*.1cd") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.466] lstrlenA (lpString="*.md") returned 4 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.466] lstrlenA (lpString="*.mdf") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.466] lstrlenA (lpString="*.dbf") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.466] lstrlenA (lpString="*.odt") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.466] lstrlenA (lpString="*.vob") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.466] lstrlenA (lpString="*.ifo") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.466] lstrlenA (lpString="*.lnk") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.466] lstrlenA (lpString="*.torrent") returned 9 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.466] lstrlenA (lpString="*.mov") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.466] lstrlenA (lpString="*.m2v") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.466] lstrlenA (lpString="*.3gp") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.466] lstrlenA (lpString="*.mpeg") returned 6 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.466] lstrlenA (lpString="*.mpg") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.466] lstrlenA (lpString="*.flv") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.466] lstrlenA (lpString="*.avi") returned 5 [0064.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.467] lstrlenA (lpString="*.mp4") returned 5 [0064.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.467] lstrlenA (lpString="*.wmv") returned 5 [0064.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.467] lstrlenA (lpString="*.divx") returned 6 [0064.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.467] lstrlenA (lpString="*.mkv") returned 5 [0064.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.467] lstrlenA (lpString="*.mp3") returned 5 [0064.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.467] lstrlenA (lpString="*.wav") returned 5 [0064.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.467] lstrlenA (lpString="*.flac") returned 6 [0064.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.467] lstrlenA (lpString="*.ape") returned 5 [0064.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.467] lstrlenA (lpString="*.wma") returned 5 [0064.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.467] lstrlenA (lpString="*.ac3") returned 5 [0064.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.467] lstrlenA (lpString="*.doc") returned 5 [0064.467] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.467] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0064.467] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e210, dwReserved1=0x752268, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0064.467] lstrcmpA (lpString1=".", lpString2="fsdefinitions") returned -1 [0064.467] lstrcmpA (lpString1="..", lpString2="fsdefinitions") returned -1 [0064.467] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.467] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="fsdefinitions" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions" [0064.467] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions") returned 64 [0064.467] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759fd0 [0064.469] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.469] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.470] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.470] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.470] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="auxpad", cAlternateFileName="")) returned 1 [0064.470] lstrcmpA (lpString1=".", lpString2="auxpad") returned -1 [0064.470] lstrcmpA (lpString1="..", lpString2="auxpad") returned -1 [0064.470] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0064.470] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad") returned 71 [0064.470] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x767eb0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0064.470] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.470] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x767eb0, cFileName="..", cAlternateFileName="")) returned 1 [0064.470] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.470] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.470] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0xfffffffe, dwReserved1=0x767eb0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0064.470] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.470] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="auxbase.xml") returned 1 [0064.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="auxbase.xml") returned 1 [0064.470] lstrcmpiA (lpString1="", lpString2="auxbase.xml") returned -1 [0064.470] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*.*") returned="*.*" [0064.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\" [0064.471] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned="" [0064.471] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\how to decrypt files.txt")) returned 0xffffffff [0064.471] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0064.471] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.471] WriteFile (in: hFile=0x218, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.473] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.473] CloseHandle (hObject=0x218) returned 1 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.zip") returned 0 [0064.474] lstrlenA (lpString="*.zip") returned 5 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.rar") returned 0 [0064.474] lstrlenA (lpString="*.rar") returned 5 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.7z") returned 0 [0064.474] lstrlenA (lpString="*.7z") returned 4 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.tar") returned 0 [0064.474] lstrlenA (lpString="*.tar") returned 5 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.gzip") returned 0 [0064.474] lstrlenA (lpString="*.gzip") returned 6 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.jpg") returned 0 [0064.474] lstrlenA (lpString="*.jpg") returned 5 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.jpeg") returned 0 [0064.474] lstrlenA (lpString="*.jpeg") returned 6 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.psd") returned 0 [0064.474] lstrlenA (lpString="*.psd") returned 5 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.cdr") returned 0 [0064.474] lstrlenA (lpString="*.cdr") returned 5 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.dwg") returned 0 [0064.474] lstrlenA (lpString="*.dwg") returned 5 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.max") returned 0 [0064.474] lstrlenA (lpString="*.max") returned 5 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.bmp") returned 0 [0064.474] lstrlenA (lpString="*.bmp") returned 5 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.gif") returned 0 [0064.474] lstrlenA (lpString="*.gif") returned 5 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.png") returned 0 [0064.474] lstrlenA (lpString="*.png") returned 5 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.doc") returned 0 [0064.474] lstrlenA (lpString="*.doc") returned 5 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.docx") returned 0 [0064.474] lstrlenA (lpString="*.docx") returned 6 [0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.xls") returned 0 [0064.475] lstrlenA (lpString="*.xls") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.xlsx") returned 0 [0064.475] lstrlenA (lpString="*.xlsx") returned 6 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.ppt") returned 0 [0064.475] lstrlenA (lpString="*.ppt") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.pptx") returned 0 [0064.475] lstrlenA (lpString="*.pptx") returned 6 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.txt") returned 0 [0064.475] lstrlenA (lpString="*.txt") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.pdf") returned 0 [0064.475] lstrlenA (lpString="*.pdf") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.djvu") returned 0 [0064.475] lstrlenA (lpString="*.djvu") returned 6 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.htm") returned 0 [0064.475] lstrlenA (lpString="*.htm") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.html") returned 0 [0064.475] lstrlenA (lpString="*.html") returned 6 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mdb") returned 0 [0064.475] lstrlenA (lpString="*.mdb") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.cer") returned 0 [0064.475] lstrlenA (lpString="*.cer") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.p12") returned 0 [0064.475] lstrlenA (lpString="*.p12") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.pfx") returned 0 [0064.475] lstrlenA (lpString="*.pfx") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.kwm") returned 0 [0064.475] lstrlenA (lpString="*.kwm") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.pwm") returned 0 [0064.475] lstrlenA (lpString="*.pwm") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.1cd") returned 0 [0064.475] lstrlenA (lpString="*.1cd") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.md") returned 0 [0064.475] lstrlenA (lpString="*.md") returned 4 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mdf") returned 0 [0064.475] lstrlenA (lpString="*.mdf") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.dbf") returned 0 [0064.475] lstrlenA (lpString="*.dbf") returned 5 [0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.odt") returned 0 [0064.476] lstrlenA (lpString="*.odt") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.vob") returned 0 [0064.476] lstrlenA (lpString="*.vob") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.ifo") returned 0 [0064.476] lstrlenA (lpString="*.ifo") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.lnk") returned 0 [0064.476] lstrlenA (lpString="*.lnk") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.torrent") returned 0 [0064.476] lstrlenA (lpString="*.torrent") returned 9 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mov") returned 0 [0064.476] lstrlenA (lpString="*.mov") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.m2v") returned 0 [0064.476] lstrlenA (lpString="*.m2v") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.3gp") returned 0 [0064.476] lstrlenA (lpString="*.3gp") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mpeg") returned 0 [0064.476] lstrlenA (lpString="*.mpeg") returned 6 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mpg") returned 0 [0064.476] lstrlenA (lpString="*.mpg") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.flv") returned 0 [0064.476] lstrlenA (lpString="*.flv") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.avi") returned 0 [0064.476] lstrlenA (lpString="*.avi") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mp4") returned 0 [0064.476] lstrlenA (lpString="*.mp4") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.wmv") returned 0 [0064.476] lstrlenA (lpString="*.wmv") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.divx") returned 0 [0064.476] lstrlenA (lpString="*.divx") returned 6 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mkv") returned 0 [0064.476] lstrlenA (lpString="*.mkv") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.mp3") returned 0 [0064.476] lstrlenA (lpString="*.mp3") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.wav") returned 0 [0064.476] lstrlenA (lpString="*.wav") returned 5 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.flac") returned 0 [0064.476] lstrlenA (lpString="*.flac") returned 6 [0064.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.ape") returned 0 [0064.477] lstrlenA (lpString="*.ape") returned 5 [0064.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.wma") returned 0 [0064.477] lstrlenA (lpString="*.wma") returned 5 [0064.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.ac3") returned 0 [0064.477] lstrlenA (lpString="*.ac3") returned 5 [0064.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", pszSpec="*.doc") returned 0 [0064.477] lstrlenA (lpString="*.doc") returned 5 [0064.477] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0xfffffffe, dwReserved1=0x767eb0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0064.477] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0064.477] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0064.477] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.477] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="auxpad.xml") returned 1 [0064.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="auxpad.xml") returned 1 [0064.477] lstrcmpiA (lpString1="", lpString2="auxpad.xml") returned -1 [0064.477] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0064.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0064.477] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0064.477] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0064.477] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0xffffffff [0064.477] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.477] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.478] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.498] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.498] CloseHandle (hObject=0x214) returned 1 [0064.499] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="auxpad.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.zip") returned 0 [0064.499] lstrlenA (lpString="*.zip") returned 5 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.rar") returned 0 [0064.499] lstrlenA (lpString="*.rar") returned 5 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.7z") returned 0 [0064.499] lstrlenA (lpString="*.7z") returned 4 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.tar") returned 0 [0064.499] lstrlenA (lpString="*.tar") returned 5 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.gzip") returned 0 [0064.499] lstrlenA (lpString="*.gzip") returned 6 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.jpg") returned 0 [0064.499] lstrlenA (lpString="*.jpg") returned 5 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.jpeg") returned 0 [0064.499] lstrlenA (lpString="*.jpeg") returned 6 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.psd") returned 0 [0064.499] lstrlenA (lpString="*.psd") returned 5 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.cdr") returned 0 [0064.499] lstrlenA (lpString="*.cdr") returned 5 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.dwg") returned 0 [0064.499] lstrlenA (lpString="*.dwg") returned 5 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.max") returned 0 [0064.499] lstrlenA (lpString="*.max") returned 5 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.bmp") returned 0 [0064.499] lstrlenA (lpString="*.bmp") returned 5 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.gif") returned 0 [0064.499] lstrlenA (lpString="*.gif") returned 5 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.png") returned 0 [0064.499] lstrlenA (lpString="*.png") returned 5 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.doc") returned 0 [0064.499] lstrlenA (lpString="*.doc") returned 5 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.docx") returned 0 [0064.499] lstrlenA (lpString="*.docx") returned 6 [0064.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.xls") returned 0 [0064.500] lstrlenA (lpString="*.xls") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.xlsx") returned 0 [0064.500] lstrlenA (lpString="*.xlsx") returned 6 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.ppt") returned 0 [0064.500] lstrlenA (lpString="*.ppt") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.pptx") returned 0 [0064.500] lstrlenA (lpString="*.pptx") returned 6 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.txt") returned 0 [0064.500] lstrlenA (lpString="*.txt") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.pdf") returned 0 [0064.500] lstrlenA (lpString="*.pdf") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.djvu") returned 0 [0064.500] lstrlenA (lpString="*.djvu") returned 6 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.htm") returned 0 [0064.500] lstrlenA (lpString="*.htm") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.html") returned 0 [0064.500] lstrlenA (lpString="*.html") returned 6 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mdb") returned 0 [0064.500] lstrlenA (lpString="*.mdb") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.cer") returned 0 [0064.500] lstrlenA (lpString="*.cer") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.p12") returned 0 [0064.500] lstrlenA (lpString="*.p12") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.pfx") returned 0 [0064.500] lstrlenA (lpString="*.pfx") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.kwm") returned 0 [0064.500] lstrlenA (lpString="*.kwm") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.pwm") returned 0 [0064.500] lstrlenA (lpString="*.pwm") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.1cd") returned 0 [0064.500] lstrlenA (lpString="*.1cd") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.md") returned 0 [0064.500] lstrlenA (lpString="*.md") returned 4 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mdf") returned 0 [0064.500] lstrlenA (lpString="*.mdf") returned 5 [0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.dbf") returned 0 [0064.500] lstrlenA (lpString="*.dbf") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.odt") returned 0 [0064.501] lstrlenA (lpString="*.odt") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.vob") returned 0 [0064.501] lstrlenA (lpString="*.vob") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.ifo") returned 0 [0064.501] lstrlenA (lpString="*.ifo") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.lnk") returned 0 [0064.501] lstrlenA (lpString="*.lnk") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.torrent") returned 0 [0064.501] lstrlenA (lpString="*.torrent") returned 9 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mov") returned 0 [0064.501] lstrlenA (lpString="*.mov") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.m2v") returned 0 [0064.501] lstrlenA (lpString="*.m2v") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.3gp") returned 0 [0064.501] lstrlenA (lpString="*.3gp") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mpeg") returned 0 [0064.501] lstrlenA (lpString="*.mpeg") returned 6 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mpg") returned 0 [0064.501] lstrlenA (lpString="*.mpg") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.flv") returned 0 [0064.501] lstrlenA (lpString="*.flv") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.avi") returned 0 [0064.501] lstrlenA (lpString="*.avi") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mp4") returned 0 [0064.501] lstrlenA (lpString="*.mp4") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.wmv") returned 0 [0064.501] lstrlenA (lpString="*.wmv") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.divx") returned 0 [0064.501] lstrlenA (lpString="*.divx") returned 6 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mkv") returned 0 [0064.501] lstrlenA (lpString="*.mkv") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.mp3") returned 0 [0064.501] lstrlenA (lpString="*.mp3") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.wav") returned 0 [0064.501] lstrlenA (lpString="*.wav") returned 5 [0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.flac") returned 0 [0064.502] lstrlenA (lpString="*.flac") returned 6 [0064.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.ape") returned 0 [0064.502] lstrlenA (lpString="*.ape") returned 5 [0064.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.wma") returned 0 [0064.502] lstrlenA (lpString="*.wma") returned 5 [0064.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.ac3") returned 0 [0064.502] lstrlenA (lpString="*.ac3") returned 5 [0064.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", pszSpec="*.doc") returned 0 [0064.502] lstrlenA (lpString="*.doc") returned 5 [0064.502] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="insert", cAlternateFileName="")) returned 1 [0064.502] lstrcmpA (lpString1=".", lpString2="insert") returned -1 [0064.502] lstrcmpA (lpString1="..", lpString2="insert") returned -1 [0064.502] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned="auxpad.xml" [0064.502] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="insert" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert" [0064.502] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert") returned 71 [0064.502] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x752f68, dwReserved1=0xc8, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0064.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.503] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x752f68, dwReserved1=0xc8, cFileName="..", cAlternateFileName="")) returned 1 [0064.503] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.503] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.503] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x752f68, dwReserved1=0xc8, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0064.503] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.503] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="insertbase.xml") returned -1 [0064.503] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="insertbase.xml") returned -1 [0064.503] lstrcmpiA (lpString1="", lpString2="insertbase.xml") returned -1 [0064.503] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*.*") returned="*.*" [0064.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\" [0064.503] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\") returned="" [0064.503] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\HOW TO DECRYPT FILES.txt" [0064.503] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\how to decrypt files.txt")) returned 0xffffffff [0064.503] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0064.504] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.504] WriteFile (in: hFile=0x218, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.505] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.505] CloseHandle (hObject=0x218) returned 1 [0064.505] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\", lpString2="insertbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" [0064.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.zip") returned 0 [0064.505] lstrlenA (lpString="*.zip") returned 5 [0064.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.rar") returned 0 [0064.505] lstrlenA (lpString="*.rar") returned 5 [0064.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.7z") returned 0 [0064.505] lstrlenA (lpString="*.7z") returned 4 [0064.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.tar") returned 0 [0064.505] lstrlenA (lpString="*.tar") returned 5 [0064.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.gzip") returned 0 [0064.505] lstrlenA (lpString="*.gzip") returned 6 [0064.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.jpg") returned 0 [0064.505] lstrlenA (lpString="*.jpg") returned 5 [0064.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.jpeg") returned 0 [0064.505] lstrlenA (lpString="*.jpeg") returned 6 [0064.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.psd") returned 0 [0064.505] lstrlenA (lpString="*.psd") returned 5 [0064.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.cdr") returned 0 [0064.505] lstrlenA (lpString="*.cdr") returned 5 [0064.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.dwg") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.max") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.bmp") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.gif") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.png") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.doc") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.docx") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.xls") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.xlsx") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.ppt") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.pptx") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.txt") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.pdf") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.djvu") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.htm") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.html") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mdb") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.cer") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.p12") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.pfx") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.kwm") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.pwm") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.1cd") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.md") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mdf") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.dbf") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.odt") returned 0 [0064.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.vob") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.ifo") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.lnk") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.torrent") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mov") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.m2v") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.3gp") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mpeg") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mpg") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.flv") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.avi") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mp4") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.wmv") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.divx") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mkv") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.mp3") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.wav") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.flac") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.ape") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.wma") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.ac3") returned 0 [0064.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", pszSpec="*.doc") returned 0 [0064.507] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x752f68, dwReserved1=0xc8, cFileName="insertbase.xml", cAlternateFileName="")) returned 0 [0064.507] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0064.507] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0064.508] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.508] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="insert.xml") returned -1 [0064.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="insert.xml") returned -1 [0064.508] lstrcmpiA (lpString1="", lpString2="insert.xml") returned -1 [0064.508] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0064.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0064.508] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0064.508] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0064.508] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0064.508] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="insert.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.zip") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.rar") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.7z") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.tar") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.gzip") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.jpg") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.jpeg") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.psd") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.cdr") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.dwg") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.max") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.bmp") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.gif") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.png") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.doc") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.docx") returned 0 [0064.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.xls") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.xlsx") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.ppt") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.pptx") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.txt") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.pdf") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.djvu") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.htm") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.html") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mdb") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.cer") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.p12") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.pfx") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.kwm") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.pwm") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.1cd") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.md") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mdf") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.dbf") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.odt") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.vob") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.ifo") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.lnk") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.torrent") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mov") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.m2v") returned 0 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.3gp") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mpeg") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mpg") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.flv") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.avi") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mp4") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.wmv") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.divx") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mkv") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.mp3") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.wav") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.flac") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.ape") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.wma") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.ac3") returned 0 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", pszSpec="*.doc") returned 0 [0064.510] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="keypad", cAlternateFileName="")) returned 1 [0064.510] lstrcmpA (lpString1=".", lpString2="keypad") returned -1 [0064.510] lstrcmpA (lpString1="..", lpString2="keypad") returned -1 [0064.510] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned="insert.xml" [0064.510] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="keypad" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad" [0064.510] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0064.510] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.510] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="..", cAlternateFileName="")) returned 1 [0064.511] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.511] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.511] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0064.511] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.511] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ea.xml") returned 1 [0064.511] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ea.xml") returned 1 [0064.511] lstrcmpiA (lpString1="", lpString2="ea.xml") returned -1 [0064.511] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*.*") returned="*.*" [0064.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" [0064.511] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned="" [0064.511] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" [0064.511] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how to decrypt files.txt")) returned 0xffffffff [0064.511] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0064.512] WriteFile (in: hFile=0x218, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.513] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.513] CloseHandle (hObject=0x218) returned 1 [0064.513] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", lpString2="ea.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.zip") returned 0 [0064.513] lstrlenA (lpString="*.zip") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.rar") returned 0 [0064.514] lstrlenA (lpString="*.rar") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.7z") returned 0 [0064.514] lstrlenA (lpString="*.7z") returned 4 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.tar") returned 0 [0064.514] lstrlenA (lpString="*.tar") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.gzip") returned 0 [0064.514] lstrlenA (lpString="*.gzip") returned 6 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.jpg") returned 0 [0064.514] lstrlenA (lpString="*.jpg") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.jpeg") returned 0 [0064.514] lstrlenA (lpString="*.jpeg") returned 6 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.psd") returned 0 [0064.514] lstrlenA (lpString="*.psd") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.cdr") returned 0 [0064.514] lstrlenA (lpString="*.cdr") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.dwg") returned 0 [0064.514] lstrlenA (lpString="*.dwg") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.max") returned 0 [0064.514] lstrlenA (lpString="*.max") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.bmp") returned 0 [0064.514] lstrlenA (lpString="*.bmp") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.gif") returned 0 [0064.514] lstrlenA (lpString="*.gif") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.png") returned 0 [0064.514] lstrlenA (lpString="*.png") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.doc") returned 0 [0064.514] lstrlenA (lpString="*.doc") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.docx") returned 0 [0064.514] lstrlenA (lpString="*.docx") returned 6 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", pszSpec="*.xls") returned 0 [0064.514] lstrlenA (lpString="*.xls") returned 5 [0064.515] lstrlenA (lpString="*.xlsx") returned 6 [0064.515] lstrlenA (lpString="*.ppt") returned 5 [0064.515] lstrlenA (lpString="*.pptx") returned 6 [0064.515] lstrlenA (lpString="*.txt") returned 5 [0064.515] lstrlenA (lpString="*.pdf") returned 5 [0064.515] lstrlenA (lpString="*.djvu") returned 6 [0064.515] lstrlenA (lpString="*.htm") returned 5 [0064.515] lstrlenA (lpString="*.html") returned 6 [0064.515] lstrlenA (lpString="*.mdb") returned 5 [0064.515] lstrlenA (lpString="*.cer") returned 5 [0064.515] lstrlenA (lpString="*.p12") returned 5 [0064.515] lstrlenA (lpString="*.pfx") returned 5 [0064.515] lstrlenA (lpString="*.kwm") returned 5 [0064.515] lstrlenA (lpString="*.pwm") returned 5 [0064.515] lstrlenA (lpString="*.1cd") returned 5 [0064.515] lstrlenA (lpString="*.md") returned 4 [0064.515] lstrlenA (lpString="*.mdf") returned 5 [0064.515] lstrlenA (lpString="*.dbf") returned 5 [0064.515] lstrlenA (lpString="*.odt") returned 5 [0064.515] lstrlenA (lpString="*.vob") returned 5 [0064.515] lstrlenA (lpString="*.ifo") returned 5 [0064.515] lstrlenA (lpString="*.lnk") returned 5 [0064.515] lstrlenA (lpString="*.torrent") returned 9 [0064.515] lstrlenA (lpString="*.mov") returned 5 [0064.515] lstrlenA (lpString="*.m2v") returned 5 [0064.516] lstrlenA (lpString="*.3gp") returned 5 [0064.516] lstrlenA (lpString="*.mpeg") returned 6 [0064.516] lstrlenA (lpString="*.mpg") returned 5 [0064.516] lstrlenA (lpString="*.flv") returned 5 [0064.516] lstrlenA (lpString="*.avi") returned 5 [0064.516] lstrlenA (lpString="*.mp4") returned 5 [0064.516] lstrlenA (lpString="*.wmv") returned 5 [0064.516] lstrlenA (lpString="*.divx") returned 6 [0064.516] lstrlenA (lpString="*.mkv") returned 5 [0064.516] lstrlenA (lpString="*.mp3") returned 5 [0064.516] lstrlenA (lpString="*.wav") returned 5 [0064.516] lstrlenA (lpString="*.flac") returned 6 [0064.516] lstrlenA (lpString="*.ape") returned 5 [0064.516] lstrlenA (lpString="*.wma") returned 5 [0064.516] lstrlenA (lpString="*.ac3") returned 5 [0064.516] lstrlenA (lpString="*.doc") returned 5 [0064.516] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0064.516] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.516] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="keypadbase.xml") returned -1 [0064.516] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="keypadbase.xml") returned -1 [0064.516] lstrcmpiA (lpString1="", lpString2="keypadbase.xml") returned -1 [0064.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned="ea.xml" [0064.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" [0064.516] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned="" [0064.516] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" [0064.516] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how to decrypt files.txt")) returned 0x20 [0064.516] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", lpString2="keypadbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" [0064.516] lstrlenA (lpString="*.zip") returned 5 [0064.517] lstrlenA (lpString="*.rar") returned 5 [0064.517] lstrlenA (lpString="*.7z") returned 4 [0064.517] lstrlenA (lpString="*.tar") returned 5 [0064.517] lstrlenA (lpString="*.gzip") returned 6 [0064.517] lstrlenA (lpString="*.jpg") returned 5 [0064.517] lstrlenA (lpString="*.jpeg") returned 6 [0064.517] lstrlenA (lpString="*.psd") returned 5 [0064.517] lstrlenA (lpString="*.cdr") returned 5 [0064.517] lstrlenA (lpString="*.dwg") returned 5 [0064.517] lstrlenA (lpString="*.max") returned 5 [0064.517] lstrlenA (lpString="*.bmp") returned 5 [0064.517] lstrlenA (lpString="*.gif") returned 5 [0064.517] lstrlenA (lpString="*.png") returned 5 [0064.517] lstrlenA (lpString="*.doc") returned 5 [0064.517] lstrlenA (lpString="*.docx") returned 6 [0064.517] lstrlenA (lpString="*.xls") returned 5 [0064.517] lstrlenA (lpString="*.xlsx") returned 6 [0064.517] lstrlenA (lpString="*.ppt") returned 5 [0064.517] lstrlenA (lpString="*.pptx") returned 6 [0064.517] lstrlenA (lpString="*.txt") returned 5 [0064.517] lstrlenA (lpString="*.pdf") returned 5 [0064.517] lstrlenA (lpString="*.djvu") returned 6 [0064.517] lstrlenA (lpString="*.htm") returned 5 [0064.517] lstrlenA (lpString="*.html") returned 6 [0064.517] lstrlenA (lpString="*.mdb") returned 5 [0064.517] lstrlenA (lpString="*.cer") returned 5 [0064.517] lstrlenA (lpString="*.p12") returned 5 [0064.517] lstrlenA (lpString="*.pfx") returned 5 [0064.518] lstrlenA (lpString="*.kwm") returned 5 [0064.518] lstrlenA (lpString="*.pwm") returned 5 [0064.518] lstrlenA (lpString="*.1cd") returned 5 [0064.518] lstrlenA (lpString="*.md") returned 4 [0064.518] lstrlenA (lpString="*.mdf") returned 5 [0064.518] lstrlenA (lpString="*.dbf") returned 5 [0064.518] lstrlenA (lpString="*.odt") returned 5 [0064.518] lstrlenA (lpString="*.vob") returned 5 [0064.518] lstrlenA (lpString="*.ifo") returned 5 [0064.518] lstrlenA (lpString="*.lnk") returned 5 [0064.518] lstrlenA (lpString="*.torrent") returned 9 [0064.518] lstrlenA (lpString="*.mov") returned 5 [0064.518] lstrlenA (lpString="*.m2v") returned 5 [0064.518] lstrlenA (lpString="*.3gp") returned 5 [0064.518] lstrlenA (lpString="*.mpeg") returned 6 [0064.518] lstrlenA (lpString="*.mpg") returned 5 [0064.518] lstrlenA (lpString="*.flv") returned 5 [0064.518] lstrlenA (lpString="*.avi") returned 5 [0064.518] lstrlenA (lpString="*.mp4") returned 5 [0064.518] lstrlenA (lpString="*.wmv") returned 5 [0064.518] lstrlenA (lpString="*.divx") returned 6 [0064.518] lstrlenA (lpString="*.mkv") returned 5 [0064.518] lstrlenA (lpString="*.mp3") returned 5 [0064.518] lstrlenA (lpString="*.wav") returned 5 [0064.518] lstrlenA (lpString="*.flac") returned 6 [0064.518] lstrlenA (lpString="*.ape") returned 5 [0064.518] lstrlenA (lpString="*.wma") returned 5 [0064.518] lstrlenA (lpString="*.ac3") returned 5 [0064.519] lstrlenA (lpString="*.doc") returned 5 [0064.519] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0064.519] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.519] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="kor-kor.xml") returned -1 [0064.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor-kor.xml") returned -1 [0064.519] lstrcmpiA (lpString1="", lpString2="kor-kor.xml") returned -1 [0064.519] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned="keypadbase.xml" [0064.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" [0064.519] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned="" [0064.519] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" [0064.519] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how to decrypt files.txt")) returned 0x20 [0064.519] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", lpString2="kor-kor.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" [0064.519] lstrlenA (lpString="*.zip") returned 5 [0064.519] lstrlenA (lpString="*.rar") returned 5 [0064.519] lstrlenA (lpString="*.7z") returned 4 [0064.519] lstrlenA (lpString="*.tar") returned 5 [0064.519] lstrlenA (lpString="*.gzip") returned 6 [0064.519] lstrlenA (lpString="*.jpg") returned 5 [0064.519] lstrlenA (lpString="*.jpeg") returned 6 [0064.519] lstrlenA (lpString="*.psd") returned 5 [0064.519] lstrlenA (lpString="*.cdr") returned 5 [0064.519] lstrlenA (lpString="*.dwg") returned 5 [0064.532] lstrlenA (lpString="*.max") returned 5 [0064.532] lstrlenA (lpString="*.bmp") returned 5 [0064.532] lstrlenA (lpString="*.gif") returned 5 [0064.532] lstrlenA (lpString="*.png") returned 5 [0064.532] lstrlenA (lpString="*.doc") returned 5 [0064.532] lstrlenA (lpString="*.docx") returned 6 [0064.532] lstrlenA (lpString="*.xls") returned 5 [0064.532] lstrlenA (lpString="*.xlsx") returned 6 [0064.532] lstrlenA (lpString="*.ppt") returned 5 [0064.532] lstrlenA (lpString="*.pptx") returned 6 [0064.533] lstrlenA (lpString="*.txt") returned 5 [0064.533] lstrlenA (lpString="*.pdf") returned 5 [0064.533] lstrlenA (lpString="*.djvu") returned 6 [0064.533] lstrlenA (lpString="*.htm") returned 5 [0064.533] lstrlenA (lpString="*.html") returned 6 [0064.533] lstrlenA (lpString="*.mdb") returned 5 [0064.533] lstrlenA (lpString="*.cer") returned 5 [0064.533] lstrlenA (lpString="*.p12") returned 5 [0064.533] lstrlenA (lpString="*.pfx") returned 5 [0064.533] lstrlenA (lpString="*.kwm") returned 5 [0064.533] lstrlenA (lpString="*.pwm") returned 5 [0064.533] lstrlenA (lpString="*.1cd") returned 5 [0064.533] lstrlenA (lpString="*.md") returned 4 [0064.533] lstrlenA (lpString="*.mdf") returned 5 [0064.533] lstrlenA (lpString="*.dbf") returned 5 [0064.533] lstrlenA (lpString="*.odt") returned 5 [0064.533] lstrlenA (lpString="*.vob") returned 5 [0064.533] lstrlenA (lpString="*.ifo") returned 5 [0064.533] lstrlenA (lpString="*.lnk") returned 5 [0064.533] lstrlenA (lpString="*.torrent") returned 9 [0064.533] lstrlenA (lpString="*.mov") returned 5 [0064.533] lstrlenA (lpString="*.m2v") returned 5 [0064.533] lstrlenA (lpString="*.3gp") returned 5 [0064.533] lstrlenA (lpString="*.mpeg") returned 6 [0064.533] lstrlenA (lpString="*.mpg") returned 5 [0064.533] lstrlenA (lpString="*.flv") returned 5 [0064.533] lstrlenA (lpString="*.avi") returned 5 [0064.533] lstrlenA (lpString="*.mp4") returned 5 [0064.534] lstrlenA (lpString="*.wmv") returned 5 [0064.534] lstrlenA (lpString="*.divx") returned 6 [0064.534] lstrlenA (lpString="*.mkv") returned 5 [0064.534] lstrlenA (lpString="*.mp3") returned 5 [0064.534] lstrlenA (lpString="*.wav") returned 5 [0064.534] lstrlenA (lpString="*.flac") returned 6 [0064.534] lstrlenA (lpString="*.ape") returned 5 [0064.534] lstrlenA (lpString="*.wma") returned 5 [0064.534] lstrlenA (lpString="*.ac3") returned 5 [0064.534] lstrlenA (lpString="*.doc") returned 5 [0064.534] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0064.534] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0064.534] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0064.534] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.534] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="keypad.xml") returned -1 [0064.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="keypad.xml") returned -1 [0064.534] lstrcmpiA (lpString1="", lpString2="keypad.xml") returned -1 [0064.534] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0064.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0064.534] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0064.534] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0064.534] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0064.535] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="keypad.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" [0064.535] lstrlenA (lpString="*.zip") returned 5 [0064.535] lstrlenA (lpString="*.rar") returned 5 [0064.535] lstrlenA (lpString="*.7z") returned 4 [0064.535] lstrlenA (lpString="*.tar") returned 5 [0064.535] lstrlenA (lpString="*.gzip") returned 6 [0064.535] lstrlenA (lpString="*.jpg") returned 5 [0064.535] lstrlenA (lpString="*.jpeg") returned 6 [0064.535] lstrlenA (lpString="*.psd") returned 5 [0064.535] lstrlenA (lpString="*.cdr") returned 5 [0064.535] lstrlenA (lpString="*.dwg") returned 5 [0064.535] lstrlenA (lpString="*.max") returned 5 [0064.535] lstrlenA (lpString="*.bmp") returned 5 [0064.535] lstrlenA (lpString="*.gif") returned 5 [0064.535] lstrlenA (lpString="*.png") returned 5 [0064.535] lstrlenA (lpString="*.doc") returned 5 [0064.535] lstrlenA (lpString="*.docx") returned 6 [0064.535] lstrlenA (lpString="*.xls") returned 5 [0064.536] lstrlenA (lpString="*.xlsx") returned 6 [0064.536] lstrlenA (lpString="*.ppt") returned 5 [0064.536] lstrlenA (lpString="*.pptx") returned 6 [0064.536] lstrlenA (lpString="*.txt") returned 5 [0064.536] lstrlenA (lpString="*.pdf") returned 5 [0064.536] lstrlenA (lpString="*.djvu") returned 6 [0064.536] lstrlenA (lpString="*.htm") returned 5 [0064.536] lstrlenA (lpString="*.html") returned 6 [0064.536] lstrlenA (lpString="*.mdb") returned 5 [0064.536] lstrlenA (lpString="*.cer") returned 5 [0064.536] lstrlenA (lpString="*.p12") returned 5 [0064.536] lstrlenA (lpString="*.pfx") returned 5 [0064.536] lstrlenA (lpString="*.kwm") returned 5 [0064.536] lstrlenA (lpString="*.pwm") returned 5 [0064.536] lstrlenA (lpString="*.1cd") returned 5 [0064.536] lstrlenA (lpString="*.md") returned 4 [0064.536] lstrlenA (lpString="*.mdf") returned 5 [0064.536] lstrlenA (lpString="*.dbf") returned 5 [0064.536] lstrlenA (lpString="*.odt") returned 5 [0064.536] lstrlenA (lpString="*.vob") returned 5 [0064.536] lstrlenA (lpString="*.ifo") returned 5 [0064.536] lstrlenA (lpString="*.lnk") returned 5 [0064.536] lstrlenA (lpString="*.torrent") returned 9 [0064.536] lstrlenA (lpString="*.mov") returned 5 [0064.536] lstrlenA (lpString="*.m2v") returned 5 [0064.536] lstrlenA (lpString="*.3gp") returned 5 [0064.536] lstrlenA (lpString="*.mpeg") returned 6 [0064.536] lstrlenA (lpString="*.mpg") returned 5 [0064.537] lstrlenA (lpString="*.flv") returned 5 [0064.537] lstrlenA (lpString="*.avi") returned 5 [0064.537] lstrlenA (lpString="*.mp4") returned 5 [0064.537] lstrlenA (lpString="*.wmv") returned 5 [0064.537] lstrlenA (lpString="*.divx") returned 6 [0064.537] lstrlenA (lpString="*.mkv") returned 5 [0064.537] lstrlenA (lpString="*.mp3") returned 5 [0064.537] lstrlenA (lpString="*.wav") returned 5 [0064.537] lstrlenA (lpString="*.flac") returned 6 [0064.537] lstrlenA (lpString="*.ape") returned 5 [0064.537] lstrlenA (lpString="*.wma") returned 5 [0064.537] lstrlenA (lpString="*.ac3") returned 5 [0064.537] lstrlenA (lpString="*.doc") returned 5 [0064.537] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="main", cAlternateFileName="")) returned 1 [0064.537] lstrcmpA (lpString1=".", lpString2="main") returned -1 [0064.537] lstrcmpA (lpString1="..", lpString2="main") returned -1 [0064.537] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned="keypad.xml" [0064.537] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="main" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main" [0064.537] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main") returned 69 [0064.537] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0064.539] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.539] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="..", cAlternateFileName="")) returned 1 [0064.539] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.539] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.539] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="base.xml", cAlternateFileName="")) returned 1 [0064.539] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base.xml") returned 1 [0064.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base.xml") returned 1 [0064.539] lstrcmpiA (lpString1="", lpString2="base.xml") returned -1 [0064.539] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*.*") returned="*.*" [0064.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.539] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.539] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.539] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0xffffffff [0064.540] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0064.540] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.540] WriteFile (in: hFile=0x218, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.541] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.541] CloseHandle (hObject=0x218) returned 1 [0064.541] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" [0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.zip") returned 0 [0064.541] lstrlenA (lpString="*.zip") returned 5 [0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.rar") returned 0 [0064.541] lstrlenA (lpString="*.rar") returned 5 [0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.7z") returned 0 [0064.542] lstrlenA (lpString="*.7z") returned 4 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.tar") returned 0 [0064.542] lstrlenA (lpString="*.tar") returned 5 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.gzip") returned 0 [0064.542] lstrlenA (lpString="*.gzip") returned 6 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.jpg") returned 0 [0064.542] lstrlenA (lpString="*.jpg") returned 5 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.jpeg") returned 0 [0064.542] lstrlenA (lpString="*.jpeg") returned 6 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.psd") returned 0 [0064.542] lstrlenA (lpString="*.psd") returned 5 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.cdr") returned 0 [0064.542] lstrlenA (lpString="*.cdr") returned 5 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.dwg") returned 0 [0064.542] lstrlenA (lpString="*.dwg") returned 5 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.max") returned 0 [0064.542] lstrlenA (lpString="*.max") returned 5 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.bmp") returned 0 [0064.542] lstrlenA (lpString="*.bmp") returned 5 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.gif") returned 0 [0064.542] lstrlenA (lpString="*.gif") returned 5 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.png") returned 0 [0064.542] lstrlenA (lpString="*.png") returned 5 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.doc") returned 0 [0064.542] lstrlenA (lpString="*.doc") returned 5 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.docx") returned 0 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.xls") returned 0 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.xlsx") returned 0 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.ppt") returned 0 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.pptx") returned 0 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.txt") returned 0 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.pdf") returned 0 [0064.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.djvu") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.htm") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.html") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mdb") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.cer") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.p12") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.pfx") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.kwm") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.pwm") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.1cd") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.md") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mdf") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.dbf") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.odt") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.vob") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.ifo") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.lnk") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.torrent") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mov") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.m2v") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.3gp") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mpeg") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mpg") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.flv") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.avi") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mp4") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.wmv") returned 0 [0064.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.divx") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mkv") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mp3") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.wav") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.flac") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.ape") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.wma") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.ac3") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.doc") returned 0 [0064.544] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x1, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0064.544] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.544] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="baseAltGr_rtl.xml") returned 1 [0064.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="baseAltGr_rtl.xml") returned 1 [0064.544] lstrcmpiA (lpString1="", lpString2="baseAltGr_rtl.xml") returned -1 [0064.544] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned="base.xml" [0064.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.544] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.544] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.544] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0064.544] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="baseAltGr_rtl.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.zip") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.rar") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.7z") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.tar") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.gzip") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.jpg") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.jpeg") returned 0 [0064.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.psd") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.cdr") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.dwg") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.max") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.bmp") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.gif") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.png") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.doc") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.docx") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.xls") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.xlsx") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.ppt") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.pptx") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.txt") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.pdf") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.djvu") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.htm") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.html") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mdb") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.cer") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.p12") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.pfx") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.kwm") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.pwm") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.1cd") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.md") returned 0 [0064.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mdf") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.dbf") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.odt") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.vob") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.ifo") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.lnk") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.torrent") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mov") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.m2v") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.3gp") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mpeg") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mpg") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.flv") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.avi") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mp4") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.wmv") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.divx") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mkv") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mp3") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.wav") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.flac") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.ape") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.wma") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.ac3") returned 0 [0064.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.doc") returned 0 [0064.546] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0064.546] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.546] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_altgr.xml") returned 1 [0064.546] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_altgr.xml") returned 1 [0064.547] lstrcmpiA (lpString1="", lpString2="base_altgr.xml") returned -1 [0064.547] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned="baseAltGr_rtl.xml" [0064.547] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.547] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.547] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.547] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0064.547] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base_altgr.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.zip") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.rar") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.7z") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.tar") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.gzip") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.jpg") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.jpeg") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.psd") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.cdr") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.dwg") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.max") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.bmp") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.gif") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.png") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.doc") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.docx") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.xls") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.xlsx") returned 0 [0064.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.ppt") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.pptx") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.txt") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.pdf") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.djvu") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.htm") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.html") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mdb") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.cer") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.p12") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.pfx") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.kwm") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.pwm") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.1cd") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.md") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mdf") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.dbf") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.odt") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.vob") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.ifo") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.lnk") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.torrent") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mov") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.m2v") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.3gp") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mpeg") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mpg") returned 0 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.flv") returned 0 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.avi") returned 0 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mp4") returned 0 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.wmv") returned 0 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.divx") returned 0 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mkv") returned 0 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mp3") returned 0 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.wav") returned 0 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.flac") returned 0 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.ape") returned 0 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.wma") returned 0 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.ac3") returned 0 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.doc") returned 0 [0064.550] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0064.550] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.550] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_ca.xml") returned 1 [0064.550] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_ca.xml") returned 1 [0064.550] lstrcmpiA (lpString1="", lpString2="base_ca.xml") returned -1 [0064.550] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned="base_altgr.xml" [0064.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.550] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.550] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.550] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0064.550] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base_ca.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.zip") returned 0 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.rar") returned 0 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.7z") returned 0 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.tar") returned 0 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.gzip") returned 0 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.jpg") returned 0 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.jpeg") returned 0 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.psd") returned 0 [0064.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.cdr") returned 0 [0064.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.dwg") returned 0 [0064.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.max") returned 0 [0064.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.bmp") returned 0 [0064.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.gif") returned 0 [0064.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.png") returned 0 [0064.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.doc") returned 0 [0064.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.docx") returned 0 [0064.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.xls") returned 0 [0064.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.xlsx") returned 0 [0064.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.ppt") returned 0 [0064.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.pptx") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.txt") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.pdf") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.djvu") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.htm") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.html") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mdb") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.cer") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.p12") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.pfx") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.kwm") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.pwm") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.1cd") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.md") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mdf") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.dbf") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.odt") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.vob") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.ifo") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.lnk") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.torrent") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mov") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.m2v") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.3gp") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mpeg") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mpg") returned 0 [0064.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.flv") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.avi") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mp4") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.wmv") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.divx") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mkv") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mp3") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.wav") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.flac") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.ape") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.wma") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.ac3") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.doc") returned 0 [0064.559] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0064.559] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.559] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_heb.xml") returned 1 [0064.559] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_heb.xml") returned 1 [0064.559] lstrcmpiA (lpString1="", lpString2="base_heb.xml") returned -1 [0064.559] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned="base_ca.xml" [0064.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.559] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.559] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.559] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0064.559] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base_heb.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.zip") returned 0 [0064.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.rar") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.7z") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.tar") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.gzip") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.jpg") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.jpeg") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.psd") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.cdr") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.dwg") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.max") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.bmp") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.gif") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.png") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.doc") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.docx") returned 0 [0064.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.xls") returned 0 [0064.560] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0064.560] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.560] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_jpn.xml") returned 1 [0064.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_jpn.xml") returned 1 [0064.560] lstrcmpiA (lpString1="", lpString2="base_jpn.xml") returned -1 [0064.560] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned="base_heb.xml" [0064.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.561] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.561] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0064.561] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base_jpn.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" [0064.561] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0064.561] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.561] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_kor.xml") returned 1 [0064.561] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_kor.xml") returned 1 [0064.561] lstrcmpiA (lpString1="", lpString2="base_kor.xml") returned -1 [0064.561] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned="base_jpn.xml" [0064.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.561] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.561] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0064.561] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base_kor.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" [0064.561] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0064.561] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.561] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_rtl.xml") returned 1 [0064.561] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_rtl.xml") returned 1 [0064.561] lstrcmpiA (lpString1="", lpString2="base_rtl.xml") returned -1 [0064.561] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned="base_kor.xml" [0064.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.561] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.561] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0064.562] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="base_rtl.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" [0064.562] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0064.562] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.562] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ja-jp.xml") returned -1 [0064.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja-jp.xml") returned -1 [0064.562] lstrcmpiA (lpString1="", lpString2="ja-jp.xml") returned -1 [0064.562] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned="base_rtl.xml" [0064.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.562] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.562] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.562] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0064.562] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="ja-jp.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" [0064.562] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0064.562] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.562] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ko-kr.xml") returned -1 [0064.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ko-kr.xml") returned -1 [0064.562] lstrcmpiA (lpString1="", lpString2="ko-kr.xml") returned -1 [0064.562] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned="ja-jp.xml" [0064.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.562] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.562] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.562] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0064.562] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="ko-kr.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" [0064.562] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0064.562] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.563] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-changjei.xml") returned -1 [0064.563] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-changjei.xml") returned -1 [0064.563] lstrcmpiA (lpString1="", lpString2="zh-changjei.xml") returned -1 [0064.563] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned="ko-kr.xml" [0064.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.563] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.563] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.563] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0064.563] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="zh-changjei.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" [0064.563] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0064.563] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.563] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-dayi.xml") returned -1 [0064.563] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-dayi.xml") returned -1 [0064.563] lstrcmpiA (lpString1="", lpString2="zh-dayi.xml") returned -1 [0064.563] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned="zh-changjei.xml" [0064.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.563] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.563] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.563] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0064.563] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="zh-dayi.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" [0064.563] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0064.563] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.563] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-phonetic.xml") returned -1 [0064.563] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-phonetic.xml") returned -1 [0064.563] lstrcmpiA (lpString1="", lpString2="zh-phonetic.xml") returned -1 [0064.563] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned="zh-dayi.xml" [0064.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" [0064.563] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned="" [0064.564] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0064.564] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0064.564] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", lpString2="zh-phonetic.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" [0064.564] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0064.564] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0064.564] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0064.564] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.564] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="main.xml") returned -1 [0064.564] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="main.xml") returned -1 [0064.564] lstrcmpiA (lpString1="", lpString2="main.xml") returned -1 [0064.564] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0064.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0064.564] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0064.564] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0064.564] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0064.564] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="main.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" [0064.564] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1 [0064.564] lstrcmpA (lpString1=".", lpString2="oskclearui") returned -1 [0064.564] lstrcmpA (lpString1="..", lpString2="oskclearui") returned -1 [0064.564] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned="main.xml" [0064.564] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="oskclearui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui" [0064.565] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0064.565] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.565] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="..", cAlternateFileName="")) returned 1 [0064.565] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.565] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.565] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1 [0064.565] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.565] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskclearuibase.xml") returned -1 [0064.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskclearuibase.xml") returned -1 [0064.565] lstrcmpiA (lpString1="", lpString2="oskclearuibase.xml") returned -1 [0064.565] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*.*") returned="*.*" [0064.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\" [0064.565] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\") returned="" [0064.565] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\HOW TO DECRYPT FILES.txt" [0064.565] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\how to decrypt files.txt")) returned 0xffffffff [0064.565] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0064.567] WriteFile (in: hFile=0x218, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.568] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.568] CloseHandle (hObject=0x218) returned 1 [0064.568] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\", lpString2="oskclearuibase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" [0064.568] lstrlenA (lpString="*.zip") returned 5 [0064.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.rar") returned 0 [0064.568] lstrlenA (lpString="*.rar") returned 5 [0064.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.7z") returned 0 [0064.568] lstrlenA (lpString="*.7z") returned 4 [0064.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.tar") returned 0 [0064.568] lstrlenA (lpString="*.tar") returned 5 [0064.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.gzip") returned 0 [0064.568] lstrlenA (lpString="*.gzip") returned 6 [0064.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.jpg") returned 0 [0064.568] lstrlenA (lpString="*.jpg") returned 5 [0064.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.jpeg") returned 0 [0064.568] lstrlenA (lpString="*.jpeg") returned 6 [0064.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.psd") returned 0 [0064.569] lstrlenA (lpString="*.psd") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.cdr") returned 0 [0064.569] lstrlenA (lpString="*.cdr") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.dwg") returned 0 [0064.569] lstrlenA (lpString="*.dwg") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.max") returned 0 [0064.569] lstrlenA (lpString="*.max") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.bmp") returned 0 [0064.569] lstrlenA (lpString="*.bmp") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.gif") returned 0 [0064.569] lstrlenA (lpString="*.gif") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.png") returned 0 [0064.569] lstrlenA (lpString="*.png") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.doc") returned 0 [0064.569] lstrlenA (lpString="*.doc") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.docx") returned 0 [0064.569] lstrlenA (lpString="*.docx") returned 6 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.xls") returned 0 [0064.569] lstrlenA (lpString="*.xls") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.xlsx") returned 0 [0064.569] lstrlenA (lpString="*.xlsx") returned 6 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.ppt") returned 0 [0064.569] lstrlenA (lpString="*.ppt") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.pptx") returned 0 [0064.569] lstrlenA (lpString="*.pptx") returned 6 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.txt") returned 0 [0064.569] lstrlenA (lpString="*.txt") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.pdf") returned 0 [0064.569] lstrlenA (lpString="*.pdf") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.djvu") returned 0 [0064.569] lstrlenA (lpString="*.djvu") returned 6 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.htm") returned 0 [0064.569] lstrlenA (lpString="*.htm") returned 5 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.html") returned 0 [0064.569] lstrlenA (lpString="*.html") returned 6 [0064.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mdb") returned 0 [0064.570] lstrlenA (lpString="*.mdb") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.cer") returned 0 [0064.570] lstrlenA (lpString="*.cer") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.p12") returned 0 [0064.570] lstrlenA (lpString="*.p12") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.pfx") returned 0 [0064.570] lstrlenA (lpString="*.pfx") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.kwm") returned 0 [0064.570] lstrlenA (lpString="*.kwm") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.pwm") returned 0 [0064.570] lstrlenA (lpString="*.pwm") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.1cd") returned 0 [0064.570] lstrlenA (lpString="*.1cd") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.md") returned 0 [0064.570] lstrlenA (lpString="*.md") returned 4 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mdf") returned 0 [0064.570] lstrlenA (lpString="*.mdf") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.dbf") returned 0 [0064.570] lstrlenA (lpString="*.dbf") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.odt") returned 0 [0064.570] lstrlenA (lpString="*.odt") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.vob") returned 0 [0064.570] lstrlenA (lpString="*.vob") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.ifo") returned 0 [0064.570] lstrlenA (lpString="*.ifo") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.lnk") returned 0 [0064.570] lstrlenA (lpString="*.lnk") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.torrent") returned 0 [0064.570] lstrlenA (lpString="*.torrent") returned 9 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mov") returned 0 [0064.570] lstrlenA (lpString="*.mov") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.m2v") returned 0 [0064.570] lstrlenA (lpString="*.m2v") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.3gp") returned 0 [0064.570] lstrlenA (lpString="*.3gp") returned 5 [0064.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mpeg") returned 0 [0064.570] lstrlenA (lpString="*.mpeg") returned 6 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mpg") returned 0 [0064.571] lstrlenA (lpString="*.mpg") returned 5 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.flv") returned 0 [0064.571] lstrlenA (lpString="*.flv") returned 5 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.avi") returned 0 [0064.571] lstrlenA (lpString="*.avi") returned 5 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mp4") returned 0 [0064.571] lstrlenA (lpString="*.mp4") returned 5 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.wmv") returned 0 [0064.571] lstrlenA (lpString="*.wmv") returned 5 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.divx") returned 0 [0064.571] lstrlenA (lpString="*.divx") returned 6 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mkv") returned 0 [0064.571] lstrlenA (lpString="*.mkv") returned 5 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.mp3") returned 0 [0064.571] lstrlenA (lpString="*.mp3") returned 5 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.wav") returned 0 [0064.571] lstrlenA (lpString="*.wav") returned 5 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.flac") returned 0 [0064.571] lstrlenA (lpString="*.flac") returned 6 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.ape") returned 0 [0064.571] lstrlenA (lpString="*.ape") returned 5 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.wma") returned 0 [0064.571] lstrlenA (lpString="*.wma") returned 5 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.ac3") returned 0 [0064.571] lstrlenA (lpString="*.ac3") returned 5 [0064.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", pszSpec="*.doc") returned 0 [0064.571] lstrlenA (lpString="*.doc") returned 5 [0064.571] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 0 [0064.571] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0064.571] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0064.571] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.572] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskclearui.xml") returned -1 [0064.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskclearui.xml") returned -1 [0064.572] lstrcmpiA (lpString1="", lpString2="oskclearui.xml") returned -1 [0064.572] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0064.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0064.572] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0064.572] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0064.572] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0064.572] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="oskclearui.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.zip") returned 0 [0064.572] lstrlenA (lpString="*.zip") returned 5 [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.rar") returned 0 [0064.572] lstrlenA (lpString="*.rar") returned 5 [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.7z") returned 0 [0064.572] lstrlenA (lpString="*.7z") returned 4 [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.tar") returned 0 [0064.572] lstrlenA (lpString="*.tar") returned 5 [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.gzip") returned 0 [0064.572] lstrlenA (lpString="*.gzip") returned 6 [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.jpg") returned 0 [0064.572] lstrlenA (lpString="*.jpg") returned 5 [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.jpeg") returned 0 [0064.572] lstrlenA (lpString="*.jpeg") returned 6 [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.psd") returned 0 [0064.572] lstrlenA (lpString="*.psd") returned 5 [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.cdr") returned 0 [0064.572] lstrlenA (lpString="*.cdr") returned 5 [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.dwg") returned 0 [0064.572] lstrlenA (lpString="*.dwg") returned 5 [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.max") returned 0 [0064.572] lstrlenA (lpString="*.max") returned 5 [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.bmp") returned 0 [0064.572] lstrlenA (lpString="*.bmp") returned 5 [0064.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.gif") returned 0 [0064.573] lstrlenA (lpString="*.gif") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.png") returned 0 [0064.573] lstrlenA (lpString="*.png") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.doc") returned 0 [0064.573] lstrlenA (lpString="*.doc") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.docx") returned 0 [0064.573] lstrlenA (lpString="*.docx") returned 6 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.xls") returned 0 [0064.573] lstrlenA (lpString="*.xls") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.xlsx") returned 0 [0064.573] lstrlenA (lpString="*.xlsx") returned 6 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.ppt") returned 0 [0064.573] lstrlenA (lpString="*.ppt") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.pptx") returned 0 [0064.573] lstrlenA (lpString="*.pptx") returned 6 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.txt") returned 0 [0064.573] lstrlenA (lpString="*.txt") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.pdf") returned 0 [0064.573] lstrlenA (lpString="*.pdf") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.djvu") returned 0 [0064.573] lstrlenA (lpString="*.djvu") returned 6 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.htm") returned 0 [0064.573] lstrlenA (lpString="*.htm") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.html") returned 0 [0064.573] lstrlenA (lpString="*.html") returned 6 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mdb") returned 0 [0064.573] lstrlenA (lpString="*.mdb") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.cer") returned 0 [0064.573] lstrlenA (lpString="*.cer") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.p12") returned 0 [0064.573] lstrlenA (lpString="*.p12") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.pfx") returned 0 [0064.573] lstrlenA (lpString="*.pfx") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.kwm") returned 0 [0064.573] lstrlenA (lpString="*.kwm") returned 5 [0064.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.pwm") returned 0 [0064.574] lstrlenA (lpString="*.pwm") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.1cd") returned 0 [0064.574] lstrlenA (lpString="*.1cd") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.md") returned 0 [0064.574] lstrlenA (lpString="*.md") returned 4 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mdf") returned 0 [0064.574] lstrlenA (lpString="*.mdf") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.dbf") returned 0 [0064.574] lstrlenA (lpString="*.dbf") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.odt") returned 0 [0064.574] lstrlenA (lpString="*.odt") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.vob") returned 0 [0064.574] lstrlenA (lpString="*.vob") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.ifo") returned 0 [0064.574] lstrlenA (lpString="*.ifo") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.lnk") returned 0 [0064.574] lstrlenA (lpString="*.lnk") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.torrent") returned 0 [0064.574] lstrlenA (lpString="*.torrent") returned 9 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mov") returned 0 [0064.574] lstrlenA (lpString="*.mov") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.m2v") returned 0 [0064.574] lstrlenA (lpString="*.m2v") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.3gp") returned 0 [0064.574] lstrlenA (lpString="*.3gp") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mpeg") returned 0 [0064.574] lstrlenA (lpString="*.mpeg") returned 6 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mpg") returned 0 [0064.574] lstrlenA (lpString="*.mpg") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.flv") returned 0 [0064.574] lstrlenA (lpString="*.flv") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.avi") returned 0 [0064.574] lstrlenA (lpString="*.avi") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mp4") returned 0 [0064.574] lstrlenA (lpString="*.mp4") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.wmv") returned 0 [0064.574] lstrlenA (lpString="*.wmv") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.divx") returned 0 [0064.575] lstrlenA (lpString="*.divx") returned 6 [0064.575] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mkv") returned 0 [0064.575] lstrlenA (lpString="*.mkv") returned 5 [0064.575] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.mp3") returned 0 [0064.575] lstrlenA (lpString="*.mp3") returned 5 [0064.575] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.wav") returned 0 [0064.575] lstrlenA (lpString="*.wav") returned 5 [0064.575] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.flac") returned 0 [0064.575] lstrlenA (lpString="*.flac") returned 6 [0064.575] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.ape") returned 0 [0064.575] lstrlenA (lpString="*.ape") returned 5 [0064.575] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.wma") returned 0 [0064.575] lstrlenA (lpString="*.wma") returned 5 [0064.575] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.ac3") returned 0 [0064.575] lstrlenA (lpString="*.ac3") returned 5 [0064.575] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", pszSpec="*.doc") returned 0 [0064.575] lstrlenA (lpString="*.doc") returned 5 [0064.575] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0064.575] lstrcmpA (lpString1=".", lpString2="oskmenu") returned -1 [0064.575] lstrcmpA (lpString1="..", lpString2="oskmenu") returned -1 [0064.575] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned="oskclearui.xml" [0064.575] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="oskmenu" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu" [0064.575] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu") returned 72 [0064.575] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0064.576] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.576] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="..", cAlternateFileName="")) returned 1 [0064.576] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.576] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.576] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0064.576] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.576] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskmenubase.xml") returned -1 [0064.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskmenubase.xml") returned -1 [0064.576] lstrcmpiA (lpString1="", lpString2="oskmenubase.xml") returned -1 [0064.576] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*.*") returned="*.*" [0064.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\" [0064.576] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned="" [0064.576] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt" [0064.576] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\how to decrypt files.txt")) returned 0xffffffff [0064.576] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0064.577] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.577] WriteFile (in: hFile=0x218, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.578] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.578] CloseHandle (hObject=0x218) returned 1 [0064.578] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\", lpString2="oskmenubase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" [0064.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.zip") returned 0 [0064.578] lstrlenA (lpString="*.zip") returned 5 [0064.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.rar") returned 0 [0064.578] lstrlenA (lpString="*.rar") returned 5 [0064.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.7z") returned 0 [0064.578] lstrlenA (lpString="*.7z") returned 4 [0064.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.tar") returned 0 [0064.578] lstrlenA (lpString="*.tar") returned 5 [0064.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.gzip") returned 0 [0064.578] lstrlenA (lpString="*.gzip") returned 6 [0064.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.jpg") returned 0 [0064.578] lstrlenA (lpString="*.jpg") returned 5 [0064.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.jpeg") returned 0 [0064.578] lstrlenA (lpString="*.jpeg") returned 6 [0064.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.psd") returned 0 [0064.578] lstrlenA (lpString="*.psd") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.cdr") returned 0 [0064.579] lstrlenA (lpString="*.cdr") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.dwg") returned 0 [0064.579] lstrlenA (lpString="*.dwg") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.max") returned 0 [0064.579] lstrlenA (lpString="*.max") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.bmp") returned 0 [0064.579] lstrlenA (lpString="*.bmp") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.gif") returned 0 [0064.579] lstrlenA (lpString="*.gif") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.png") returned 0 [0064.579] lstrlenA (lpString="*.png") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.doc") returned 0 [0064.579] lstrlenA (lpString="*.doc") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.docx") returned 0 [0064.579] lstrlenA (lpString="*.docx") returned 6 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.xls") returned 0 [0064.579] lstrlenA (lpString="*.xls") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.xlsx") returned 0 [0064.579] lstrlenA (lpString="*.xlsx") returned 6 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.ppt") returned 0 [0064.579] lstrlenA (lpString="*.ppt") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.pptx") returned 0 [0064.579] lstrlenA (lpString="*.pptx") returned 6 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.txt") returned 0 [0064.579] lstrlenA (lpString="*.txt") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.pdf") returned 0 [0064.579] lstrlenA (lpString="*.pdf") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.djvu") returned 0 [0064.579] lstrlenA (lpString="*.djvu") returned 6 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.htm") returned 0 [0064.579] lstrlenA (lpString="*.htm") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.html") returned 0 [0064.579] lstrlenA (lpString="*.html") returned 6 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mdb") returned 0 [0064.579] lstrlenA (lpString="*.mdb") returned 5 [0064.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.cer") returned 0 [0064.580] lstrlenA (lpString="*.cer") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.p12") returned 0 [0064.580] lstrlenA (lpString="*.p12") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.pfx") returned 0 [0064.580] lstrlenA (lpString="*.pfx") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.kwm") returned 0 [0064.580] lstrlenA (lpString="*.kwm") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.pwm") returned 0 [0064.580] lstrlenA (lpString="*.pwm") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.1cd") returned 0 [0064.580] lstrlenA (lpString="*.1cd") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.md") returned 0 [0064.580] lstrlenA (lpString="*.md") returned 4 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mdf") returned 0 [0064.580] lstrlenA (lpString="*.mdf") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.dbf") returned 0 [0064.580] lstrlenA (lpString="*.dbf") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.odt") returned 0 [0064.580] lstrlenA (lpString="*.odt") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.vob") returned 0 [0064.580] lstrlenA (lpString="*.vob") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.ifo") returned 0 [0064.580] lstrlenA (lpString="*.ifo") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.lnk") returned 0 [0064.580] lstrlenA (lpString="*.lnk") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.torrent") returned 0 [0064.580] lstrlenA (lpString="*.torrent") returned 9 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mov") returned 0 [0064.580] lstrlenA (lpString="*.mov") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.m2v") returned 0 [0064.580] lstrlenA (lpString="*.m2v") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.3gp") returned 0 [0064.580] lstrlenA (lpString="*.3gp") returned 5 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mpeg") returned 0 [0064.580] lstrlenA (lpString="*.mpeg") returned 6 [0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mpg") returned 0 [0064.580] lstrlenA (lpString="*.mpg") returned 5 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.flv") returned 0 [0064.581] lstrlenA (lpString="*.flv") returned 5 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.avi") returned 0 [0064.581] lstrlenA (lpString="*.avi") returned 5 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mp4") returned 0 [0064.581] lstrlenA (lpString="*.mp4") returned 5 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.wmv") returned 0 [0064.581] lstrlenA (lpString="*.wmv") returned 5 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.divx") returned 0 [0064.581] lstrlenA (lpString="*.divx") returned 6 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mkv") returned 0 [0064.581] lstrlenA (lpString="*.mkv") returned 5 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.mp3") returned 0 [0064.581] lstrlenA (lpString="*.mp3") returned 5 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.wav") returned 0 [0064.581] lstrlenA (lpString="*.wav") returned 5 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.flac") returned 0 [0064.581] lstrlenA (lpString="*.flac") returned 6 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.ape") returned 0 [0064.581] lstrlenA (lpString="*.ape") returned 5 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.wma") returned 0 [0064.581] lstrlenA (lpString="*.wma") returned 5 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.ac3") returned 0 [0064.581] lstrlenA (lpString="*.ac3") returned 5 [0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", pszSpec="*.doc") returned 0 [0064.581] lstrlenA (lpString="*.doc") returned 5 [0064.581] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0064.581] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0064.581] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0064.581] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.581] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskmenu.xml") returned -1 [0064.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskmenu.xml") returned -1 [0064.582] lstrcmpiA (lpString1="", lpString2="oskmenu.xml") returned -1 [0064.582] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0064.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0064.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0064.582] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0064.582] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0064.582] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="oskmenu.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" [0064.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.zip") returned 0 [0064.582] lstrlenA (lpString="*.zip") returned 5 [0064.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.rar") returned 0 [0064.582] lstrlenA (lpString="*.rar") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.7z") returned 0 [0064.583] lstrlenA (lpString="*.7z") returned 4 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.tar") returned 0 [0064.583] lstrlenA (lpString="*.tar") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.gzip") returned 0 [0064.583] lstrlenA (lpString="*.gzip") returned 6 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.jpg") returned 0 [0064.583] lstrlenA (lpString="*.jpg") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.jpeg") returned 0 [0064.583] lstrlenA (lpString="*.jpeg") returned 6 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.psd") returned 0 [0064.583] lstrlenA (lpString="*.psd") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.cdr") returned 0 [0064.583] lstrlenA (lpString="*.cdr") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.dwg") returned 0 [0064.583] lstrlenA (lpString="*.dwg") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.max") returned 0 [0064.583] lstrlenA (lpString="*.max") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.bmp") returned 0 [0064.583] lstrlenA (lpString="*.bmp") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.gif") returned 0 [0064.583] lstrlenA (lpString="*.gif") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.png") returned 0 [0064.583] lstrlenA (lpString="*.png") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.doc") returned 0 [0064.583] lstrlenA (lpString="*.doc") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.docx") returned 0 [0064.583] lstrlenA (lpString="*.docx") returned 6 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.xls") returned 0 [0064.583] lstrlenA (lpString="*.xls") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.xlsx") returned 0 [0064.583] lstrlenA (lpString="*.xlsx") returned 6 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.ppt") returned 0 [0064.583] lstrlenA (lpString="*.ppt") returned 5 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.pptx") returned 0 [0064.583] lstrlenA (lpString="*.pptx") returned 6 [0064.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.txt") returned 0 [0064.583] lstrlenA (lpString="*.txt") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.pdf") returned 0 [0064.584] lstrlenA (lpString="*.pdf") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.djvu") returned 0 [0064.584] lstrlenA (lpString="*.djvu") returned 6 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.htm") returned 0 [0064.584] lstrlenA (lpString="*.htm") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.html") returned 0 [0064.584] lstrlenA (lpString="*.html") returned 6 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mdb") returned 0 [0064.584] lstrlenA (lpString="*.mdb") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.cer") returned 0 [0064.584] lstrlenA (lpString="*.cer") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.p12") returned 0 [0064.584] lstrlenA (lpString="*.p12") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.pfx") returned 0 [0064.584] lstrlenA (lpString="*.pfx") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.kwm") returned 0 [0064.584] lstrlenA (lpString="*.kwm") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.pwm") returned 0 [0064.584] lstrlenA (lpString="*.pwm") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.1cd") returned 0 [0064.584] lstrlenA (lpString="*.1cd") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.md") returned 0 [0064.584] lstrlenA (lpString="*.md") returned 4 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mdf") returned 0 [0064.584] lstrlenA (lpString="*.mdf") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.dbf") returned 0 [0064.584] lstrlenA (lpString="*.dbf") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.odt") returned 0 [0064.584] lstrlenA (lpString="*.odt") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.vob") returned 0 [0064.584] lstrlenA (lpString="*.vob") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.ifo") returned 0 [0064.584] lstrlenA (lpString="*.ifo") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.lnk") returned 0 [0064.584] lstrlenA (lpString="*.lnk") returned 5 [0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.torrent") returned 0 [0064.585] lstrlenA (lpString="*.torrent") returned 9 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mov") returned 0 [0064.585] lstrlenA (lpString="*.mov") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.m2v") returned 0 [0064.585] lstrlenA (lpString="*.m2v") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.3gp") returned 0 [0064.585] lstrlenA (lpString="*.3gp") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mpeg") returned 0 [0064.585] lstrlenA (lpString="*.mpeg") returned 6 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mpg") returned 0 [0064.585] lstrlenA (lpString="*.mpg") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.flv") returned 0 [0064.585] lstrlenA (lpString="*.flv") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.avi") returned 0 [0064.585] lstrlenA (lpString="*.avi") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mp4") returned 0 [0064.585] lstrlenA (lpString="*.mp4") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.wmv") returned 0 [0064.585] lstrlenA (lpString="*.wmv") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.divx") returned 0 [0064.585] lstrlenA (lpString="*.divx") returned 6 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mkv") returned 0 [0064.585] lstrlenA (lpString="*.mkv") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.mp3") returned 0 [0064.585] lstrlenA (lpString="*.mp3") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.wav") returned 0 [0064.585] lstrlenA (lpString="*.wav") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.flac") returned 0 [0064.585] lstrlenA (lpString="*.flac") returned 6 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.ape") returned 0 [0064.585] lstrlenA (lpString="*.ape") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.wma") returned 0 [0064.585] lstrlenA (lpString="*.wma") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.ac3") returned 0 [0064.585] lstrlenA (lpString="*.ac3") returned 5 [0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", pszSpec="*.doc") returned 0 [0064.585] lstrlenA (lpString="*.doc") returned 5 [0064.586] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="osknav", cAlternateFileName="")) returned 1 [0064.586] lstrcmpA (lpString1=".", lpString2="osknav") returned -1 [0064.586] lstrcmpA (lpString1="..", lpString2="osknav") returned -1 [0064.586] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned="oskmenu.xml" [0064.586] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="osknav" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav" [0064.586] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav") returned 71 [0064.586] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName=".", cAlternateFileName="")) returned 0x75a010 [0064.586] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.586] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="..", cAlternateFileName="")) returned 1 [0064.586] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.586] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.586] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="osknavbase.xml", cAlternateFileName="")) returned 1 [0064.586] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osknavbase.xml") returned -1 [0064.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknavbase.xml") returned -1 [0064.586] lstrcmpiA (lpString1="", lpString2="osknavbase.xml") returned -1 [0064.586] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*.*") returned="*.*" [0064.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\" [0064.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\") returned="" [0064.586] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\HOW TO DECRYPT FILES.txt" [0064.586] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\how to decrypt files.txt")) returned 0xffffffff [0064.586] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0064.587] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.587] WriteFile (in: hFile=0x218, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.589] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.589] CloseHandle (hObject=0x218) returned 1 [0064.589] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\", lpString2="osknavbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" [0064.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.zip") returned 0 [0064.589] lstrlenA (lpString="*.zip") returned 5 [0064.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.rar") returned 0 [0064.589] lstrlenA (lpString="*.rar") returned 5 [0064.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.7z") returned 0 [0064.589] lstrlenA (lpString="*.7z") returned 4 [0064.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.tar") returned 0 [0064.589] lstrlenA (lpString="*.tar") returned 5 [0064.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.gzip") returned 0 [0064.589] lstrlenA (lpString="*.gzip") returned 6 [0064.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.jpg") returned 0 [0064.589] lstrlenA (lpString="*.jpg") returned 5 [0064.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.jpeg") returned 0 [0064.589] lstrlenA (lpString="*.jpeg") returned 6 [0064.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.psd") returned 0 [0064.589] lstrlenA (lpString="*.psd") returned 5 [0064.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.cdr") returned 0 [0064.589] lstrlenA (lpString="*.cdr") returned 5 [0064.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.dwg") returned 0 [0064.589] lstrlenA (lpString="*.dwg") returned 5 [0064.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.max") returned 0 [0064.589] lstrlenA (lpString="*.max") returned 5 [0064.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.bmp") returned 0 [0064.589] lstrlenA (lpString="*.bmp") returned 5 [0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.gif") returned 0 [0064.590] lstrlenA (lpString="*.gif") returned 5 [0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.png") returned 0 [0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.doc") returned 0 [0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.docx") returned 0 [0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.xls") returned 0 [0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", pszSpec="*.xlsx") returned 0 [0064.590] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="osknavbase.xml", cAlternateFileName="")) returned 0 [0064.590] FindClose (in: hFindFile=0x75a010 | out: hFindFile=0x75a010) returned 1 [0064.590] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0064.590] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.590] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osknav.xml") returned -1 [0064.590] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknav.xml") returned -1 [0064.590] lstrcmpiA (lpString1="", lpString2="osknav.xml") returned -1 [0064.590] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0064.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0064.590] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0064.590] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0064.590] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0064.591] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="osknav.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" [0064.591] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0064.591] lstrcmpA (lpString1=".", lpString2="osknumpad") returned -1 [0064.591] lstrcmpA (lpString1="..", lpString2="osknumpad") returned -1 [0064.591] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned="osknav.xml" [0064.591] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="osknumpad" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad" [0064.591] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName=".", cAlternateFileName="")) returned 0x75a010 [0064.591] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.591] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="..", cAlternateFileName="")) returned 1 [0064.591] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.591] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.591] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0064.591] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.591] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osknumpadbase.xml") returned -1 [0064.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknumpadbase.xml") returned -1 [0064.591] lstrcmpiA (lpString1="", lpString2="osknumpadbase.xml") returned -1 [0064.591] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*.*") returned="*.*" [0064.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\" [0064.591] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned="" [0064.591] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt" [0064.591] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\how to decrypt files.txt")) returned 0xffffffff [0064.591] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0064.592] WriteFile (in: hFile=0x218, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.597] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.597] CloseHandle (hObject=0x218) returned 1 [0064.598] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\", lpString2="osknumpadbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" [0064.598] lstrlenA (lpString="*.zip") returned 5 [0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.rar") returned 0 [0064.598] lstrlenA (lpString="*.rar") returned 5 [0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.7z") returned 0 [0064.598] lstrlenA (lpString="*.7z") returned 4 [0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.tar") returned 0 [0064.598] lstrlenA (lpString="*.tar") returned 5 [0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.gzip") returned 0 [0064.599] lstrlenA (lpString="*.gzip") returned 6 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.jpg") returned 0 [0064.599] lstrlenA (lpString="*.jpg") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.jpeg") returned 0 [0064.599] lstrlenA (lpString="*.jpeg") returned 6 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.psd") returned 0 [0064.599] lstrlenA (lpString="*.psd") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.cdr") returned 0 [0064.599] lstrlenA (lpString="*.cdr") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.dwg") returned 0 [0064.599] lstrlenA (lpString="*.dwg") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.max") returned 0 [0064.599] lstrlenA (lpString="*.max") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.bmp") returned 0 [0064.599] lstrlenA (lpString="*.bmp") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.gif") returned 0 [0064.599] lstrlenA (lpString="*.gif") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.png") returned 0 [0064.599] lstrlenA (lpString="*.png") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.doc") returned 0 [0064.599] lstrlenA (lpString="*.doc") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.docx") returned 0 [0064.599] lstrlenA (lpString="*.docx") returned 6 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.xls") returned 0 [0064.599] lstrlenA (lpString="*.xls") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.xlsx") returned 0 [0064.599] lstrlenA (lpString="*.xlsx") returned 6 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.ppt") returned 0 [0064.599] lstrlenA (lpString="*.ppt") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.pptx") returned 0 [0064.599] lstrlenA (lpString="*.pptx") returned 6 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.txt") returned 0 [0064.599] lstrlenA (lpString="*.txt") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.pdf") returned 0 [0064.599] lstrlenA (lpString="*.pdf") returned 5 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.djvu") returned 0 [0064.599] lstrlenA (lpString="*.djvu") returned 6 [0064.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.htm") returned 0 [0064.600] lstrlenA (lpString="*.htm") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.html") returned 0 [0064.600] lstrlenA (lpString="*.html") returned 6 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mdb") returned 0 [0064.600] lstrlenA (lpString="*.mdb") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.cer") returned 0 [0064.600] lstrlenA (lpString="*.cer") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.p12") returned 0 [0064.600] lstrlenA (lpString="*.p12") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.pfx") returned 0 [0064.600] lstrlenA (lpString="*.pfx") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.kwm") returned 0 [0064.600] lstrlenA (lpString="*.kwm") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.pwm") returned 0 [0064.600] lstrlenA (lpString="*.pwm") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.1cd") returned 0 [0064.600] lstrlenA (lpString="*.1cd") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.md") returned 0 [0064.600] lstrlenA (lpString="*.md") returned 4 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mdf") returned 0 [0064.600] lstrlenA (lpString="*.mdf") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.dbf") returned 0 [0064.600] lstrlenA (lpString="*.dbf") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.odt") returned 0 [0064.600] lstrlenA (lpString="*.odt") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.vob") returned 0 [0064.600] lstrlenA (lpString="*.vob") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.ifo") returned 0 [0064.600] lstrlenA (lpString="*.ifo") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.lnk") returned 0 [0064.600] lstrlenA (lpString="*.lnk") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.torrent") returned 0 [0064.600] lstrlenA (lpString="*.torrent") returned 9 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mov") returned 0 [0064.600] lstrlenA (lpString="*.mov") returned 5 [0064.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.m2v") returned 0 [0064.600] lstrlenA (lpString="*.m2v") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.3gp") returned 0 [0064.601] lstrlenA (lpString="*.3gp") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mpeg") returned 0 [0064.601] lstrlenA (lpString="*.mpeg") returned 6 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mpg") returned 0 [0064.601] lstrlenA (lpString="*.mpg") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.flv") returned 0 [0064.601] lstrlenA (lpString="*.flv") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.avi") returned 0 [0064.601] lstrlenA (lpString="*.avi") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mp4") returned 0 [0064.601] lstrlenA (lpString="*.mp4") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.wmv") returned 0 [0064.601] lstrlenA (lpString="*.wmv") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.divx") returned 0 [0064.601] lstrlenA (lpString="*.divx") returned 6 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mkv") returned 0 [0064.601] lstrlenA (lpString="*.mkv") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.mp3") returned 0 [0064.601] lstrlenA (lpString="*.mp3") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.wav") returned 0 [0064.601] lstrlenA (lpString="*.wav") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.flac") returned 0 [0064.601] lstrlenA (lpString="*.flac") returned 6 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.ape") returned 0 [0064.601] lstrlenA (lpString="*.ape") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.wma") returned 0 [0064.601] lstrlenA (lpString="*.wma") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.ac3") returned 0 [0064.601] lstrlenA (lpString="*.ac3") returned 5 [0064.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", pszSpec="*.doc") returned 0 [0064.601] lstrlenA (lpString="*.doc") returned 5 [0064.601] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0064.601] FindClose (in: hFindFile=0x75a010 | out: hFindFile=0x75a010) returned 1 [0064.604] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0064.604] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.604] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osknumpad.xml") returned -1 [0064.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknumpad.xml") returned -1 [0064.604] lstrcmpiA (lpString1="", lpString2="osknumpad.xml") returned -1 [0064.604] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0064.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0064.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0064.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0064.604] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0064.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="osknumpad.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.zip") returned 0 [0064.605] lstrlenA (lpString="*.zip") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.rar") returned 0 [0064.605] lstrlenA (lpString="*.rar") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.7z") returned 0 [0064.605] lstrlenA (lpString="*.7z") returned 4 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.tar") returned 0 [0064.605] lstrlenA (lpString="*.tar") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.gzip") returned 0 [0064.605] lstrlenA (lpString="*.gzip") returned 6 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.jpg") returned 0 [0064.605] lstrlenA (lpString="*.jpg") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.jpeg") returned 0 [0064.605] lstrlenA (lpString="*.jpeg") returned 6 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.psd") returned 0 [0064.605] lstrlenA (lpString="*.psd") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.cdr") returned 0 [0064.605] lstrlenA (lpString="*.cdr") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.dwg") returned 0 [0064.605] lstrlenA (lpString="*.dwg") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.max") returned 0 [0064.605] lstrlenA (lpString="*.max") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.bmp") returned 0 [0064.605] lstrlenA (lpString="*.bmp") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.gif") returned 0 [0064.605] lstrlenA (lpString="*.gif") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.png") returned 0 [0064.605] lstrlenA (lpString="*.png") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.doc") returned 0 [0064.605] lstrlenA (lpString="*.doc") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.docx") returned 0 [0064.605] lstrlenA (lpString="*.docx") returned 6 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.xls") returned 0 [0064.605] lstrlenA (lpString="*.xls") returned 5 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.xlsx") returned 0 [0064.605] lstrlenA (lpString="*.xlsx") returned 6 [0064.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.ppt") returned 0 [0064.606] lstrlenA (lpString="*.ppt") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.pptx") returned 0 [0064.606] lstrlenA (lpString="*.pptx") returned 6 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.txt") returned 0 [0064.606] lstrlenA (lpString="*.txt") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.pdf") returned 0 [0064.606] lstrlenA (lpString="*.pdf") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.djvu") returned 0 [0064.606] lstrlenA (lpString="*.djvu") returned 6 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.htm") returned 0 [0064.606] lstrlenA (lpString="*.htm") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.html") returned 0 [0064.606] lstrlenA (lpString="*.html") returned 6 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mdb") returned 0 [0064.606] lstrlenA (lpString="*.mdb") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.cer") returned 0 [0064.606] lstrlenA (lpString="*.cer") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.p12") returned 0 [0064.606] lstrlenA (lpString="*.p12") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.pfx") returned 0 [0064.606] lstrlenA (lpString="*.pfx") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.kwm") returned 0 [0064.606] lstrlenA (lpString="*.kwm") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.pwm") returned 0 [0064.606] lstrlenA (lpString="*.pwm") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.1cd") returned 0 [0064.606] lstrlenA (lpString="*.1cd") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.md") returned 0 [0064.606] lstrlenA (lpString="*.md") returned 4 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mdf") returned 0 [0064.606] lstrlenA (lpString="*.mdf") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.dbf") returned 0 [0064.606] lstrlenA (lpString="*.dbf") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.odt") returned 0 [0064.606] lstrlenA (lpString="*.odt") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.vob") returned 0 [0064.606] lstrlenA (lpString="*.vob") returned 5 [0064.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.ifo") returned 0 [0064.607] lstrlenA (lpString="*.ifo") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.lnk") returned 0 [0064.607] lstrlenA (lpString="*.lnk") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.torrent") returned 0 [0064.607] lstrlenA (lpString="*.torrent") returned 9 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mov") returned 0 [0064.607] lstrlenA (lpString="*.mov") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.m2v") returned 0 [0064.607] lstrlenA (lpString="*.m2v") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.3gp") returned 0 [0064.607] lstrlenA (lpString="*.3gp") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mpeg") returned 0 [0064.607] lstrlenA (lpString="*.mpeg") returned 6 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mpg") returned 0 [0064.607] lstrlenA (lpString="*.mpg") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.flv") returned 0 [0064.607] lstrlenA (lpString="*.flv") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.avi") returned 0 [0064.607] lstrlenA (lpString="*.avi") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mp4") returned 0 [0064.607] lstrlenA (lpString="*.mp4") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.wmv") returned 0 [0064.607] lstrlenA (lpString="*.wmv") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.divx") returned 0 [0064.607] lstrlenA (lpString="*.divx") returned 6 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mkv") returned 0 [0064.607] lstrlenA (lpString="*.mkv") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.mp3") returned 0 [0064.607] lstrlenA (lpString="*.mp3") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.wav") returned 0 [0064.607] lstrlenA (lpString="*.wav") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.flac") returned 0 [0064.607] lstrlenA (lpString="*.flac") returned 6 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.ape") returned 0 [0064.607] lstrlenA (lpString="*.ape") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.wma") returned 0 [0064.607] lstrlenA (lpString="*.wma") returned 5 [0064.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.ac3") returned 0 [0064.608] lstrlenA (lpString="*.ac3") returned 5 [0064.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", pszSpec="*.doc") returned 0 [0064.608] lstrlenA (lpString="*.doc") returned 5 [0064.608] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="oskpred", cAlternateFileName="")) returned 1 [0064.608] lstrcmpA (lpString1=".", lpString2="oskpred") returned -1 [0064.608] lstrcmpA (lpString1="..", lpString2="oskpred") returned -1 [0064.608] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned="osknumpad.xml" [0064.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="oskpred" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred" [0064.608] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred") returned 72 [0064.608] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0064.608] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.608] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="..", cAlternateFileName="")) returned 1 [0064.608] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.608] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.608] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0064.608] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.608] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskpredbase.xml") returned -1 [0064.608] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskpredbase.xml") returned -1 [0064.608] lstrcmpiA (lpString1="", lpString2="oskpredbase.xml") returned -1 [0064.608] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*.*") returned="*.*" [0064.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\" [0064.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned="" [0064.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt" [0064.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\how to decrypt files.txt")) returned 0xffffffff [0064.608] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0064.609] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.609] WriteFile (in: hFile=0x218, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.610] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.610] CloseHandle (hObject=0x218) returned 1 [0064.610] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\", lpString2="oskpredbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" [0064.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.zip") returned 0 [0064.610] lstrlenA (lpString="*.zip") returned 5 [0064.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.rar") returned 0 [0064.610] lstrlenA (lpString="*.rar") returned 5 [0064.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.7z") returned 0 [0064.610] lstrlenA (lpString="*.7z") returned 4 [0064.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.tar") returned 0 [0064.610] lstrlenA (lpString="*.tar") returned 5 [0064.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.gzip") returned 0 [0064.610] lstrlenA (lpString="*.gzip") returned 6 [0064.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.jpg") returned 0 [0064.610] lstrlenA (lpString="*.jpg") returned 5 [0064.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.jpeg") returned 0 [0064.610] lstrlenA (lpString="*.jpeg") returned 6 [0064.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.psd") returned 0 [0064.610] lstrlenA (lpString="*.psd") returned 5 [0064.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.cdr") returned 0 [0064.611] lstrlenA (lpString="*.cdr") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.dwg") returned 0 [0064.611] lstrlenA (lpString="*.dwg") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.max") returned 0 [0064.611] lstrlenA (lpString="*.max") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.bmp") returned 0 [0064.611] lstrlenA (lpString="*.bmp") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.gif") returned 0 [0064.611] lstrlenA (lpString="*.gif") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.png") returned 0 [0064.611] lstrlenA (lpString="*.png") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.doc") returned 0 [0064.611] lstrlenA (lpString="*.doc") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.docx") returned 0 [0064.611] lstrlenA (lpString="*.docx") returned 6 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.xls") returned 0 [0064.611] lstrlenA (lpString="*.xls") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.xlsx") returned 0 [0064.611] lstrlenA (lpString="*.xlsx") returned 6 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.ppt") returned 0 [0064.611] lstrlenA (lpString="*.ppt") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.pptx") returned 0 [0064.611] lstrlenA (lpString="*.pptx") returned 6 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.txt") returned 0 [0064.611] lstrlenA (lpString="*.txt") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.pdf") returned 0 [0064.611] lstrlenA (lpString="*.pdf") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.djvu") returned 0 [0064.611] lstrlenA (lpString="*.djvu") returned 6 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.htm") returned 0 [0064.611] lstrlenA (lpString="*.htm") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.html") returned 0 [0064.611] lstrlenA (lpString="*.html") returned 6 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mdb") returned 0 [0064.611] lstrlenA (lpString="*.mdb") returned 5 [0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.cer") returned 0 [0064.611] lstrlenA (lpString="*.cer") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.p12") returned 0 [0064.612] lstrlenA (lpString="*.p12") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.pfx") returned 0 [0064.612] lstrlenA (lpString="*.pfx") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.kwm") returned 0 [0064.612] lstrlenA (lpString="*.kwm") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.pwm") returned 0 [0064.612] lstrlenA (lpString="*.pwm") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.1cd") returned 0 [0064.612] lstrlenA (lpString="*.1cd") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.md") returned 0 [0064.612] lstrlenA (lpString="*.md") returned 4 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mdf") returned 0 [0064.612] lstrlenA (lpString="*.mdf") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.dbf") returned 0 [0064.612] lstrlenA (lpString="*.dbf") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.odt") returned 0 [0064.612] lstrlenA (lpString="*.odt") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.vob") returned 0 [0064.612] lstrlenA (lpString="*.vob") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.ifo") returned 0 [0064.612] lstrlenA (lpString="*.ifo") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.lnk") returned 0 [0064.612] lstrlenA (lpString="*.lnk") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.torrent") returned 0 [0064.612] lstrlenA (lpString="*.torrent") returned 9 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mov") returned 0 [0064.612] lstrlenA (lpString="*.mov") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.m2v") returned 0 [0064.612] lstrlenA (lpString="*.m2v") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.3gp") returned 0 [0064.612] lstrlenA (lpString="*.3gp") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mpeg") returned 0 [0064.612] lstrlenA (lpString="*.mpeg") returned 6 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mpg") returned 0 [0064.612] lstrlenA (lpString="*.mpg") returned 5 [0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.flv") returned 0 [0064.612] lstrlenA (lpString="*.flv") returned 5 [0064.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.avi") returned 0 [0064.613] lstrlenA (lpString="*.avi") returned 5 [0064.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mp4") returned 0 [0064.613] lstrlenA (lpString="*.mp4") returned 5 [0064.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.wmv") returned 0 [0064.613] lstrlenA (lpString="*.wmv") returned 5 [0064.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.divx") returned 0 [0064.613] lstrlenA (lpString="*.divx") returned 6 [0064.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mkv") returned 0 [0064.613] lstrlenA (lpString="*.mkv") returned 5 [0064.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.mp3") returned 0 [0064.614] lstrlenA (lpString="*.mp3") returned 5 [0064.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.wav") returned 0 [0064.614] lstrlenA (lpString="*.wav") returned 5 [0064.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.flac") returned 0 [0064.614] lstrlenA (lpString="*.flac") returned 6 [0064.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.ape") returned 0 [0064.614] lstrlenA (lpString="*.ape") returned 5 [0064.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.wma") returned 0 [0064.614] lstrlenA (lpString="*.wma") returned 5 [0064.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.ac3") returned 0 [0064.614] lstrlenA (lpString="*.ac3") returned 5 [0064.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", pszSpec="*.doc") returned 0 [0064.614] lstrlenA (lpString="*.doc") returned 5 [0064.614] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0064.614] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0064.614] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x75e210, dwReserved1=0x7400c0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0064.614] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.614] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskpred.xml") returned -1 [0064.614] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskpred.xml") returned -1 [0064.614] lstrcmpiA (lpString1="", lpString2="oskpred.xml") returned -1 [0064.614] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0064.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0064.615] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0064.615] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0064.615] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0064.615] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="oskpred.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.zip") returned 0 [0064.615] lstrlenA (lpString="*.zip") returned 5 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.rar") returned 0 [0064.615] lstrlenA (lpString="*.rar") returned 5 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.7z") returned 0 [0064.615] lstrlenA (lpString="*.7z") returned 4 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.tar") returned 0 [0064.615] lstrlenA (lpString="*.tar") returned 5 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.gzip") returned 0 [0064.615] lstrlenA (lpString="*.gzip") returned 6 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.jpg") returned 0 [0064.615] lstrlenA (lpString="*.jpg") returned 5 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.jpeg") returned 0 [0064.615] lstrlenA (lpString="*.jpeg") returned 6 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.psd") returned 0 [0064.615] lstrlenA (lpString="*.psd") returned 5 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.cdr") returned 0 [0064.615] lstrlenA (lpString="*.cdr") returned 5 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.dwg") returned 0 [0064.615] lstrlenA (lpString="*.dwg") returned 5 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.max") returned 0 [0064.615] lstrlenA (lpString="*.max") returned 5 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.bmp") returned 0 [0064.615] lstrlenA (lpString="*.bmp") returned 5 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.gif") returned 0 [0064.615] lstrlenA (lpString="*.gif") returned 5 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.png") returned 0 [0064.615] lstrlenA (lpString="*.png") returned 5 [0064.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.doc") returned 0 [0064.616] lstrlenA (lpString="*.doc") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.docx") returned 0 [0064.616] lstrlenA (lpString="*.docx") returned 6 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.xls") returned 0 [0064.616] lstrlenA (lpString="*.xls") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.xlsx") returned 0 [0064.616] lstrlenA (lpString="*.xlsx") returned 6 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.ppt") returned 0 [0064.616] lstrlenA (lpString="*.ppt") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.pptx") returned 0 [0064.616] lstrlenA (lpString="*.pptx") returned 6 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.txt") returned 0 [0064.616] lstrlenA (lpString="*.txt") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.pdf") returned 0 [0064.616] lstrlenA (lpString="*.pdf") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.djvu") returned 0 [0064.616] lstrlenA (lpString="*.djvu") returned 6 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.htm") returned 0 [0064.616] lstrlenA (lpString="*.htm") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.html") returned 0 [0064.616] lstrlenA (lpString="*.html") returned 6 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mdb") returned 0 [0064.616] lstrlenA (lpString="*.mdb") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.cer") returned 0 [0064.616] lstrlenA (lpString="*.cer") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.p12") returned 0 [0064.616] lstrlenA (lpString="*.p12") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.pfx") returned 0 [0064.616] lstrlenA (lpString="*.pfx") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.kwm") returned 0 [0064.616] lstrlenA (lpString="*.kwm") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.pwm") returned 0 [0064.616] lstrlenA (lpString="*.pwm") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.1cd") returned 0 [0064.616] lstrlenA (lpString="*.1cd") returned 5 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.md") returned 0 [0064.616] lstrlenA (lpString="*.md") returned 4 [0064.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mdf") returned 0 [0064.617] lstrlenA (lpString="*.mdf") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.dbf") returned 0 [0064.617] lstrlenA (lpString="*.dbf") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.odt") returned 0 [0064.617] lstrlenA (lpString="*.odt") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.vob") returned 0 [0064.617] lstrlenA (lpString="*.vob") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.ifo") returned 0 [0064.617] lstrlenA (lpString="*.ifo") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.lnk") returned 0 [0064.617] lstrlenA (lpString="*.lnk") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.torrent") returned 0 [0064.617] lstrlenA (lpString="*.torrent") returned 9 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mov") returned 0 [0064.617] lstrlenA (lpString="*.mov") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.m2v") returned 0 [0064.617] lstrlenA (lpString="*.m2v") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.3gp") returned 0 [0064.617] lstrlenA (lpString="*.3gp") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mpeg") returned 0 [0064.617] lstrlenA (lpString="*.mpeg") returned 6 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mpg") returned 0 [0064.617] lstrlenA (lpString="*.mpg") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.flv") returned 0 [0064.617] lstrlenA (lpString="*.flv") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.avi") returned 0 [0064.617] lstrlenA (lpString="*.avi") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mp4") returned 0 [0064.617] lstrlenA (lpString="*.mp4") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.wmv") returned 0 [0064.617] lstrlenA (lpString="*.wmv") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.divx") returned 0 [0064.617] lstrlenA (lpString="*.divx") returned 6 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mkv") returned 0 [0064.617] lstrlenA (lpString="*.mkv") returned 5 [0064.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.mp3") returned 0 [0064.617] lstrlenA (lpString="*.mp3") returned 5 [0064.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.wav") returned 0 [0064.618] lstrlenA (lpString="*.wav") returned 5 [0064.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.flac") returned 0 [0064.618] lstrlenA (lpString="*.flac") returned 6 [0064.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.ape") returned 0 [0064.618] lstrlenA (lpString="*.ape") returned 5 [0064.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.wma") returned 0 [0064.618] lstrlenA (lpString="*.wma") returned 5 [0064.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.ac3") returned 0 [0064.618] lstrlenA (lpString="*.ac3") returned 5 [0064.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", pszSpec="*.doc") returned 0 [0064.618] lstrlenA (lpString="*.doc") returned 5 [0064.618] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="symbols", cAlternateFileName="")) returned 1 [0064.618] lstrcmpA (lpString1=".", lpString2="symbols") returned -1 [0064.618] lstrcmpA (lpString1="..", lpString2="symbols") returned -1 [0064.618] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned="oskpred.xml" [0064.618] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="symbols" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols" [0064.618] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols") returned 72 [0064.618] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0064.619] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.619] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="..", cAlternateFileName="")) returned 1 [0064.619] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.619] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.619] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x740000, dwReserved1=0xc8, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0064.619] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.619] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ea-sym.xml") returned -1 [0064.619] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ea-sym.xml") returned 1 [0064.619] lstrcmpiA (lpString1="", lpString2="ea-sym.xml") returned -1 [0064.619] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*.*") returned="*.*" [0064.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" [0064.619] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned="" [0064.619] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" [0064.619] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt")) returned 0xffffffff [0064.619] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0064.620] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.620] WriteFile (in: hFile=0x218, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.621] SetFileTime (hFile=0x218, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.621] CloseHandle (hObject=0x218) returned 1 [0064.621] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", lpString2="ea-sym.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" [0064.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.zip") returned 0 [0064.621] lstrlenA (lpString="*.zip") returned 5 [0064.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.rar") returned 0 [0064.621] lstrlenA (lpString="*.rar") returned 5 [0064.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.7z") returned 0 [0064.621] lstrlenA (lpString="*.7z") returned 4 [0064.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.tar") returned 0 [0064.621] lstrlenA (lpString="*.tar") returned 5 [0064.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.gzip") returned 0 [0064.621] lstrlenA (lpString="*.gzip") returned 6 [0064.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.jpg") returned 0 [0064.622] lstrlenA (lpString="*.jpg") returned 5 [0064.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.jpeg") returned 0 [0064.622] lstrlenA (lpString="*.jpeg") returned 6 [0064.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.psd") returned 0 [0064.622] lstrlenA (lpString="*.psd") returned 5 [0064.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.cdr") returned 0 [0064.622] lstrlenA (lpString="*.cdr") returned 5 [0064.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.dwg") returned 0 [0064.622] lstrlenA (lpString="*.dwg") returned 5 [0064.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.max") returned 0 [0064.622] lstrlenA (lpString="*.max") returned 5 [0064.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.bmp") returned 0 [0064.622] lstrlenA (lpString="*.bmp") returned 5 [0064.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.gif") returned 0 [0064.622] lstrlenA (lpString="*.gif") returned 5 [0064.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.png") returned 0 [0064.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.doc") returned 0 [0064.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.docx") returned 0 [0064.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.xls") returned 0 [0064.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", pszSpec="*.xlsx") returned 0 [0064.622] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0064.622] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.622] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ja-jp-sym.xml") returned -1 [0064.622] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja-jp-sym.xml") returned -1 [0064.622] lstrcmpiA (lpString1="", lpString2="ja-jp-sym.xml") returned -1 [0064.623] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned="ea-sym.xml" [0064.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" [0064.623] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned="" [0064.623] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" [0064.623] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt")) returned 0x20 [0064.623] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", lpString2="ja-jp-sym.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" [0064.623] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0064.623] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.623] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="symbase.xml") returned -1 [0064.623] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="symbase.xml") returned -1 [0064.623] lstrcmpiA (lpString1="", lpString2="symbase.xml") returned -1 [0064.623] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned="ja-jp-sym.xml" [0064.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" [0064.623] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned="" [0064.623] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" [0064.623] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt")) returned 0x20 [0064.623] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", lpString2="symbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" [0064.623] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f650 | out: lpFindFileData=0x19f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0064.623] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0064.623] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x75cec8, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0064.623] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.623] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="symbols.xml") returned -1 [0064.623] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="symbols.xml") returned -1 [0064.623] lstrcmpiA (lpString1="", lpString2="symbols.xml") returned -1 [0064.624] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0064.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" [0064.624] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned="" [0064.624] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0064.624] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0064.624] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", lpString2="symbols.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" [0064.624] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x75cec8, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 0 [0064.624] FindClose (in: hFindFile=0x759fd0 | out: hFindFile=0x759fd0) returned 1 [0064.624] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75cec8, dwReserved1=0x7400c0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0064.624] lstrcmpA (lpString1=".", lpString2="he-IL") returned -1 [0064.624] lstrcmpA (lpString1="..", lpString2="he-IL") returned -1 [0064.624] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.624] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="he-IL" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL" [0064.624] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName=".", cAlternateFileName="")) returned 0x759ed0 [0064.624] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.624] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="..", cAlternateFileName="")) returned 1 [0064.624] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.624] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.624] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.624] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.624] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.624] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.624] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.625] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*.*") returned="*.*" [0064.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\" [0064.625] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\") returned="" [0064.625] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt" [0064.625] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\how to decrypt files.txt")) returned 0xffffffff [0064.625] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.625] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.626] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.626] CloseHandle (hObject=0x214) returned 1 [0064.626] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" [0064.626] lstrlenA (lpString="*.zip") returned 5 [0064.626] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.626] lstrlenA (lpString="*.rar") returned 5 [0064.626] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.626] lstrlenA (lpString="*.7z") returned 4 [0064.626] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.626] lstrlenA (lpString="*.tar") returned 5 [0064.626] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.627] lstrlenA (lpString="*.gzip") returned 6 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.627] lstrlenA (lpString="*.jpg") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.627] lstrlenA (lpString="*.jpeg") returned 6 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.627] lstrlenA (lpString="*.psd") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.627] lstrlenA (lpString="*.cdr") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.627] lstrlenA (lpString="*.dwg") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.627] lstrlenA (lpString="*.max") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.627] lstrlenA (lpString="*.bmp") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.627] lstrlenA (lpString="*.gif") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.627] lstrlenA (lpString="*.png") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.627] lstrlenA (lpString="*.doc") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.627] lstrlenA (lpString="*.docx") returned 6 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.627] lstrlenA (lpString="*.xls") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.627] lstrlenA (lpString="*.xlsx") returned 6 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.627] lstrlenA (lpString="*.ppt") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.627] lstrlenA (lpString="*.pptx") returned 6 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.627] lstrlenA (lpString="*.txt") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.627] lstrlenA (lpString="*.pdf") returned 5 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.627] lstrlenA (lpString="*.djvu") returned 6 [0064.627] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.627] lstrlenA (lpString="*.htm") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.628] lstrlenA (lpString="*.html") returned 6 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.628] lstrlenA (lpString="*.mdb") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.628] lstrlenA (lpString="*.cer") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.628] lstrlenA (lpString="*.p12") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.628] lstrlenA (lpString="*.pfx") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.628] lstrlenA (lpString="*.kwm") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.628] lstrlenA (lpString="*.pwm") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.628] lstrlenA (lpString="*.1cd") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.628] lstrlenA (lpString="*.md") returned 4 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.628] lstrlenA (lpString="*.mdf") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.628] lstrlenA (lpString="*.dbf") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.628] lstrlenA (lpString="*.odt") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.628] lstrlenA (lpString="*.vob") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.628] lstrlenA (lpString="*.ifo") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.628] lstrlenA (lpString="*.lnk") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.628] lstrlenA (lpString="*.torrent") returned 9 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.628] lstrlenA (lpString="*.mov") returned 5 [0064.628] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.630] lstrlenA (lpString="*.m2v") returned 5 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.630] lstrlenA (lpString="*.3gp") returned 5 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.630] lstrlenA (lpString="*.mpeg") returned 6 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.630] lstrlenA (lpString="*.mpg") returned 5 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.630] lstrlenA (lpString="*.flv") returned 5 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.630] lstrlenA (lpString="*.avi") returned 5 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.630] lstrlenA (lpString="*.mp4") returned 5 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.630] lstrlenA (lpString="*.wmv") returned 5 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.630] lstrlenA (lpString="*.divx") returned 6 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.630] lstrlenA (lpString="*.mkv") returned 5 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.630] lstrlenA (lpString="*.mp3") returned 5 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.630] lstrlenA (lpString="*.wav") returned 5 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.630] lstrlenA (lpString="*.flac") returned 6 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.630] lstrlenA (lpString="*.ape") returned 5 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.630] lstrlenA (lpString="*.wma") returned 5 [0064.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.630] lstrlenA (lpString="*.ac3") returned 5 [0064.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.631] lstrlenA (lpString="*.doc") returned 5 [0064.631] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.631] FindClose (in: hFindFile=0x759ed0 | out: hFindFile=0x759ed0) returned 1 [0064.631] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75cec8, dwReserved1=0x7400c0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0064.631] lstrcmpA (lpString1=".", lpString2="hr-HR") returned -1 [0064.631] lstrcmpA (lpString1="..", lpString2="hr-HR") returned -1 [0064.631] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.631] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hr-HR" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR" [0064.631] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR") returned 56 [0064.631] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759990 [0064.631] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.631] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.631] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.631] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.631] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.631] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.631] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.631] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.631] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.631] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*.*") returned="*.*" [0064.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\" [0064.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\") returned="" [0064.631] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt" [0064.631] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\how to decrypt files.txt")) returned 0xffffffff [0064.632] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.632] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.632] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.633] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.636] CloseHandle (hObject=0x214) returned 1 [0064.636] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" [0064.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.636] lstrlenA (lpString="*.zip") returned 5 [0064.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.636] lstrlenA (lpString="*.rar") returned 5 [0064.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.636] lstrlenA (lpString="*.7z") returned 4 [0064.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.636] lstrlenA (lpString="*.tar") returned 5 [0064.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.636] lstrlenA (lpString="*.gzip") returned 6 [0064.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.636] lstrlenA (lpString="*.jpg") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.637] lstrlenA (lpString="*.jpeg") returned 6 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.637] lstrlenA (lpString="*.psd") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.637] lstrlenA (lpString="*.cdr") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.637] lstrlenA (lpString="*.dwg") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.637] lstrlenA (lpString="*.max") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.637] lstrlenA (lpString="*.bmp") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.637] lstrlenA (lpString="*.gif") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.637] lstrlenA (lpString="*.png") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.637] lstrlenA (lpString="*.doc") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.637] lstrlenA (lpString="*.docx") returned 6 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.637] lstrlenA (lpString="*.xls") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.637] lstrlenA (lpString="*.xlsx") returned 6 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.637] lstrlenA (lpString="*.ppt") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.637] lstrlenA (lpString="*.pptx") returned 6 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.637] lstrlenA (lpString="*.txt") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.637] lstrlenA (lpString="*.pdf") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.637] lstrlenA (lpString="*.djvu") returned 6 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.637] lstrlenA (lpString="*.htm") returned 5 [0064.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.638] lstrlenA (lpString="*.html") returned 6 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.638] lstrlenA (lpString="*.mdb") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.638] lstrlenA (lpString="*.cer") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.638] lstrlenA (lpString="*.p12") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.638] lstrlenA (lpString="*.pfx") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.638] lstrlenA (lpString="*.kwm") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.638] lstrlenA (lpString="*.pwm") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.638] lstrlenA (lpString="*.1cd") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.638] lstrlenA (lpString="*.md") returned 4 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.638] lstrlenA (lpString="*.mdf") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.638] lstrlenA (lpString="*.dbf") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.638] lstrlenA (lpString="*.odt") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.638] lstrlenA (lpString="*.vob") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.638] lstrlenA (lpString="*.ifo") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.638] lstrlenA (lpString="*.lnk") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.638] lstrlenA (lpString="*.torrent") returned 9 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.638] lstrlenA (lpString="*.mov") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.638] lstrlenA (lpString="*.m2v") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.638] lstrlenA (lpString="*.3gp") returned 5 [0064.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.639] lstrlenA (lpString="*.mpeg") returned 6 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.639] lstrlenA (lpString="*.mpg") returned 5 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.639] lstrlenA (lpString="*.flv") returned 5 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.639] lstrlenA (lpString="*.avi") returned 5 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.639] lstrlenA (lpString="*.mp4") returned 5 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.639] lstrlenA (lpString="*.wmv") returned 5 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.639] lstrlenA (lpString="*.divx") returned 6 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.639] lstrlenA (lpString="*.mkv") returned 5 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.639] lstrlenA (lpString="*.mp3") returned 5 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.639] lstrlenA (lpString="*.wav") returned 5 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.639] lstrlenA (lpString="*.flac") returned 6 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.639] lstrlenA (lpString="*.ape") returned 5 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.639] lstrlenA (lpString="*.wma") returned 5 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.639] lstrlenA (lpString="*.ac3") returned 5 [0064.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.639] lstrlenA (lpString="*.doc") returned 5 [0064.639] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.639] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0064.639] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75cec8, dwReserved1=0x7400c0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0064.639] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1 [0064.640] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1 [0064.640] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.640] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hu-HU" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU" [0064.640] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU") returned 56 [0064.640] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x759b50 [0064.640] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.640] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0064.640] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.640] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.640] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0064.640] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.640] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.640] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.640] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.640] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*.*") returned="*.*" [0064.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\" [0064.640] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\") returned="" [0064.640] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt" [0064.640] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\how to decrypt files.txt")) returned 0xffffffff [0064.640] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.643] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0064.643] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.644] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.644] CloseHandle (hObject=0x214) returned 1 [0064.644] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" [0064.644] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0064.644] lstrlenA (lpString="*.zip") returned 5 [0064.644] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0064.644] lstrlenA (lpString="*.rar") returned 5 [0064.644] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0064.644] lstrlenA (lpString="*.7z") returned 4 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0064.645] lstrlenA (lpString="*.tar") returned 5 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0064.645] lstrlenA (lpString="*.gzip") returned 6 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0064.645] lstrlenA (lpString="*.jpg") returned 5 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0064.645] lstrlenA (lpString="*.jpeg") returned 6 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0064.645] lstrlenA (lpString="*.psd") returned 5 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.cdr") returned 0 [0064.645] lstrlenA (lpString="*.cdr") returned 5 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.dwg") returned 0 [0064.645] lstrlenA (lpString="*.dwg") returned 5 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.max") returned 0 [0064.645] lstrlenA (lpString="*.max") returned 5 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.bmp") returned 0 [0064.645] lstrlenA (lpString="*.bmp") returned 5 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0064.645] lstrlenA (lpString="*.gif") returned 5 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.png") returned 0 [0064.645] lstrlenA (lpString="*.png") returned 5 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.645] lstrlenA (lpString="*.doc") returned 5 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0064.645] lstrlenA (lpString="*.docx") returned 6 [0064.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0064.646] lstrlenA (lpString="*.xls") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0064.646] lstrlenA (lpString="*.xlsx") returned 6 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0064.646] lstrlenA (lpString="*.ppt") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0064.646] lstrlenA (lpString="*.pptx") returned 6 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.txt") returned 0 [0064.646] lstrlenA (lpString="*.txt") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0064.646] lstrlenA (lpString="*.pdf") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.djvu") returned 0 [0064.646] lstrlenA (lpString="*.djvu") returned 6 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.htm") returned 0 [0064.646] lstrlenA (lpString="*.htm") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.html") returned 0 [0064.646] lstrlenA (lpString="*.html") returned 6 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mdb") returned 0 [0064.646] lstrlenA (lpString="*.mdb") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.cer") returned 0 [0064.646] lstrlenA (lpString="*.cer") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.p12") returned 0 [0064.646] lstrlenA (lpString="*.p12") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.pfx") returned 0 [0064.646] lstrlenA (lpString="*.pfx") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.kwm") returned 0 [0064.646] lstrlenA (lpString="*.kwm") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.pwm") returned 0 [0064.646] lstrlenA (lpString="*.pwm") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.1cd") returned 0 [0064.646] lstrlenA (lpString="*.1cd") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.md") returned 0 [0064.646] lstrlenA (lpString="*.md") returned 4 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mdf") returned 0 [0064.646] lstrlenA (lpString="*.mdf") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.dbf") returned 0 [0064.646] lstrlenA (lpString="*.dbf") returned 5 [0064.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.odt") returned 0 [0064.647] lstrlenA (lpString="*.odt") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.vob") returned 0 [0064.647] lstrlenA (lpString="*.vob") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.ifo") returned 0 [0064.647] lstrlenA (lpString="*.ifo") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.lnk") returned 0 [0064.647] lstrlenA (lpString="*.lnk") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.torrent") returned 0 [0064.647] lstrlenA (lpString="*.torrent") returned 9 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0064.647] lstrlenA (lpString="*.mov") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0064.647] lstrlenA (lpString="*.m2v") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0064.647] lstrlenA (lpString="*.3gp") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0064.647] lstrlenA (lpString="*.mpeg") returned 6 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0064.647] lstrlenA (lpString="*.mpg") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0064.647] lstrlenA (lpString="*.flv") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0064.647] lstrlenA (lpString="*.avi") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0064.647] lstrlenA (lpString="*.mp4") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0064.647] lstrlenA (lpString="*.wmv") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0064.647] lstrlenA (lpString="*.divx") returned 6 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0064.647] lstrlenA (lpString="*.mkv") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0064.647] lstrlenA (lpString="*.mp3") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0064.647] lstrlenA (lpString="*.wav") returned 5 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0064.647] lstrlenA (lpString="*.flac") returned 6 [0064.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0064.648] lstrlenA (lpString="*.ape") returned 5 [0064.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0064.648] lstrlenA (lpString="*.wma") returned 5 [0064.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0064.648] lstrlenA (lpString="*.ac3") returned 5 [0064.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0064.648] lstrlenA (lpString="*.doc") returned 5 [0064.648] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x1, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0064.648] FindClose (in: hFindFile=0x759b50 | out: hFindFile=0x759b50) returned 1 [0064.648] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x75cec8, dwReserved1=0x7400c0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0064.648] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.648] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrcommonlm.dat") returned -1 [0064.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrcommonlm.dat") returned -1 [0064.648] lstrcmpiA (lpString1="", lpString2="hwrcommonlm.dat") returned -1 [0064.648] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.648] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.648] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.648] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.648] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hwrcommonlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" [0064.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.zip") returned 0 [0064.648] lstrlenA (lpString="*.zip") returned 5 [0064.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.rar") returned 0 [0064.648] lstrlenA (lpString="*.rar") returned 5 [0064.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.7z") returned 0 [0064.648] lstrlenA (lpString="*.7z") returned 4 [0064.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.tar") returned 0 [0064.648] lstrlenA (lpString="*.tar") returned 5 [0064.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.gzip") returned 0 [0064.648] lstrlenA (lpString="*.gzip") returned 6 [0064.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.jpg") returned 0 [0064.649] lstrlenA (lpString="*.jpg") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.jpeg") returned 0 [0064.649] lstrlenA (lpString="*.jpeg") returned 6 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.psd") returned 0 [0064.649] lstrlenA (lpString="*.psd") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.cdr") returned 0 [0064.649] lstrlenA (lpString="*.cdr") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.dwg") returned 0 [0064.649] lstrlenA (lpString="*.dwg") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.max") returned 0 [0064.649] lstrlenA (lpString="*.max") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.bmp") returned 0 [0064.649] lstrlenA (lpString="*.bmp") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.gif") returned 0 [0064.649] lstrlenA (lpString="*.gif") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.png") returned 0 [0064.649] lstrlenA (lpString="*.png") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.doc") returned 0 [0064.649] lstrlenA (lpString="*.doc") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.docx") returned 0 [0064.649] lstrlenA (lpString="*.docx") returned 6 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.xls") returned 0 [0064.649] lstrlenA (lpString="*.xls") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.xlsx") returned 0 [0064.649] lstrlenA (lpString="*.xlsx") returned 6 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.ppt") returned 0 [0064.649] lstrlenA (lpString="*.ppt") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.pptx") returned 0 [0064.649] lstrlenA (lpString="*.pptx") returned 6 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.txt") returned 0 [0064.649] lstrlenA (lpString="*.txt") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.pdf") returned 0 [0064.649] lstrlenA (lpString="*.pdf") returned 5 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.djvu") returned 0 [0064.649] lstrlenA (lpString="*.djvu") returned 6 [0064.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.htm") returned 0 [0064.650] lstrlenA (lpString="*.htm") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.html") returned 0 [0064.650] lstrlenA (lpString="*.html") returned 6 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mdb") returned 0 [0064.650] lstrlenA (lpString="*.mdb") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.cer") returned 0 [0064.650] lstrlenA (lpString="*.cer") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.p12") returned 0 [0064.650] lstrlenA (lpString="*.p12") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.pfx") returned 0 [0064.650] lstrlenA (lpString="*.pfx") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.kwm") returned 0 [0064.650] lstrlenA (lpString="*.kwm") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.pwm") returned 0 [0064.650] lstrlenA (lpString="*.pwm") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.1cd") returned 0 [0064.650] lstrlenA (lpString="*.1cd") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.md") returned 0 [0064.650] lstrlenA (lpString="*.md") returned 4 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mdf") returned 0 [0064.650] lstrlenA (lpString="*.mdf") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.dbf") returned 0 [0064.650] lstrlenA (lpString="*.dbf") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.odt") returned 0 [0064.650] lstrlenA (lpString="*.odt") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.vob") returned 0 [0064.650] lstrlenA (lpString="*.vob") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.ifo") returned 0 [0064.650] lstrlenA (lpString="*.ifo") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.lnk") returned 0 [0064.650] lstrlenA (lpString="*.lnk") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.torrent") returned 0 [0064.650] lstrlenA (lpString="*.torrent") returned 9 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mov") returned 0 [0064.650] lstrlenA (lpString="*.mov") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.m2v") returned 0 [0064.650] lstrlenA (lpString="*.m2v") returned 5 [0064.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.3gp") returned 0 [0064.651] lstrlenA (lpString="*.3gp") returned 5 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mpeg") returned 0 [0064.651] lstrlenA (lpString="*.mpeg") returned 6 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mpg") returned 0 [0064.651] lstrlenA (lpString="*.mpg") returned 5 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.flv") returned 0 [0064.651] lstrlenA (lpString="*.flv") returned 5 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.avi") returned 0 [0064.651] lstrlenA (lpString="*.avi") returned 5 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mp4") returned 0 [0064.651] lstrlenA (lpString="*.mp4") returned 5 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.wmv") returned 0 [0064.651] lstrlenA (lpString="*.wmv") returned 5 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.divx") returned 0 [0064.651] lstrlenA (lpString="*.divx") returned 6 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mkv") returned 0 [0064.651] lstrlenA (lpString="*.mkv") returned 5 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.mp3") returned 0 [0064.651] lstrlenA (lpString="*.mp3") returned 5 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.wav") returned 0 [0064.651] lstrlenA (lpString="*.wav") returned 5 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.flac") returned 0 [0064.651] lstrlenA (lpString="*.flac") returned 6 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.ape") returned 0 [0064.651] lstrlenA (lpString="*.ape") returned 5 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.wma") returned 0 [0064.651] lstrlenA (lpString="*.wma") returned 5 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.ac3") returned 0 [0064.651] lstrlenA (lpString="*.ac3") returned 5 [0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", pszSpec="*.doc") returned 0 [0064.651] lstrlenA (lpString="*.doc") returned 5 [0064.651] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0064.651] lstrcmpA (lpString1=".", lpString2="HWRCustomization") returned -1 [0064.651] lstrcmpA (lpString1="..", lpString2="HWRCustomization") returned -1 [0064.651] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned="hwrcommonlm.dat" [0064.651] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HWRCustomization" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization" [0064.651] lstrlenA (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization") returned 67 [0064.651] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x75a010 [0064.652] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.652] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xa8, cFileName="..", cAlternateFileName="")) returned 1 [0064.652] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.652] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.652] FindNextFileA (in: hFindFile=0x75a010, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0xa8, cFileName="..", cAlternateFileName="")) returned 0 [0064.652] FindClose (in: hFindFile=0x75a010 | out: hFindFile=0x75a010) returned 1 [0064.652] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x75cec8, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0064.652] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.652] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrenclm.dat") returned -1 [0064.652] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrenclm.dat") returned -1 [0064.652] lstrcmpiA (lpString1="", lpString2="hwrenclm.dat") returned -1 [0064.652] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.652] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.652] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.652] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.652] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.652] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hwrenclm.dat" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" [0064.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.zip") returned 0 [0064.652] lstrlenA (lpString="*.zip") returned 5 [0064.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.rar") returned 0 [0064.653] lstrlenA (lpString="*.rar") returned 5 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.7z") returned 0 [0064.653] lstrlenA (lpString="*.7z") returned 4 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.tar") returned 0 [0064.653] lstrlenA (lpString="*.tar") returned 5 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.gzip") returned 0 [0064.653] lstrlenA (lpString="*.gzip") returned 6 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.jpg") returned 0 [0064.653] lstrlenA (lpString="*.jpg") returned 5 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.jpeg") returned 0 [0064.653] lstrlenA (lpString="*.jpeg") returned 6 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.psd") returned 0 [0064.653] lstrlenA (lpString="*.psd") returned 5 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.cdr") returned 0 [0064.653] lstrlenA (lpString="*.cdr") returned 5 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.dwg") returned 0 [0064.653] lstrlenA (lpString="*.dwg") returned 5 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.max") returned 0 [0064.653] lstrlenA (lpString="*.max") returned 5 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.bmp") returned 0 [0064.653] lstrlenA (lpString="*.bmp") returned 5 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.gif") returned 0 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.png") returned 0 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.doc") returned 0 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.docx") returned 0 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.xls") returned 0 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.xlsx") returned 0 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.ppt") returned 0 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.pptx") returned 0 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.txt") returned 0 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.pdf") returned 0 [0064.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.djvu") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.htm") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.html") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mdb") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.cer") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.p12") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.pfx") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.kwm") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.pwm") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.1cd") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.md") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mdf") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.dbf") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.odt") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.vob") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.ifo") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.lnk") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.torrent") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mov") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.m2v") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.3gp") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mpeg") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mpg") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.flv") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.avi") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mp4") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.wmv") returned 0 [0064.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.divx") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mkv") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.mp3") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.wav") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.flac") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.ape") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.wma") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.ac3") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", pszSpec="*.doc") returned 0 [0064.655] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe38781cd, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe38781cd, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0064.655] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.655] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrlatinlm.dat") returned -1 [0064.655] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrlatinlm.dat") returned -1 [0064.655] lstrcmpiA (lpString1="", lpString2="hwrlatinlm.dat") returned -1 [0064.655] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned="hwrenclm.dat" [0064.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.655] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.655] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.655] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.655] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hwrlatinlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.zip") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.rar") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.7z") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.tar") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.gzip") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.jpg") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.jpeg") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.psd") returned 0 [0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.cdr") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.dwg") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.max") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.bmp") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.gif") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.png") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.doc") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.docx") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.xls") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.xlsx") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.ppt") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.pptx") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.txt") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.pdf") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.djvu") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.htm") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.html") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mdb") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.cer") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.p12") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.pfx") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.kwm") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.pwm") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.1cd") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.md") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mdf") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.dbf") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.odt") returned 0 [0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.vob") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.ifo") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.lnk") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.torrent") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mov") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.m2v") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.3gp") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mpeg") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mpg") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.flv") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.avi") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mp4") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.wmv") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.divx") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mkv") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.mp3") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.wav") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.flac") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.ape") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.wma") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.ac3") returned 0 [0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", pszSpec="*.doc") returned 0 [0064.657] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb28b2edf, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb28b2edf, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2662f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0064.657] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrusalm.dat") returned -1 [0064.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrusalm.dat") returned -1 [0064.657] lstrcmpiA (lpString1="", lpString2="hwrusalm.dat") returned -1 [0064.657] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned="hwrlatinlm.dat" [0064.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.658] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.658] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.658] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.658] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hwrusalm.dat" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.zip") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.rar") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.7z") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.tar") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.gzip") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.jpg") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.jpeg") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.psd") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.cdr") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.dwg") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.max") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.bmp") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.gif") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.png") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.doc") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.docx") returned 0 [0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", pszSpec="*.xls") returned 0 [0064.659] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb281a570, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb281a570, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x339380, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0064.659] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.659] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrusash.dat") returned -1 [0064.659] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrusash.dat") returned -1 [0064.659] lstrcmpiA (lpString1="", lpString2="hwrusash.dat") returned -1 [0064.659] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned="hwrusalm.dat" [0064.659] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.659] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.659] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.659] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.659] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="hwrusash.dat" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" [0064.659] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x58400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0064.659] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.659] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkDiv.dll") returned -1 [0064.659] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkDiv.dll") returned -1 [0064.659] lstrcmpiA (lpString1="", lpString2="InkDiv.dll") returned -1 [0064.659] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned="hwrusash.dat" [0064.659] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.659] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.659] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.659] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.659] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="InkDiv.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" [0064.659] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0064.659] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.659] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkObj.dll") returned -1 [0064.659] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkObj.dll") returned -1 [0064.659] lstrcmpiA (lpString1="", lpString2="InkObj.dll") returned -1 [0064.659] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned="InkDiv.dll" [0064.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.660] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.660] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.660] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.660] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="InkObj.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" [0064.660] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x59a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0064.660] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.660] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InputPersonalization.exe") returned -1 [0064.660] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InputPersonalization.exe") returned -1 [0064.660] lstrcmpiA (lpString1="", lpString2="InputPersonalization.exe") returned -1 [0064.660] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned="InkObj.dll" [0064.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.660] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.660] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.660] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.660] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="InputPersonalization.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" [0064.661] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsar.xml", cAlternateFileName="")) returned 1 [0064.661] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.661] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsar.xml") returned -1 [0064.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsar.xml") returned -1 [0064.661] lstrcmpiA (lpString1="", lpString2="ipsar.xml") returned -1 [0064.661] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned="InputPersonalization.exe" [0064.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.661] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.661] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.661] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.661] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsar.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" [0064.661] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0064.661] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.661] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipscat.xml") returned -1 [0064.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipscat.xml") returned -1 [0064.661] lstrcmpiA (lpString1="", lpString2="ipscat.xml") returned -1 [0064.661] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned="ipsar.xml" [0064.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.661] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.661] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.661] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.661] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipscat.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" [0064.661] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0064.661] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.661] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipschs.xml") returned -1 [0064.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipschs.xml") returned -1 [0064.661] lstrcmpiA (lpString1="", lpString2="ipschs.xml") returned -1 [0064.661] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned="ipscat.xml" [0064.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.662] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.662] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.662] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.662] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipschs.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" [0064.662] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0064.662] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.662] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipscht.xml") returned -1 [0064.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipscht.xml") returned -1 [0064.662] lstrcmpiA (lpString1="", lpString2="ipscht.xml") returned -1 [0064.662] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned="ipschs.xml" [0064.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.662] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.662] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.662] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.662] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipscht.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" [0064.662] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0064.662] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.662] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipscsy.xml") returned -1 [0064.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipscsy.xml") returned -1 [0064.662] lstrcmpiA (lpString1="", lpString2="ipscsy.xml") returned -1 [0064.662] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned="ipscht.xml" [0064.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.662] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.662] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.662] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.663] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipscsy.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" [0064.663] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0064.663] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsdan.xml") returned -1 [0064.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsdan.xml") returned -1 [0064.663] lstrcmpiA (lpString1="", lpString2="ipsdan.xml") returned -1 [0064.663] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned="ipscsy.xml" [0064.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.663] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.663] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.663] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.663] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsdan.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" [0064.663] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsdeu.xml") returned -1 [0064.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsdeu.xml") returned -1 [0064.663] lstrcmpiA (lpString1="", lpString2="ipsdeu.xml") returned -1 [0064.663] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned="ipsdan.xml" [0064.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.663] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.663] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.663] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.663] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsdeu.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" [0064.663] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsel.xml") returned -1 [0064.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsel.xml") returned -1 [0064.664] lstrcmpiA (lpString1="", lpString2="ipsel.xml") returned -1 [0064.664] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned="ipsdeu.xml" [0064.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.664] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.664] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.664] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsel.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" [0064.664] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsen.xml") returned -1 [0064.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsen.xml") returned -1 [0064.664] lstrcmpiA (lpString1="", lpString2="ipsen.xml") returned -1 [0064.664] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned="ipsel.xml" [0064.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.664] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.664] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.664] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsen.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" [0064.664] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsesp.xml") returned -1 [0064.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsesp.xml") returned -1 [0064.664] lstrcmpiA (lpString1="", lpString2="ipsesp.xml") returned -1 [0064.664] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned="ipsen.xml" [0064.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.664] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.664] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.664] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsesp.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" [0064.665] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.665] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPSEventLogMsg.dll") returned -1 [0064.665] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPSEventLogMsg.dll") returned -1 [0064.665] lstrcmpiA (lpString1="", lpString2="IPSEventLogMsg.dll") returned -1 [0064.665] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned="ipsesp.xml" [0064.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.665] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.665] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.665] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.665] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="IPSEventLogMsg.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" [0064.665] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.665] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsfin.xml") returned -1 [0064.665] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsfin.xml") returned -1 [0064.665] lstrcmpiA (lpString1="", lpString2="ipsfin.xml") returned -1 [0064.665] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned="IPSEventLogMsg.dll" [0064.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.665] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.665] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.665] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.665] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsfin.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" [0064.665] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.665] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsfra.xml") returned -1 [0064.665] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsfra.xml") returned -1 [0064.665] lstrcmpiA (lpString1="", lpString2="ipsfra.xml") returned -1 [0064.665] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned="ipsfin.xml" [0064.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.665] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.665] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.666] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.666] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsfra.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" [0064.666] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.666] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipshe.xml") returned -1 [0064.666] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipshe.xml") returned -1 [0064.666] lstrcmpiA (lpString1="", lpString2="ipshe.xml") returned -1 [0064.666] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned="ipsfra.xml" [0064.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.666] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.666] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.666] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.666] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipshe.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" [0064.666] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.666] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipshi.xml") returned -1 [0064.666] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipshi.xml") returned -1 [0064.666] lstrcmpiA (lpString1="", lpString2="ipshi.xml") returned -1 [0064.666] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned="ipshe.xml" [0064.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.666] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.666] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.666] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.666] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipshi.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" [0064.666] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.666] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipshrv.xml") returned -1 [0064.666] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipshrv.xml") returned -1 [0064.666] lstrcmpiA (lpString1="", lpString2="ipshrv.xml") returned -1 [0064.667] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned="ipshi.xml" [0064.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.667] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.667] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.667] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.667] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipshrv.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" [0064.667] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.667] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsid.xml") returned -1 [0064.667] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsid.xml") returned -1 [0064.667] lstrcmpiA (lpString1="", lpString2="ipsid.xml") returned -1 [0064.667] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned="ipshrv.xml" [0064.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.667] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.667] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.667] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.667] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsid.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" [0064.667] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.667] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsita.xml") returned -1 [0064.667] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsita.xml") returned -1 [0064.667] lstrcmpiA (lpString1="", lpString2="ipsita.xml") returned -1 [0064.667] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned="ipsid.xml" [0064.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.667] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.667] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.667] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.667] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsita.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" [0064.667] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.668] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsjpn.xml") returned -1 [0064.668] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsjpn.xml") returned -1 [0064.668] lstrcmpiA (lpString1="", lpString2="ipsjpn.xml") returned -1 [0064.668] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml") returned="ipsita.xml" [0064.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.668] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.668] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.668] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.668] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsjpn.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" [0064.668] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.668] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipskor.xml") returned -1 [0064.668] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipskor.xml") returned -1 [0064.668] lstrcmpiA (lpString1="", lpString2="ipskor.xml") returned -1 [0064.668] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned="ipsjpn.xml" [0064.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.668] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.668] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.668] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.668] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipskor.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" [0064.668] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.668] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IpsMigrationPlugin.dll") returned -1 [0064.668] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IpsMigrationPlugin.dll") returned -1 [0064.668] lstrcmpiA (lpString1="", lpString2="IpsMigrationPlugin.dll") returned -1 [0064.668] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned="ipskor.xml" [0064.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.668] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.668] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.668] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.668] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="IpsMigrationPlugin.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" [0064.669] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsnld.xml") returned -1 [0064.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsnld.xml") returned -1 [0064.669] lstrcmpiA (lpString1="", lpString2="ipsnld.xml") returned -1 [0064.669] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned="IpsMigrationPlugin.dll" [0064.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.669] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.669] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.669] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.669] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsnld.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" [0064.669] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsnor.xml") returned -1 [0064.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsnor.xml") returned -1 [0064.669] lstrcmpiA (lpString1="", lpString2="ipsnor.xml") returned -1 [0064.669] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned="ipsnld.xml" [0064.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.669] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.669] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.669] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.669] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsnor.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" [0064.669] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsplk.xml") returned -1 [0064.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsplk.xml") returned -1 [0064.669] lstrcmpiA (lpString1="", lpString2="ipsplk.xml") returned -1 [0064.669] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned="ipsnor.xml" [0064.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.669] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.670] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.670] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.670] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsplk.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" [0064.670] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.670] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IpsPlugin.dll") returned -1 [0064.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IpsPlugin.dll") returned -1 [0064.670] lstrcmpiA (lpString1="", lpString2="IpsPlugin.dll") returned -1 [0064.670] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned="ipsplk.xml" [0064.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.670] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.670] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.670] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.670] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="IpsPlugin.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" [0064.670] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.670] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsptb.xml") returned -1 [0064.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsptb.xml") returned -1 [0064.670] lstrcmpiA (lpString1="", lpString2="ipsptb.xml") returned -1 [0064.670] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned="IpsPlugin.dll" [0064.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.670] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.670] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.670] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.670] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsptb.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" [0064.670] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.670] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsptg.xml") returned -1 [0064.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsptg.xml") returned -1 [0064.670] lstrcmpiA (lpString1="", lpString2="ipsptg.xml") returned -1 [0064.671] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned="ipsptb.xml" [0064.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.671] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.671] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.671] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.671] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsptg.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" [0064.671] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.673] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsrom.xml") returned -1 [0064.673] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsrom.xml") returned -1 [0064.673] lstrcmpiA (lpString1="", lpString2="ipsrom.xml") returned -1 [0064.673] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned="ipsptg.xml" [0064.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.673] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.673] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.673] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.673] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsrom.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" [0064.674] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.674] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipsrus.xml") returned -1 [0064.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipsrus.xml") returned -1 [0064.674] lstrcmpiA (lpString1="", lpString2="ipsrus.xml") returned -1 [0064.674] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned="ipsrom.xml" [0064.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.674] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.674] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.674] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.674] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipsrus.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" [0064.674] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.674] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipssrb.xml") returned -1 [0064.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipssrb.xml") returned -1 [0064.674] lstrcmpiA (lpString1="", lpString2="ipssrb.xml") returned -1 [0064.674] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned="ipsrus.xml" [0064.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.674] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.674] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.674] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.674] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipssrb.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" [0064.674] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.674] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipssrl.xml") returned -1 [0064.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipssrl.xml") returned -1 [0064.674] lstrcmpiA (lpString1="", lpString2="ipssrl.xml") returned -1 [0064.674] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned="ipssrb.xml" [0064.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.674] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.675] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.675] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.675] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipssrl.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" [0064.675] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipssve.xml") returned -1 [0064.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipssve.xml") returned -1 [0064.675] lstrcmpiA (lpString1="", lpString2="ipssve.xml") returned -1 [0064.675] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned="ipssrl.xml" [0064.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.675] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.675] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.675] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.675] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipssve.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" [0064.675] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipstr.xml") returned -1 [0064.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipstr.xml") returned -1 [0064.675] lstrcmpiA (lpString1="", lpString2="ipstr.xml") returned -1 [0064.675] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned="ipssve.xml" [0064.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.675] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.675] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.675] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.676] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ipstr.xml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" [0064.676] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned="ipstr.xml" [0064.676] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="it-IT" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT" [0064.681] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.681] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.681] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*.*") returned="*.*" [0064.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\" [0064.681] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\") returned="" [0064.681] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\HOW TO DECRYPT FILES.txt" [0064.681] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\how to decrypt files.txt")) returned 0xffffffff [0064.681] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.682] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.683] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.683] CloseHandle (hObject=0x214) returned 1 [0064.683] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" [0064.683] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.683] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ja-JP" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP" [0064.684] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.684] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.684] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.684] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.684] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*.*") returned="*.*" [0064.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\" [0064.684] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\") returned="" [0064.684] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\HOW TO DECRYPT FILES.txt" [0064.684] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\how to decrypt files.txt")) returned 0xffffffff [0064.684] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.685] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.686] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.686] CloseHandle (hObject=0x214) returned 1 [0064.686] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" [0064.686] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.686] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ko-KR" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR" [0064.686] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.686] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.686] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*.*") returned="*.*" [0064.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\" [0064.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\") returned="" [0064.686] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\HOW TO DECRYPT FILES.txt" [0064.686] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\how to decrypt files.txt")) returned 0xffffffff [0064.687] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.687] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.688] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.688] CloseHandle (hObject=0x214) returned 1 [0064.688] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" [0064.688] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.688] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="LanguageModel" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel" [0064.689] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.689] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chstic.dgml") returned 1 [0064.689] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chstic.dgml") returned 1 [0064.689] lstrcmpiA (lpString1="", lpString2="chstic.dgml") returned -1 [0064.689] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*.*") returned="*.*" [0064.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\" [0064.689] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\") returned="" [0064.689] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\HOW TO DECRYPT FILES.txt" [0064.689] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\how to decrypt files.txt")) returned 0xffffffff [0064.689] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.690] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.691] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.691] CloseHandle (hObject=0x214) returned 1 [0064.691] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\", lpString2="chstic.dgml" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" [0064.691] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.691] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="lt-LT" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT" [0064.692] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.692] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.692] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*.*") returned="*.*" [0064.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\" [0064.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\") returned="" [0064.692] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\HOW TO DECRYPT FILES.txt" [0064.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\how to decrypt files.txt")) returned 0xffffffff [0064.692] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.693] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.694] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.694] CloseHandle (hObject=0x214) returned 1 [0064.694] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" [0064.694] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.694] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="lv-LV" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV" [0064.694] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.694] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.694] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*.*") returned="*.*" [0064.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\" [0064.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\") returned="" [0064.694] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\HOW TO DECRYPT FILES.txt" [0064.694] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\how to decrypt files.txt")) returned 0xffffffff [0064.694] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.695] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.696] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.696] CloseHandle (hObject=0x214) returned 1 [0064.696] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" [0064.696] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="micaut.dll") returned -1 [0064.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="micaut.dll") returned -1 [0064.696] lstrcmpiA (lpString1="", lpString2="micaut.dll") returned -1 [0064.696] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.696] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.696] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.696] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="micaut.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" [0064.696] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Ink.dll") returned -1 [0064.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Ink.dll") returned -1 [0064.696] lstrcmpiA (lpString1="", lpString2="Microsoft.Ink.dll") returned -1 [0064.696] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned="micaut.dll" [0064.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.697] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.697] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.697] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="Microsoft.Ink.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" [0064.697] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.697] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mip.exe") returned -1 [0064.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mip.exe") returned -1 [0064.697] lstrcmpiA (lpString1="", lpString2="mip.exe") returned -1 [0064.697] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned="Microsoft.Ink.dll" [0064.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.697] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.697] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.697] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="mip.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" [0064.697] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.697] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mraut.dll") returned -1 [0064.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mraut.dll") returned -1 [0064.697] lstrcmpiA (lpString1="", lpString2="mraut.dll") returned -1 [0064.697] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned="mip.exe" [0064.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.697] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.697] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.697] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="mraut.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" [0064.698] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mshwgst.dll") returned -1 [0064.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwgst.dll") returned -1 [0064.698] lstrcmpiA (lpString1="", lpString2="mshwgst.dll") returned -1 [0064.698] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned="mraut.dll" [0064.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.698] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.698] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.698] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.698] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="mshwgst.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" [0064.698] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mshwLatin.dll") returned -1 [0064.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwLatin.dll") returned -1 [0064.698] lstrcmpiA (lpString1="", lpString2="mshwLatin.dll") returned -1 [0064.698] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned="mshwgst.dll" [0064.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.698] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.698] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.698] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.698] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="mshwLatin.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" [0064.698] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned="mshwLatin.dll" [0064.698] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="nb-NO" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO" [0064.698] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.699] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.699] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.699] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.699] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*.*") returned="*.*" [0064.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\" [0064.699] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\") returned="" [0064.699] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\HOW TO DECRYPT FILES.txt" [0064.699] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\how to decrypt files.txt")) returned 0xffffffff [0064.699] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.699] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.700] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.700] CloseHandle (hObject=0x214) returned 1 [0064.700] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" [0064.700] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.701] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="nl-NL" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL" [0064.701] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.701] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.701] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*.*") returned="*.*" [0064.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\" [0064.701] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\") returned="" [0064.701] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\HOW TO DECRYPT FILES.txt" [0064.701] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\how to decrypt files.txt")) returned 0xffffffff [0064.701] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.702] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.703] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.703] CloseHandle (hObject=0x214) returned 1 [0064.703] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" [0064.703] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.703] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="pl-PL" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL" [0064.704] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.704] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.704] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*.*") returned="*.*" [0064.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\" [0064.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\") returned="" [0064.704] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\HOW TO DECRYPT FILES.txt" [0064.704] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\how to decrypt files.txt")) returned 0xffffffff [0064.704] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.704] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.705] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.705] CloseHandle (hObject=0x214) returned 1 [0064.705] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" [0064.705] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.706] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="pt-BR" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR" [0064.706] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.706] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.706] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.706] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*.*") returned="*.*" [0064.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\" [0064.706] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\") returned="" [0064.706] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\HOW TO DECRYPT FILES.txt" [0064.706] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\how to decrypt files.txt")) returned 0xffffffff [0064.706] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.706] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.708] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.708] CloseHandle (hObject=0x214) returned 1 [0064.708] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" [0064.708] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.708] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="pt-PT" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT" [0064.708] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.708] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.708] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.708] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.708] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*.*") returned="*.*" [0064.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\" [0064.708] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\") returned="" [0064.709] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\HOW TO DECRYPT FILES.txt" [0064.709] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\how to decrypt files.txt")) returned 0xffffffff [0064.709] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.781] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.782] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.782] CloseHandle (hObject=0x214) returned 1 [0064.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" [0064.782] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ro-RO" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO" [0064.783] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.783] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.783] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*.*") returned="*.*" [0064.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\" [0064.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\") returned="" [0064.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\HOW TO DECRYPT FILES.txt" [0064.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\how to decrypt files.txt")) returned 0xffffffff [0064.783] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.784] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.786] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.786] CloseHandle (hObject=0x214) returned 1 [0064.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" [0064.786] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtscom.dll") returned -1 [0064.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtscom.dll") returned -1 [0064.786] lstrcmpiA (lpString1="", lpString2="rtscom.dll") returned -1 [0064.786] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="rtscom.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" [0064.786] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned="rtscom.dll" [0064.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ru-RU" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU" [0064.787] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.787] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.787] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*.*") returned="*.*" [0064.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\" [0064.787] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\") returned="" [0064.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\HOW TO DECRYPT FILES.txt" [0064.787] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\how to decrypt files.txt")) returned 0xffffffff [0064.787] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.787] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.788] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.788] CloseHandle (hObject=0x214) returned 1 [0064.788] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" [0064.788] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShapeCollector.exe") returned -1 [0064.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShapeCollector.exe") returned -1 [0064.789] lstrcmpiA (lpString1="", lpString2="ShapeCollector.exe") returned -1 [0064.789] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.789] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.789] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="ShapeCollector.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" [0064.789] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned="ShapeCollector.exe" [0064.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="sk-SK" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK" [0064.789] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.789] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.789] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*.*") returned="*.*" [0064.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\" [0064.789] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\") returned="" [0064.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\HOW TO DECRYPT FILES.txt" [0064.789] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\how to decrypt files.txt")) returned 0xffffffff [0064.789] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.790] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.790] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.791] CloseHandle (hObject=0x214) returned 1 [0064.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" [0064.791] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="sl-SI" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI" [0064.791] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.791] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.791] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.791] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*.*") returned="*.*" [0064.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\" [0064.791] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\") returned="" [0064.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\HOW TO DECRYPT FILES.txt" [0064.791] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\how to decrypt files.txt")) returned 0xffffffff [0064.791] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.792] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.793] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.793] CloseHandle (hObject=0x214) returned 1 [0064.793] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" [0064.793] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="sr-Latn-RS" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS" [0064.794] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.794] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.794] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.794] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*.*") returned="*.*" [0064.794] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\" [0064.794] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\") returned="" [0064.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt" [0064.794] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\how to decrypt files.txt")) returned 0xffffffff [0064.794] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.795] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.796] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.796] CloseHandle (hObject=0x214) returned 1 [0064.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" [0064.796] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="sv-SE" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE" [0064.796] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.796] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.796] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.796] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.796] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*.*") returned="*.*" [0064.796] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\" [0064.796] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\") returned="" [0064.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\HOW TO DECRYPT FILES.txt" [0064.796] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\how to decrypt files.txt")) returned 0xffffffff [0064.797] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.797] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.798] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.798] CloseHandle (hObject=0x214) returned 1 [0064.798] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" [0064.798] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.798] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TabIpsps.dll") returned -1 [0064.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TabIpsps.dll") returned -1 [0064.799] lstrcmpiA (lpString1="", lpString2="TabIpsps.dll") returned -1 [0064.799] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="TabIpsps.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" [0064.799] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.799] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tabskb.dll") returned -1 [0064.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tabskb.dll") returned -1 [0064.799] lstrcmpiA (lpString1="", lpString2="tabskb.dll") returned -1 [0064.799] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned="TabIpsps.dll" [0064.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="tabskb.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" [0064.799] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.799] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TabTip.exe") returned -1 [0064.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TabTip.exe") returned -1 [0064.799] lstrcmpiA (lpString1="", lpString2="TabTip.exe") returned -1 [0064.799] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned="tabskb.dll" [0064.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="TabTip.exe" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" [0064.800] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe") returned="TabTip.exe" [0064.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="th-TH" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH" [0064.800] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.800] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.800] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.800] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*.*") returned="*.*" [0064.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\" [0064.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\") returned="" [0064.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\HOW TO DECRYPT FILES.txt" [0064.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\how to decrypt files.txt")) returned 0xffffffff [0064.800] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.801] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0064.802] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.802] CloseHandle (hObject=0x214) returned 1 [0064.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" [0064.803] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.803] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipRes.dll") returned -1 [0064.803] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipRes.dll") returned -1 [0064.803] lstrcmpiA (lpString1="", lpString2="TipRes.dll") returned -1 [0064.803] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.803] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.803] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0064.803] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0064.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", lpString2="TipRes.dll" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" [0064.803] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.803] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll") returned -1 [0064.803] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll") returned -1 [0064.803] lstrcmpiA (lpString1="", lpString2="tipresx.dll") returned -1 [0064.803] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned="TipRes.dll" [0064.803] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.803] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.804] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.804] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipskins.dll") returned -1 [0064.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipskins.dll") returned -1 [0064.804] lstrcmpiA (lpString1="", lpString2="tipskins.dll") returned -1 [0064.804] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll") returned="tipresx.dll" [0064.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.804] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.804] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.804] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tiptsf.dll") returned -1 [0064.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tiptsf.dll") returned -1 [0064.804] lstrcmpiA (lpString1="", lpString2="tiptsf.dll") returned -1 [0064.804] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll") returned="tipskins.dll" [0064.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.804] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.804] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.804] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tpcps.dll") returned -1 [0064.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tpcps.dll") returned -1 [0064.804] lstrcmpiA (lpString1="", lpString2="tpcps.dll") returned -1 [0064.804] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll") returned="tiptsf.dll" [0064.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" [0064.804] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned="" [0064.804] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll") returned="tpcps.dll" [0064.805] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.805] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.805] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*.*") returned="*.*" [0064.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\" [0064.805] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\") returned="" [0064.807] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.808] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.808] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.808] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.808] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.808] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*.*") returned="*.*" [0064.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\" [0064.808] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\") returned="" [0064.809] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.809] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.809] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.809] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.809] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.809] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*.*") returned="*.*" [0064.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\" [0064.809] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\") returned="" [0064.811] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0064.811] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.811] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0064.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0064.811] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0064.811] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*.*") returned="*.*" [0064.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\" [0064.811] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\") returned="" [0064.813] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0064.813] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*.*") returned="*.*" [0064.813] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.813] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msinfo32.exe.mui") returned -1 [0064.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msinfo32.exe.mui") returned -1 [0064.814] lstrcmpiA (lpString1="", lpString2="msinfo32.exe.mui") returned -1 [0064.814] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*.*") returned="*.*" [0064.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\" [0064.814] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\") returned="" [0064.815] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.815] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msinfo32.exe") returned -1 [0064.815] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msinfo32.exe") returned -1 [0064.815] lstrcmpiA (lpString1="", lpString2="msinfo32.exe") returned -1 [0064.815] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*.*") returned="*.*" [0064.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\" [0064.815] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\") returned="" [0064.820] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0064.822] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.822] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LICLUA.EXE") returned -1 [0064.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LICLUA.EXE") returned -1 [0064.822] lstrcmpiA (lpString1="", lpString2="LICLUA.EXE") returned -1 [0064.822] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*.*") returned="*.*" [0064.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" [0064.822] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned="" [0064.824] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned="LICLUA.EXE" [0064.826] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.826] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*.*") returned="*.*" [0064.826] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\" [0064.826] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\") returned="" [0064.827] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.827] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned="pidgenx.dll" [0064.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\" [0064.827] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\") returned="" [0064.827] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.827] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0064.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\" [0064.827] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\") returned="" [0064.827] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0064.828] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0064.829] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.829] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*.*") returned="*.*" [0064.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\" [0064.829] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\") returned="" [0064.830] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0064.833] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.833] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*.*") returned="*.*" [0064.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.833] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.836] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.836] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned="Bears.htm" [0064.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.836] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.838] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.838] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned="Bears.jpg" [0064.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.838] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.838] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.838] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned="Desktop.ini" [0064.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.840] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.840] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned="Garden.htm" [0064.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.840] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.842] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.842] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned="Garden.jpg" [0064.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.842] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.842] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned="Green Bubbles.htm" [0064.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.846] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.846] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned="GreenBubbles.jpg" [0064.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.846] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.847] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.847] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned="Hand Prints.htm" [0064.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.848] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.848] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned="HandPrints.jpg" [0064.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.848] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.848] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned="Orange Circles.htm" [0064.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.849] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.849] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned="OrangeCircles.jpg" [0064.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.849] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.850] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned="Peacock.htm" [0064.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.851] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.851] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned="Peacock.jpg" [0064.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.851] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.852] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.852] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned="Roses.htm" [0064.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.852] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.853] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.853] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned="Roses.jpg" [0064.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.853] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.854] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.854] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned="Shades of Blue.htm" [0064.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.854] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.854] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.854] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned="ShadesOfBlue.jpg" [0064.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.854] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.855] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.855] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned="Soft Blue.htm" [0064.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.855] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.855] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.855] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned="SoftBlue.jpg" [0064.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.855] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.856] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.856] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned="Stars.htm" [0064.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" [0064.856] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned="" [0064.857] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0064.857] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*.*") returned="*.*" [0064.857] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0064.858] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*.*") returned="*.*" [0064.858] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0064.859] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.859] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VC\\*.*") returned="*.*" [0064.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VC\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VC\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VC\\" [0064.859] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VC\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VC\\") returned="" [0064.860] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.860] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned="msdia100.dll" [0064.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VC\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VC\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VC\\" [0064.860] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VC\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VC\\") returned="" [0064.860] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0064.860] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.860] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*.*") returned="*.*" [0064.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\" [0064.860] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\") returned="" [0064.862] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\*.*") returned="*.*" [0064.862] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*.*") returned="*.*" [0064.865] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*.*") returned="*.*" [0064.867] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.867] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*.*") returned="*.*" [0064.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" [0064.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned="" [0064.872] PeekMessageA (in: lpMsg=0x19f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f62c) returned 0 [0064.872] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned="VSTOInstallerUI.dll" [0064.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" [0064.872] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned="" [0064.872] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.872] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*.*") returned="*.*" [0064.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" [0064.872] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="" [0064.874] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.874] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned="VSTOInstaller.exe" [0064.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" [0064.874] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="" [0064.874] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.874] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned="VSTOLoader.dll" [0064.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" [0064.874] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="" [0064.874] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.874] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*.*") returned="*.*" [0064.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" [0064.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned="" [0064.877] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.877] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned="vstoee.dll" [0064.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" [0064.877] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned="" [0064.877] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.877] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned="vstoee100.tlb" [0064.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" [0064.877] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned="" [0064.878] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0064.878] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0064.878] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Services\\*.*") returned="*.*" [0064.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Services\\" | out: lpString1="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\" [0064.878] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Services\\" | out: pszPath="C:\\Program Files\\Common Files\\Services\\") returned="" [0064.919] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0064.922] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0064.946] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.946] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\*.*") returned="*.*" [0064.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.946] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.948] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.948] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned="adojavas.inc" [0064.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.948] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned="adovbs.inc" [0064.948] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.948] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*") returned="*.*" [0064.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" [0064.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="" [0064.950] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.950] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\*.*") returned="*.*" [0064.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.950] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.950] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.950] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned="msader15.dll" [0064.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.950] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.951] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.951] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned="msado15.dll" [0064.951] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.951] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.951] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.951] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned="msado20.tlb" [0064.951] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.951] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.951] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.951] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned="msado21.tlb" [0064.951] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.951] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.951] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.951] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned="msado25.tlb" [0064.951] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.951] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.951] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.952] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned="msado26.tlb" [0064.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.952] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.952] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned="msado27.tlb" [0064.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.952] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.952] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned="msado28.tlb" [0064.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.952] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.952] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned="msado60.tlb" [0064.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.952] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.952] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned="msadomd.dll" [0064.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.953] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.953] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned="msadomd28.tlb" [0064.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.953] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.953] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned="msador15.dll" [0064.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.954] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.954] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned="msador28.tlb" [0064.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.954] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.954] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.954] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned="msadox.dll" [0064.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.954] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.954] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.954] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned="msadox28.tlb" [0064.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0064.954] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0064.954] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0064.954] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0064.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\" [0064.954] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned="" [0064.956] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned="DirectDB.dll" [0064.956] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.956] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\en-US\\*.*") returned="*.*" [0064.956] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\en-US\\" [0064.956] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\en-US\\") returned="" [0064.958] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0064.960] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.960] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\*.*") returned="*.*" [0064.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0064.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.962] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.962] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned="adcjavas.inc" [0064.962] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0064.962] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.962] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned="adcvbs.inc" [0064.962] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.962] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*") returned="*.*" [0064.962] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0064.962] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0064.970] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.970] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned="msadcer.dll.mui" [0064.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0064.970] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0064.970] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.970] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0064.971] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.971] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0064.971] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.971] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0064.971] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.971] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.971] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.971] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.971] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.971] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.971] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.971] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.971] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.972] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.972] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.972] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.972] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.972] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.972] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.972] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.972] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.972] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.973] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.973] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.973] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.973] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0064.975] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.975] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0064.979] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0064.979] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0064.979] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0064.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0064.979] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.981] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.981] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.981] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.981] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.981] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.982] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.982] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.982] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.982] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.982] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.982] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.982] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.983] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.983] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0064.983] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0064.983] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned="" [0064.983] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0064.983] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned="" [0064.983] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0064.983] PathAddBackslashA (in: pszPath="C:\\Program Files\\" | out: pszPath="C:\\Program Files\\") returned="" [0064.985] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.987] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.987] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.987] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0064.987] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\en-US\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\en-US\\") returned="" [0064.989] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0064.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\en-US\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\en-US\\") returned="" [0064.989] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0064.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\en-US\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\en-US\\") returned="" [0064.989] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.989] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.989] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.989] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.990] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.990] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.990] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.990] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.990] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0064.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\images\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\images\\") returned="" [0064.992] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0064.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\SIGNUP\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\SIGNUP\\") returned="" [0064.995] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.995] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.995] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Internet Explorer\\" | out: pszPath="C:\\Program Files\\Internet Explorer\\") returned="" [0064.995] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\" | out: pszPath="C:\\Program Files\\Java\\") returned="" [0064.997] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0064.997] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\" | out: pszPath="C:\\Program Files\\Java\\") returned="" [0064.998] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0064.998] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.000] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.000] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.000] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.000] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.000] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.000] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.000] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.000] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.001] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0065.001] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\") returned="" [0065.005] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0065.005] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\") returned="" [0065.005] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.005] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.005] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.005] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.005] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.005] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.005] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.005] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.006] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.006] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.006] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.006] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.006] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.006] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.006] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.006] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.006] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.006] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.006] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.006] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.007] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.007] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.007] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.007] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.007] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.007] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.007] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.007] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.007] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.007] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.007] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.007] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.008] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.008] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.008] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.008] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.008] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.008] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.008] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.008] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.008] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.008] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.009] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.009] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.009] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.009] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.009] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.009] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.009] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.009] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.010] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.010] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.010] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.010] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.021] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.021] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.021] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.023] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.024] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.024] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.024] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.024] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.024] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.025] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.025] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.025] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.025] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.025] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.025] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.025] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.025] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.025] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.026] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.026] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0065.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" | out: pszPath="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="" [0065.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.enciphered")) returned 1 [0065.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.enciphered")) returned 1 [0065.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.enciphered")) returned 1 [0065.070] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.enciphered")) returned 1 [0065.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.enciphered")) returned 1 [0065.076] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.enciphered")) returned 1 [0065.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.enciphered")) returned 1 [0065.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.enciphered")) returned 1 [0065.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.enciphered")) returned 1 [0065.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.enciphered")) returned 1 [0065.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.enciphered")) returned 1 [0065.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.enciphered")) returned 1 [0065.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.enciphered")) returned 1 [0065.114] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.enciphered")) returned 1 [0065.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.enciphered")) returned 1 [0065.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.enciphered")) returned 1 [0065.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.enciphered")) returned 1 [0065.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.EnCiPhErEd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.enciphered")) returned 1 [0065.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.enciphered")) returned 1 [0065.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.enciphered")) returned 1 [0065.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.enciphered")) returned 1 [0065.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.enciphered")) returned 1 [0065.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.enciphered")) returned 1 [0065.237] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.enciphered")) returned 1 [0065.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.enciphered")) returned 1 [0065.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.enciphered")) returned 1 [0065.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.enciphered")) returned 1 [0065.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.enciphered")) returned 1 [0065.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.enciphered")) returned 1 [0065.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.enciphered")) returned 1 [0065.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.enciphered")) returned 1 [0065.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.enciphered")) returned 1 [0065.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.enciphered")) returned 1 [0065.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.enciphered")) returned 1 [0065.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.enciphered")) returned 1 [0065.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.enciphered")) returned 1 [0065.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.enciphered")) returned 1 [0065.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.enciphered")) returned 1 [0065.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.enciphered")) returned 1 [0065.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.enciphered")) returned 1 [0065.355] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.enciphered")) returned 1 [0065.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.enciphered")) returned 1 [0065.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.enciphered")) returned 1 [0065.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.enciphered")) returned 1 [0065.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.enciphered")) returned 1 [0065.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.enciphered")) returned 1 [0065.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.enciphered")) returned 1 [0065.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.enciphered")) returned 1 [0065.409] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.enciphered")) returned 1 [0065.414] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.enciphered")) returned 1 [0065.420] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.enciphered")) returned 1 [0065.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.enciphered")) returned 1 [0065.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.enciphered")) returned 1 [0065.448] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.enciphered")) returned 1 [0065.467] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.enciphered")) returned 1 [0065.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.enciphered")) returned 1 [0065.476] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.enciphered")) returned 1 [0065.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.enciphered")) returned 1 [0065.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.enciphered")) returned 1 [0065.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.enciphered")) returned 1 [0065.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.enciphered")) returned 1 [0065.617] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.enciphered")) returned 1 [0065.622] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.enciphered")) returned 1 [0065.638] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.enciphered")) returned 1 [0065.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.enciphered")) returned 1 [0065.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.enciphered")) returned 1 [0065.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.enciphered")) returned 1 [0065.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.enciphered")) returned 1 [0065.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.enciphered")) returned 1 [0065.717] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.enciphered")) returned 1 [0065.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.enciphered")) returned 1 [0065.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.enciphered")) returned 1 [0065.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.enciphered")) returned 1 [0065.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.enciphered")) returned 1 [0065.736] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.enciphered")) returned 1 [0065.739] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.enciphered")) returned 1 [0065.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.enciphered")) returned 1 [0065.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.enciphered")) returned 1 [0065.756] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.enciphered")) returned 1 [0065.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.enciphered")) returned 1 [0065.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.enciphered")) returned 1 [0065.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.enciphered")) returned 1 [0065.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.enciphered")) returned 1 [0065.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.enciphered")) returned 1 [0065.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.enciphered")) returned 1 [0065.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.enciphered")) returned 1 [0065.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.enciphered")) returned 1 [0065.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.enciphered")) returned 1 [0065.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.enciphered")) returned 1 [0065.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.enciphered")) returned 1 [0065.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.enciphered")) returned 1 [0065.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.enciphered")) returned 1 [0065.903] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.enciphered")) returned 1 [0065.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.enciphered")) returned 1 [0065.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.enciphered")) returned 1 [0065.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.enciphered")) returned 1 [0065.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.enciphered")) returned 1 [0065.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.enciphered")) returned 1 [0065.922] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.enciphered")) returned 1 [0065.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.enciphered")) returned 1 [0065.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.enciphered")) returned 1 [0065.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.enciphered")) returned 1 [0065.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.enciphered")) returned 1 [0065.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.enciphered")) returned 1 [0065.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.enciphered")) returned 1 [0065.964] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.enciphered")) returned 1 [0065.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.enciphered")) returned 1 [0065.971] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.enciphered")) returned 1 [0065.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.enciphered")) returned 1 [0065.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.enciphered")) returned 1 [0065.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.enciphered")) returned 1 [0065.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.enciphered")) returned 1 [0065.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.enciphered")) returned 1 [0066.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.enciphered")) returned 1 [0066.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.enciphered")) returned 1 [0066.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.enciphered")) returned 1 [0066.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.enciphered")) returned 1 [0066.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.enciphered")) returned 1 [0066.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.enciphered")) returned 1 [0066.085] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.enciphered")) returned 1 [0066.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.enciphered")) returned 1 [0066.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.enciphered")) returned 1 [0066.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.enciphered")) returned 1 [0066.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.enciphered")) returned 1 [0066.122] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.enciphered")) returned 1 [0066.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.enciphered")) returned 1 [0066.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.enciphered")) returned 1 [0066.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.enciphered")) returned 1 [0066.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.enciphered")) returned 1 [0066.140] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.enciphered")) returned 1 [0066.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.enciphered")) returned 1 [0066.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.enciphered")) returned 1 [0066.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.enciphered")) returned 1 [0066.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.enciphered")) returned 1 [0066.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.enciphered")) returned 1 [0066.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.enciphered")) returned 1 [0066.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.enciphered")) returned 1 [0066.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.enciphered")) returned 1 [0066.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg.enciphered")) returned 1 [0066.241] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg.enciphered")) returned 1 [0066.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg.enciphered")) returned 1 [0066.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg.enciphered")) returned 1 [0066.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg.enciphered")) returned 1 [0066.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg.enciphered")) returned 1 [0066.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg.enciphered")) returned 1 [0066.277] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg.enciphered")) returned 1 [0066.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg.enciphered")) returned 1 [0066.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg.enciphered")) returned 1 [0066.285] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg.enciphered")) returned 1 [0066.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg.enciphered")) returned 1 [0066.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg.enciphered")) returned 1 [0066.298] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg.enciphered")) returned 1 [0066.300] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg.enciphered")) returned 1 [0066.303] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg.enciphered")) returned 1 [0066.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg.enciphered")) returned 1 [0066.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg.enciphered")) returned 1 [0066.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg.enciphered")) returned 1 [0066.355] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg.enciphered")) returned 1 [0066.376] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg.enciphered")) returned 1 [0066.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg.enciphered")) returned 1 [0066.382] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg.enciphered")) returned 1 [0066.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg.enciphered")) returned 1 [0066.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg.enciphered")) returned 1 [0066.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg.enciphered")) returned 1 [0066.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg.enciphered")) returned 1 [0066.399] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg.enciphered")) returned 1 [0066.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg.enciphered")) returned 1 [0066.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg.enciphered")) returned 1 [0066.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg.enciphered")) returned 1 [0066.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg.enciphered")) returned 1 [0066.414] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg.enciphered")) returned 1 [0066.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg.enciphered")) returned 1 [0066.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg.enciphered")) returned 1 [0066.438] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg.enciphered")) returned 1 [0066.441] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg.enciphered")) returned 1 [0066.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg.enciphered")) returned 1 [0066.453] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg.enciphered")) returned 1 [0066.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg.enciphered")) returned 1 [0066.497] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg.enciphered")) returned 1 [0066.505] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg.enciphered")) returned 1 [0066.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg.enciphered")) returned 1 [0066.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg.enciphered")) returned 1 [0066.515] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg.enciphered")) returned 1 [0066.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg.enciphered")) returned 1 [0066.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg.enciphered")) returned 1 [0066.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg.enciphered")) returned 1 [0066.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg.enciphered")) returned 1 [0066.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg.enciphered")) returned 1 [0066.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg.enciphered")) returned 1 [0066.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg.enciphered")) returned 1 [0066.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg.enciphered")) returned 1 [0066.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg.enciphered")) returned 1 [0066.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg.enciphered")) returned 1 [0066.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg.enciphered")) returned 1 [0066.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg.enciphered")) returned 1 [0066.592] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg.enciphered")) returned 1 [0066.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg.enciphered")) returned 1 [0066.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg.enciphered")) returned 1 [0066.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg.enciphered")) returned 1 [0066.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg.enciphered")) returned 1 [0066.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg.enciphered")) returned 1 [0066.653] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg.enciphered")) returned 1 [0066.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg.enciphered")) returned 1 [0066.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg.enciphered")) returned 1 [0066.669] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg.enciphered")) returned 1 [0066.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg.enciphered")) returned 1 [0066.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg.enciphered")) returned 1 [0066.683] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg.enciphered")) returned 1 [0066.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg.enciphered")) returned 1 [0066.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg.enciphered")) returned 1 [0066.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg.enciphered")) returned 1 [0066.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg.enciphered")) returned 1 [0066.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg.enciphered")) returned 1 [0066.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg.enciphered")) returned 1 [0066.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg.enciphered")) returned 1 [0066.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg.enciphered")) returned 1 [0066.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg.enciphered")) returned 1 [0066.748] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg.enciphered")) returned 1 [0066.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg.enciphered")) returned 1 [0066.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg.enciphered")) returned 1 [0066.839] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg.enciphered")) returned 1 [0066.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg.enciphered")) returned 1 [0066.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg.enciphered")) returned 1 [0066.851] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg.enciphered")) returned 1 [0066.854] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387337.jpg.enciphered")) returned 1 [0066.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg.enciphered")) returned 1 [0066.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg.enciphered")) returned 1 [0066.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg.enciphered")) returned 1 [0066.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg.enciphered")) returned 1 [0066.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387895.jpg.enciphered")) returned 1 [0066.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg.enciphered")) returned 1 [0066.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png.enciphered")) returned 1 [0066.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png.enciphered")) returned 1 [0066.918] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400003.png.enciphered")) returned 1 [0066.922] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png.enciphered")) returned 1 [0066.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png.enciphered")) returned 1 [0067.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00601G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00601g.gif.enciphered")) returned 1 [0067.011] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp.enciphered")) returned 1 [0067.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp.enciphered")) returned 1 [0067.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg.enciphered")) returned 1 [0067.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01179j.jpg.enciphered")) returned 1 [0067.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg.enciphered")) returned 1 [0067.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg.enciphered")) returned 1 [0067.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp.enciphered")) returned 1 [0067.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01236u.bmp.enciphered")) returned 1 [0067.044] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg.enciphered")) returned 1 [0067.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp.enciphered")) returned 1 [0067.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif.enciphered")) returned 1 [0067.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01265u.bmp.enciphered")) returned 1 [0067.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp.enciphered")) returned 1 [0067.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp.enciphered")) returned 1 [0067.080] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp.enciphered")) returned 1 [0067.084] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp.enciphered")) returned 1 [0067.086] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg.enciphered")) returned 1 [0067.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg.enciphered")) returned 1 [0067.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp.enciphered")) returned 1 [0067.097] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp.enciphered")) returned 1 [0067.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02053j.jpg.enciphered")) returned 1 [0067.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp.enciphered")) returned 1 [0067.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp.enciphered")) returned 1 [0067.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg.enciphered")) returned 1 [0067.124] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02071u.bmp.enciphered")) returned 1 [0067.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp.enciphered")) returned 1 [0067.130] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp.enciphered")) returned 1 [0067.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp.enciphered")) returned 1 [0067.147] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02291u.bmp.enciphered")) returned 1 [0067.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp.enciphered")) returned 1 [0067.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg.enciphered")) returned 1 [0067.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp.enciphered")) returned 1 [0067.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02466u.bmp.enciphered")) returned 1 [0067.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp.enciphered")) returned 1 [0067.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp.enciphered")) returned 1 [0067.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg.enciphered")) returned 1 [0067.297] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736g.gif.enciphered")) returned 1 [0067.357] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp.enciphered")) returned 1 [0067.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp.enciphered")) returned 1 [0067.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif.enciphered")) returned 1 [0067.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740u.bmp.enciphered")) returned 1 [0067.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif.enciphered")) returned 1 [0067.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp.enciphered")) returned 1 [0067.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif.enciphered")) returned 1 [0067.467] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746g.gif.enciphered")) returned 1 [0067.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp.enciphered")) returned 1 [0067.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif.enciphered")) returned 1 [0067.669] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp.enciphered")) returned 1 [0067.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749g.gif.enciphered")) returned 1 [0067.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp.enciphered")) returned 1 [0067.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif.enciphered")) returned 1 [0067.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp.enciphered")) returned 1 [0067.701] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752g.gif.enciphered")) returned 1 [0067.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp.enciphered")) returned 1 [0067.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp.enciphered")) returned 1 [0067.714] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp.enciphered")) returned 1 [0067.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02755u.bmp.enciphered")) returned 1 [0067.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp.enciphered")) returned 1 [0067.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp.enciphered")) returned 1 [0067.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp.enciphered")) returned 1 [0067.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02759j.jpg.enciphered")) returned 1 [0067.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg.enciphered")) returned 1 [0067.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg.enciphered")) returned 1 [0067.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif.enciphered")) returned 1 [0067.763] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02897j.jpg.enciphered")) returned 1 [0067.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp.enciphered")) returned 1 [0067.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp.enciphered")) returned 1 [0067.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif.enciphered")) returned 1 [0067.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03041i.jpg.enciphered")) returned 1 [0067.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg.enciphered")) returned 1 [0067.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg.enciphered")) returned 1 [0067.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg.enciphered")) returned 1 [0067.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03379i.jpg.enciphered")) returned 1 [0067.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg.enciphered")) returned 1 [0067.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg.enciphered")) returned 1 [0067.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01219_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01219_.gif.enciphered")) returned 1 [0067.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01237_.gif.enciphered")) returned 1 [0067.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01238_.gif.enciphered")) returned 1 [0067.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01239_.gif.enciphered")) returned 1 [0067.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01240_.gif.enciphered")) returned 1 [0067.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01241_.gif.enciphered")) returned 1 [0067.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01242_.gif.enciphered")) returned 1 [0067.997] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01243_.gif.enciphered")) returned 1 [0067.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01244_.gif.enciphered")) returned 1 [0068.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01245_.gif.enciphered")) returned 1 [0068.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01246_.gif.enciphered")) returned 1 [0068.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01253_.gif.enciphered")) returned 1 [0068.011] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01268_.gif.enciphered")) returned 1 [0068.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01292_.gif.enciphered")) returned 1 [0068.017] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01293_.gif.enciphered")) returned 1 [0068.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif.enciphered")) returned 1 [0068.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif.enciphered")) returned 1 [0068.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif.enciphered")) returned 1 [0068.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif.enciphered")) returned 1 [0068.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif.enciphered")) returned 1 [0068.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif.enciphered")) returned 1 [0068.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif.enciphered")) returned 1 [0068.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif.enciphered")) returned 1 [0068.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif.enciphered")) returned 1 [0068.044] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01330_.gif.enciphered")) returned 1 [0068.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01734_.gif.enciphered")) returned 1 [0068.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01740_.gif.enciphered")) returned 1 [0068.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01742_.gif.enciphered")) returned 1 [0068.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01743_.gif.enciphered")) returned 1 [0068.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01744_.gif.enciphered")) returned 1 [0068.064] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01745_.gif.enciphered")) returned 1 [0068.066] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01746_.gif.enciphered")) returned 1 [0068.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01747_.gif.enciphered")) returned 1 [0068.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01748_.gif.enciphered")) returned 1 [0068.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01749_.gif.enciphered")) returned 1 [0068.086] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01750_.gif.enciphered")) returned 1 [0068.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01751_.gif.enciphered")) returned 1 [0068.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01770_.gif.enciphered")) returned 1 [0068.097] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01838_.gif.enciphered")) returned 1 [0068.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01839_.gif.enciphered")) returned 1 [0068.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01840_.gif.enciphered")) returned 1 [0068.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01842_.gif.enciphered")) returned 1 [0068.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01843_.gif.enciphered")) returned 1 [0068.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb02229_.gif.enciphered")) returned 1 [0068.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143743.gif.enciphered")) returned 1 [0068.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143744.gif.enciphered")) returned 1 [0068.125] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143745.gif.enciphered")) returned 1 [0068.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143746.gif.enciphered")) returned 1 [0068.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143748.gif.enciphered")) returned 1 [0068.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143749.gif.enciphered")) returned 1 [0068.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143750.gif.enciphered")) returned 1 [0068.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143752.gif.enciphered")) returned 1 [0068.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143753.gif.enciphered")) returned 1 [0068.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143754.gif.enciphered")) returned 1 [0068.148] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143758.gif.enciphered")) returned 1 [0068.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00516l.gif.enciphered")) returned 1 [0068.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00531l.gif.enciphered")) returned 1 [0068.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00673l.gif.enciphered")) returned 1 [0068.319] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00703l.gif.enciphered")) returned 1 [0068.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00760l.gif.enciphered")) returned 1 [0068.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00780l.gif.enciphered")) returned 1 [0068.335] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb01741l.gif.enciphered")) returned 1 [0068.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif.enciphered")) returned 1 [0068.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02055_.gif.enciphered")) returned 1 [0068.355] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02073_.gif.enciphered")) returned 1 [0068.358] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02074_.gif.enciphered")) returned 1 [0068.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02077_.gif.enciphered")) returned 1 [0068.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02082_.gif.enciphered")) returned 1 [0068.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02085_.gif.enciphered")) returned 1 [0068.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02097_.gif.enciphered")) returned 1 [0068.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02106_.gif.enciphered")) returned 1 [0068.500] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02116_.gif.enciphered")) returned 1 [0068.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02134_.gif.enciphered")) returned 1 [0068.510] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02187_.gif.enciphered")) returned 1 [0068.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02198_.gif.enciphered")) returned 1 [0068.515] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02201_.gif.enciphered")) returned 1 [0068.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02214_.gif.enciphered")) returned 1 [0068.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02218_.gif.enciphered")) returned 1 [0068.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10.mp4"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10.mp4.enciphered")) returned 1 [0068.590] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10_rtl.mp4"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10_rtl.mp4.enciphered")) returned 1 [0068.599] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7.wmv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7.wmv.enciphered")) returned 1 [0068.614] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7_rtl.wmv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7_rtl.wmv.enciphered")) returned 1 [0068.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8.mp4"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8.mp4.enciphered")) returned 1 [0068.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8_rtl.mp4"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8_rtl.mp4.enciphered")) returned 1 [0069.082] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\basic.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BASIC.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\basic.htm.enciphered")) returned 1 [0069.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb.enciphered")) returned 1 [0069.305] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc.enciphered")) returned 1 [0069.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt.enciphered")) returned 1 [0069.311] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls.enciphered")) returned 1 [0069.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc.enciphered")) returned 1 [0069.317] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt.enciphered")) returned 1 [0069.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls.enciphered")) returned 1 [0069.383] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR10F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir10f.gif.enciphered")) returned 1 [0069.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR11F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir11f.gif.enciphered")) returned 1 [0069.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR12F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir12f.gif.enciphered")) returned 1 [0069.392] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR13F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir13f.gif.enciphered")) returned 1 [0069.395] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR14F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir14f.gif.enciphered")) returned 1 [0069.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR15F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir15f.gif.enciphered")) returned 1 [0069.400] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR16F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir16f.gif.enciphered")) returned 1 [0069.404] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR17F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir17f.gif.enciphered")) returned 1 [0069.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR18F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir18f.gif.enciphered")) returned 1 [0069.410] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR19F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir19f.gif.enciphered")) returned 1 [0069.414] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1b.gif.enciphered")) returned 1 [0069.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1f.gif.enciphered")) returned 1 [0069.421] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR20F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir20f.gif.enciphered")) returned 1 [0069.478] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR21F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir21f.gif.enciphered")) returned 1 [0069.484] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR22F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir22f.gif.enciphered")) returned 1 [0069.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR23F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir23f.gif.enciphered")) returned 1 [0069.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR24F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir24f.gif.enciphered")) returned 1 [0069.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR25F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir25f.gif.enciphered")) returned 1 [0069.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR26F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir26f.gif.enciphered")) returned 1 [0069.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR27F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir27f.gif.enciphered")) returned 1 [0069.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir28b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR28B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir28b.gif.enciphered")) returned 1 [0069.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR28F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir28f.gif.enciphered")) returned 1 [0069.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir29b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR29B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir29b.gif.enciphered")) returned 1 [0069.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR29F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir29f.gif.enciphered")) returned 1 [0069.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR2B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir2b.gif.enciphered")) returned 1 [0069.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR2F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir2f.gif.enciphered")) returned 1 [0069.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir30b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR30B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir30b.gif.enciphered")) returned 1 [0069.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR30F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir30f.gif.enciphered")) returned 1 [0069.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir31b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR31B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir31b.gif.enciphered")) returned 1 [0069.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR31F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir31f.gif.enciphered")) returned 1 [0069.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32b.gif.enciphered")) returned 1 [0070.014] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32f.gif.enciphered")) returned 1 [0070.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir33b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR33B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir33b.gif.enciphered")) returned 1 [0070.074] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR33F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir33f.gif.enciphered")) returned 1 [0070.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir34b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR34B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir34b.gif.enciphered")) returned 1 [0070.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR34F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir34f.gif.enciphered")) returned 1 [0070.105] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir35b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR35B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir35b.gif.enciphered")) returned 1 [0070.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR35F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir35f.gif.enciphered")) returned 1 [0070.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir36b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR36B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir36b.gif.enciphered")) returned 1 [0070.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR36F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir36f.gif.enciphered")) returned 1 [0070.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR37F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir37f.gif.enciphered")) returned 1 [0070.298] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR38F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir38f.gif.enciphered")) returned 1 [0071.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR39F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir39f.gif.enciphered")) returned 1 [0072.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR3B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir3b.gif.enciphered")) returned 1 [0072.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR3F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir3f.gif.enciphered")) returned 1 [0072.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR40F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir40f.gif.enciphered")) returned 1 [0072.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR41F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir41f.gif.enciphered")) returned 1 [0072.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR42F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir42f.gif.enciphered")) returned 1 [0072.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR43B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir43b.gif.enciphered")) returned 1 [0072.199] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR43F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir43f.gif.enciphered")) returned 1 [0072.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR44B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir44b.gif.enciphered")) returned 1 [0072.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR44F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir44f.gif.enciphered")) returned 1 [0072.225] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR45B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir45b.gif.enciphered")) returned 1 [0072.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR45F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir45f.gif.enciphered")) returned 1 [0072.309] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR46B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir46b.gif.enciphered")) returned 1 [0072.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR46F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir46f.gif.enciphered")) returned 1 [0072.319] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR47B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir47b.gif.enciphered")) returned 1 [0072.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR47F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir47f.gif.enciphered")) returned 1 [0072.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR48B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir48b.gif.enciphered")) returned 1 [0072.327] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR48F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir48f.gif.enciphered")) returned 1 [0072.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR49B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir49b.gif.enciphered")) returned 1 [0072.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR49F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir49f.gif.enciphered")) returned 1 [0072.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR4B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir4b.gif.enciphered")) returned 1 [0072.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR4F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir4f.gif.enciphered")) returned 1 [0072.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50b.gif.enciphered")) returned 1 [0072.400] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50f.gif.enciphered")) returned 1 [0072.406] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR51B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir51b.gif.enciphered")) returned 1 [0072.409] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR51F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir51f.gif.enciphered")) returned 1 [0072.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR5B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir5b.gif.enciphered")) returned 1 [0072.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR5F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir5f.gif.enciphered")) returned 1 [0072.420] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR6B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir6b.gif.enciphered")) returned 1 [0072.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR6F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir6f.gif.enciphered")) returned 1 [0072.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR7B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir7b.gif.enciphered")) returned 1 [0072.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR7F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir7f.gif.enciphered")) returned 1 [0072.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR8B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir8b.gif.enciphered")) returned 1 [0072.443] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR8F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir8f.gif.enciphered")) returned 1 [0072.446] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR9B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir9b.gif.enciphered")) returned 1 [0072.453] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR9F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir9f.gif.enciphered")) returned 1 [0072.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir00.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR00.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir00.gif.enciphered")) returned 1 [0072.458] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR10F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir10f.gif.enciphered")) returned 1 [0072.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR11F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir11f.gif.enciphered")) returned 1 [0072.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR12F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir12f.gif.enciphered")) returned 1 [0072.481] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR13F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir13f.gif.enciphered")) returned 1 [0072.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR14F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir14f.gif.enciphered")) returned 1 [0072.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR15F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir15f.gif.enciphered")) returned 1 [0072.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR16F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir16f.gif.enciphered")) returned 1 [0072.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR17F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir17f.gif.enciphered")) returned 1 [0072.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR18F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir18f.gif.enciphered")) returned 1 [0072.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR19F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir19f.gif.enciphered")) returned 1 [0072.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR1B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir1b.gif.enciphered")) returned 1 [0072.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR1F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir1f.gif.enciphered")) returned 1 [0072.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR20F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir20f.gif.enciphered")) returned 1 [0072.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR21F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir21f.gif.enciphered")) returned 1 [0072.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR22F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir22f.gif.enciphered")) returned 1 [0072.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR23F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir23f.gif.enciphered")) returned 1 [0072.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR24F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir24f.gif.enciphered")) returned 1 [0072.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR25F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir25f.gif.enciphered")) returned 1 [0072.574] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR26F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir26f.gif.enciphered")) returned 1 [0072.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR27F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir27f.gif.enciphered")) returned 1 [0072.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR28F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir28f.gif.enciphered")) returned 1 [0072.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR29F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir29f.gif.enciphered")) returned 1 [0072.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR2B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir2b.gif.enciphered")) returned 1 [0072.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR2F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir2f.gif.enciphered")) returned 1 [0072.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR30F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir30f.gif.enciphered")) returned 1 [0072.600] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR31F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir31f.gif.enciphered")) returned 1 [0072.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR32F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir32f.gif.enciphered")) returned 1 [0072.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR33F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir33f.gif.enciphered")) returned 1 [0072.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR34F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir34f.gif.enciphered")) returned 1 [0072.622] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR35F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir35f.gif.enciphered")) returned 1 [0072.634] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR36F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir36f.gif.enciphered")) returned 1 [0072.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR37F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir37f.gif.enciphered")) returned 1 [0072.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR38F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir38f.gif.enciphered")) returned 1 [0072.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR39F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir39f.gif.enciphered")) returned 1 [0072.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR3B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir3b.gif.enciphered")) returned 1 [0072.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR3F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir3f.gif.enciphered")) returned 1 [0072.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR40F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir40f.gif.enciphered")) returned 1 [0072.705] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR41F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir41f.gif.enciphered")) returned 1 [0072.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR42F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir42f.gif.enciphered")) returned 1 [0072.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR43B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir43b.gif.enciphered")) returned 1 [0072.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR43F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir43f.gif.enciphered")) returned 1 [0072.718] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR44B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir44b.gif.enciphered")) returned 1 [0072.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR44F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir44f.gif.enciphered")) returned 1 [0072.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR45B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir45b.gif.enciphered")) returned 1 [0072.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR45F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir45f.gif.enciphered")) returned 1 [0072.748] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR46B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir46b.gif.enciphered")) returned 1 [0072.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR46F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir46f.gif.enciphered")) returned 1 [0072.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR47B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir47b.gif.enciphered")) returned 1 [0072.756] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR47F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir47f.gif.enciphered")) returned 1 [0072.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR48B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir48b.gif.enciphered")) returned 1 [0072.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR48F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir48f.gif.enciphered")) returned 1 [0072.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR49B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir49b.gif.enciphered")) returned 1 [0072.771] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR49F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir49f.gif.enciphered")) returned 1 [0072.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR4B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir4b.gif.enciphered")) returned 1 [0072.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR4F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir4f.gif.enciphered")) returned 1 [0072.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR50B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir50b.gif.enciphered")) returned 1 [0072.833] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR50F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir50f.gif.enciphered")) returned 1 [0072.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51b.gif.enciphered")) returned 1 [0072.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51f.gif.enciphered")) returned 1 [0072.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5b.gif.enciphered")) returned 1 [0072.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5f.gif.enciphered")) returned 1 [0072.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6b.gif.enciphered")) returned 1 [0072.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6f.gif.enciphered")) returned 1 [0072.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7b.gif.enciphered")) returned 1 [0072.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7f.gif.enciphered")) returned 1 [0072.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8b.gif.enciphered")) returned 1 [0072.883] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8f.gif.enciphered")) returned 1 [0072.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9b.gif.enciphered")) returned 1 [0072.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9f.gif.enciphered")) returned 1 [0072.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\clntwrap.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\clntwrap.htm.enciphered")) returned 1 [0073.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bi-report.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bi-report.png.enciphered")) returned 1 [0074.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_expiration_terms_dict.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_expiration_terms_dict.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_expiration_terms_dict.txt.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_expiration_terms_dict.txt.enciphered")) returned 1 [0074.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_security_terms_dict.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_security_terms_dict.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_security_terms_dict.txt.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_security_terms_dict.txt.enciphered")) returned 1 [0074.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_terms_dict.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_terms_dict.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_terms_dict.txt.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_terms_dict.txt.enciphered")) returned 1 [0074.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\ssn_high_group_info.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\ssn_high_group_info.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\ssn_high_group_info.txt.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\ssn_high_group_info.txt.enciphered")) returned 1 [0074.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\groove.net\\components\\signedcomponents.cer.enciphered")) returned 1 [0074.538] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer.enciphered")) returned 1 [0074.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\groove.net\\servers\\management.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\groove.net\\servers\\management.cer.enciphered")) returned 1 [0074.546] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\groove.net\\servers\\relay.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\groove.net\\servers\\relay.cer.enciphered")) returned 1 [0074.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer.enciphered")) returned 1 [0074.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer.enciphered")) returned 1 [0074.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer.enciphered")) returned 1 [0074.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\cough.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\COUGH.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\cough.wav.enciphered")) returned 1 [0074.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\giggle.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\GIGGLE.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\giggle.wav.enciphered")) returned 1 [0074.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\hiccup.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\HICCUP.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\hiccup.wav.enciphered")) returned 1 [0074.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\mmhmm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\MMHMM.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\mmhmm.wav.enciphered")) returned 1 [0074.622] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\sneeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\SNEEZE.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\sneeze.wav.enciphered")) returned 1 [0074.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\throat.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\THROAT.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\throat.wav.enciphered")) returned 1 [0074.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\whistling.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\Whistling.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\whistling.wav.enciphered")) returned 1 [0074.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\alarm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\ALARM.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\alarm.wav.enciphered")) returned 1 [0074.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\buzz.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\BUZZ.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\buzz.wav.enciphered")) returned 1 [0074.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\LASER.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\laser.wav.enciphered")) returned 1 [0074.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\radar.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\RADAR.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\radar.wav.enciphered")) returned 1 [0074.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\toot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\TOOT.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\toot.wav.enciphered")) returned 1 [0074.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\vibe.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\VIBE.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\vibe.wav.enciphered")) returned 1 [0074.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\warn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\WARN.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\warn.wav.enciphered")) returned 1 [0074.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\can.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\CAN.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\can.wav.enciphered")) returned 1 [0074.955] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\coupler.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\COUPLER.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\coupler.wav.enciphered")) returned 1 [0074.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\horn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\HORN.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\horn.wav.enciphered")) returned 1 [0074.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\shot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SHOT.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\shot.wav.enciphered")) returned 1 [0074.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\shovel.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SHOVEL.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\shovel.wav.enciphered")) returned 1 [0074.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\splash.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SPLASH.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\splash.wav.enciphered")) returned 1 [0074.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\WHOOSH.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\whoosh.wav.enciphered")) returned 1 [0075.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\DataListIconImages.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\datalisticonimages.jpg.enciphered")) returned 1 [0075.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\datalisticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\datalisticonimagesmask.bmp.enciphered")) returned 1 [0075.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\grip.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\GRIP.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\grip.jpg.enciphered")) returned 1 [0075.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\gripmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\GRIPMASK.BMP.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\gripmask.bmp.enciphered")) returned 1 [0075.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\InformationIcon.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\informationicon.jpg.enciphered")) returned 1 [0075.148] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\informationiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\InformationIconMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\informationiconmask.bmp.enciphered")) returned 1 [0075.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logindialogbackground.jpg.enciphered")) returned 1 [0075.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logintool24x24images.jpg.enciphered")) returned 1 [0075.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logintool24x24imagesmask.bmp.enciphered")) returned 1 [0075.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messageattachmenticonimages.jpg.enciphered")) returned 1 [0075.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp.enciphered")) returned 1 [0075.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messagehistoryiconimages.jpg.enciphered")) returned 1 [0075.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp.enciphered")) returned 1 [0075.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierBackground.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierbackground.jpg.enciphered")) returned 1 [0075.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierbackgroundrtl.jpg.enciphered")) returned 1 [0075.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierclosebutton.jpg.enciphered")) returned 1 [0075.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdisabledownarrow.jpg.enciphered")) returned 1 [0075.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdisableuparrow.jpg.enciphered")) returned 1 [0075.204] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdownarrow.jpg.enciphered")) returned 1 [0075.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifieruparrow.jpg.enciphered")) returned 1 [0075.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierwindowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierwindowmask.bmp.enciphered")) returned 1 [0075.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierwindowmaskrtl.bmp.enciphered")) returned 1 [0075.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\outofsynciconimages.jpg.enciphered")) returned 1 [0075.218] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\outofsynciconimagesmask.bmp.enciphered")) returned 1 [0075.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\QuestionIcon.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\questionicon.jpg.enciphered")) returned 1 [0075.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\questioniconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\QuestionIconMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\questioniconmask.bmp.enciphered")) returned 1 [0075.248] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared16x16Images.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared16x16images.jpg.enciphered")) returned 1 [0075.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared16x16imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared16x16imagesmask.bmp.enciphered")) returned 1 [0075.253] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared24x24Images.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared24x24images.jpg.enciphered")) returned 1 [0075.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared24x24imagesmask.bmp.enciphered")) returned 1 [0075.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\stopicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\STOPICON.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\stopicon.jpg.enciphered")) returned 1 [0075.261] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\stopiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\StopIconMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\stopiconmask.bmp.enciphered")) returned 1 [0075.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\taskbariconimages256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\taskbariconimages256colors.bmp.enciphered")) returned 1 [0075.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp.enciphered")) returned 1 [0075.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TipsImage.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\tipsimage.jpg.enciphered")) returned 1 [0075.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\tipsimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TipsImageMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\tipsimagemask.bmp.enciphered")) returned 1 [0075.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\VeriSignLogo.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\verisignlogo.jpg.enciphered")) returned 1 [0075.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.enciphered")) returned 1 [0075.285] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp.enciphered")) returned 1 [0075.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.enciphered")) returned 1 [0075.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp.enciphered")) returned 1 [0075.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.enciphered")) returned 1 [0075.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp.enciphered")) returned 1 [0075.350] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.enciphered")) returned 1 [0075.353] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp.enciphered")) returned 1 [0075.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.enciphered")) returned 1 [0075.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp.enciphered")) returned 1 [0075.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.enciphered")) returned 1 [0075.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp.enciphered")) returned 1 [0075.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.enciphered")) returned 1 [0075.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp.enciphered")) returned 1 [0075.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.enciphered")) returned 1 [0075.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp.enciphered")) returned 1 [0075.452] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.enciphered")) returned 1 [0075.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp.enciphered")) returned 1 [0075.510] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp.enciphered")) returned 1 [0075.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.enciphered")) returned 1 [0075.516] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.enciphered")) returned 1 [0075.519] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp.enciphered")) returned 1 [0075.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp.enciphered")) returned 1 [0075.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.enciphered")) returned 1 [0075.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.enciphered")) returned 1 [0075.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp.enciphered")) returned 1 [0075.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.enciphered")) returned 1 [0075.536] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.enciphered")) returned 1 [0075.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp.enciphered")) returned 1 [0075.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.enciphered")) returned 1 [0075.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp.enciphered")) returned 1 [0075.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-100.png.enciphered")) returned 1 [0075.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-140.png.enciphered")) returned 1 [0075.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-180.png.enciphered")) returned 1 [0075.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-80.png.enciphered")) returned 1 [0075.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-100.png.enciphered")) returned 1 [0075.623] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-140.png.enciphered")) returned 1 [0075.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-180.png.enciphered")) returned 1 [0075.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-80.png.enciphered")) returned 1 [0075.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-100.png.enciphered")) returned 1 [0075.673] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-140.png.enciphered")) returned 1 [0075.676] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-180.png.enciphered")) returned 1 [0075.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-80.png.enciphered")) returned 1 [0075.683] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-100.png.enciphered")) returned 1 [0075.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-140.png.enciphered")) returned 1 [0075.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-180.png.enciphered")) returned 1 [0075.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-80.png.enciphered")) returned 1 [0075.697] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-100.png.enciphered")) returned 1 [0075.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-140.png.enciphered")) returned 1 [0075.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-180.png.enciphered")) returned 1 [0075.705] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-80.png.enciphered")) returned 1 [0075.708] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-100.png.enciphered")) returned 1 [0075.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-140.png.enciphered")) returned 1 [0075.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-180.png.enciphered")) returned 1 [0075.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-80.png.enciphered")) returned 1 [0075.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-100.png.enciphered")) returned 1 [0075.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-140.png.enciphered")) returned 1 [0075.898] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-180.png.enciphered")) returned 1 [0075.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-80.png.enciphered")) returned 1 [0075.905] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-100.png.enciphered")) returned 1 [0075.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-140.png.enciphered")) returned 1 [0075.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-180.png.enciphered")) returned 1 [0075.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-80.png.enciphered")) returned 1 [0075.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-100.png.enciphered")) returned 1 [0075.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-140.png.enciphered")) returned 1 [0075.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-180.png.enciphered")) returned 1 [0075.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-80.png.enciphered")) returned 1 [0075.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-100.png.enciphered")) returned 1 [0075.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-140.png.enciphered")) returned 1 [0075.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-180.png.enciphered")) returned 1 [0075.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-80.png.enciphered")) returned 1 [0075.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-100.png.enciphered")) returned 1 [0075.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-140.png.enciphered")) returned 1 [0075.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-180.png.enciphered")) returned 1 [0075.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-80.png.enciphered")) returned 1 [0075.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-100.png.enciphered")) returned 1 [0075.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-140.png.enciphered")) returned 1 [0076.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-180.png.enciphered")) returned 1 [0076.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-80.png.enciphered")) returned 1 [0076.125] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-100.png.enciphered")) returned 1 [0076.140] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-140.png.enciphered")) returned 1 [0076.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-180.png.enciphered")) returned 1 [0076.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-80.png.enciphered")) returned 1 [0076.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-100.png.enciphered")) returned 1 [0076.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-140.png.enciphered")) returned 1 [0076.179] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-180.png.enciphered")) returned 1 [0076.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-80.png.enciphered")) returned 1 [0076.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-100.png.enciphered")) returned 1 [0076.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-140.png.enciphered")) returned 1 [0076.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-180.png.enciphered")) returned 1 [0076.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-80.png.enciphered")) returned 1 [0076.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-100.png.enciphered")) returned 1 [0076.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-140.png.enciphered")) returned 1 [0076.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-180.png.enciphered")) returned 1 [0076.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-80.png.enciphered")) returned 1 [0076.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-100.png.enciphered")) returned 1 [0076.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-140.png.enciphered")) returned 1 [0076.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-180.png.enciphered")) returned 1 [0076.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-80.png.enciphered")) returned 1 [0076.288] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-100.png.enciphered")) returned 1 [0076.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-140.png.enciphered")) returned 1 [0076.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-180.png.enciphered")) returned 1 [0076.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-80.png.enciphered")) returned 1 [0076.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-100.png.enciphered")) returned 1 [0076.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-140.png.enciphered")) returned 1 [0076.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-180.png.enciphered")) returned 1 [0076.355] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-80.png.enciphered")) returned 1 [0076.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-100.png.enciphered")) returned 1 [0076.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-140.png.enciphered")) returned 1 [0076.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-180.png.enciphered")) returned 1 [0076.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-80.png.enciphered")) returned 1 [0076.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-100.png.enciphered")) returned 1 [0076.416] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-140.png.enciphered")) returned 1 [0076.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-180.png.enciphered")) returned 1 [0076.421] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-80.png.enciphered")) returned 1 [0076.423] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-100.png.enciphered")) returned 1 [0076.426] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-140.png.enciphered")) returned 1 [0076.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-180.png.enciphered")) returned 1 [0076.431] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-80.png.enciphered")) returned 1 [0076.434] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-100.png.enciphered")) returned 1 [0076.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-140.png.enciphered")) returned 1 [0076.439] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-180.png.enciphered")) returned 1 [0076.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-80.png.enciphered")) returned 1 [0076.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-100.png.enciphered")) returned 1 [0076.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-140.png.enciphered")) returned 1 [0076.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-180.png.enciphered")) returned 1 [0076.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-80.png.enciphered")) returned 1 [0076.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-100.png.enciphered")) returned 1 [0076.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-140.png.enciphered")) returned 1 [0076.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-180.png.enciphered")) returned 1 [0076.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-80.png.enciphered")) returned 1 [0076.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-100.png.enciphered")) returned 1 [0076.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-140.png.enciphered")) returned 1 [0076.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-180.png.enciphered")) returned 1 [0076.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-80.png.enciphered")) returned 1 [0076.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-100.png.enciphered")) returned 1 [0076.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-140.png.enciphered")) returned 1 [0076.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-180.png.enciphered")) returned 1 [0076.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-80.png.enciphered")) returned 1 [0076.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-100.png.enciphered")) returned 1 [0076.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-140.png.enciphered")) returned 1 [0076.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-180.png.enciphered")) returned 1 [0076.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-80.png.enciphered")) returned 1 [0076.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-100.png.enciphered")) returned 1 [0076.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-140.png.enciphered")) returned 1 [0076.688] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-180.png.enciphered")) returned 1 [0076.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-80.png.enciphered")) returned 1 [0076.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-100.png.enciphered")) returned 1 [0076.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-140.png.enciphered")) returned 1 [0076.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-180.png.enciphered")) returned 1 [0076.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-80.png.enciphered")) returned 1 [0076.726] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-100.png.enciphered")) returned 1 [0076.728] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-140.png.enciphered")) returned 1 [0076.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-180.png.enciphered")) returned 1 [0076.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-80.png.enciphered")) returned 1 [0076.747] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-100.png.enciphered")) returned 1 [0076.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-140.png.enciphered")) returned 1 [0076.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-180.png.enciphered")) returned 1 [0076.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-80.png.enciphered")) returned 1 [0076.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-100.png.enciphered")) returned 1 [0076.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-140.png.enciphered")) returned 1 [0076.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-180.png.enciphered")) returned 1 [0076.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-80.png.enciphered")) returned 1 [0076.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-100.png.enciphered")) returned 1 [0076.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-140.png.enciphered")) returned 1 [0076.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-180.png.enciphered")) returned 1 [0076.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-80.png.enciphered")) returned 1 [0076.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-100.png.enciphered")) returned 1 [0076.845] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-140.png.enciphered")) returned 1 [0076.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-180.png.enciphered")) returned 1 [0076.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-80.png.enciphered")) returned 1 [0076.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-100.png.enciphered")) returned 1 [0076.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-140.png.enciphered")) returned 1 [0076.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-180.png.enciphered")) returned 1 [0076.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-80.png.enciphered")) returned 1 [0076.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-100.png.enciphered")) returned 1 [0076.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-140.png.enciphered")) returned 1 [0076.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-180.png.enciphered")) returned 1 [0076.959] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-80.png.enciphered")) returned 1 [0076.961] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-100.png.enciphered")) returned 1 [0076.964] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-140.png.enciphered")) returned 1 [0076.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-180.png.enciphered")) returned 1 [0076.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-80.png.enciphered")) returned 1 [0076.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-100.png.enciphered")) returned 1 [0076.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-140.png.enciphered")) returned 1 [0076.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-180.png.enciphered")) returned 1 [0076.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-80.png.enciphered")) returned 1 [0076.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-100.png.enciphered")) returned 1 [0076.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-140.png.enciphered")) returned 1 [0076.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-180.png.enciphered")) returned 1 [0077.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-80.png.enciphered")) returned 1 [0077.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-100.png.enciphered")) returned 1 [0077.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-140.png.enciphered")) returned 1 [0077.072] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-180.png.enciphered")) returned 1 [0077.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-80.png.enciphered")) returned 1 [0077.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-100.png.enciphered")) returned 1 [0077.086] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-140.png.enciphered")) returned 1 [0077.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-180.png.enciphered")) returned 1 [0077.091] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-80.png.enciphered")) returned 1 [0077.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-100.png.enciphered")) returned 1 [0077.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-140.png.enciphered")) returned 1 [0077.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-180.png.enciphered")) returned 1 [0077.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-80.png.enciphered")) returned 1 [0077.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-100.png.enciphered")) returned 1 [0077.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-140.png.enciphered")) returned 1 [0077.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-180.png.enciphered")) returned 1 [0077.154] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-80.png.enciphered")) returned 1 [0077.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-100.png.enciphered")) returned 1 [0077.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-140.png.enciphered")) returned 1 [0077.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-180.png.enciphered")) returned 1 [0077.202] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-80.png.enciphered")) returned 1 [0077.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-100.png.enciphered")) returned 1 [0077.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-140.png.enciphered")) returned 1 [0077.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-180.png.enciphered")) returned 1 [0077.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-80.png.enciphered")) returned 1 [0077.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-100.png.enciphered")) returned 1 [0077.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-140.png.enciphered")) returned 1 [0077.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-180.png.enciphered")) returned 1 [0077.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-80.png.enciphered")) returned 1 [0077.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-100.png.enciphered")) returned 1 [0077.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-140.png.enciphered")) returned 1 [0077.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-180.png.enciphered")) returned 1 [0077.284] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-80.png.enciphered")) returned 1 [0077.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-100.png.enciphered")) returned 1 [0077.289] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-140.png.enciphered")) returned 1 [0077.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-180.png.enciphered")) returned 1 [0077.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-80.png.enciphered")) returned 1 [0077.297] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-100.png.enciphered")) returned 1 [0077.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-140.png.enciphered")) returned 1 [0077.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-180.png.enciphered")) returned 1 [0077.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-80.png.enciphered")) returned 1 [0077.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-100.png.enciphered")) returned 1 [0077.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-140.png.enciphered")) returned 1 [0077.313] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-180.png.enciphered")) returned 1 [0077.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-80.png.enciphered")) returned 1 [0077.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-100.png.enciphered")) returned 1 [0077.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-140.png.enciphered")) returned 1 [0077.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-180.png.enciphered")) returned 1 [0077.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-80.png.enciphered")) returned 1 [0077.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-100.png.enciphered")) returned 1 [0077.382] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-140.png.enciphered")) returned 1 [0077.385] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-180.png.enciphered")) returned 1 [0077.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-80.png.enciphered")) returned 1 [0077.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-100.png.enciphered")) returned 1 [0077.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-140.png.enciphered")) returned 1 [0077.399] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-180.png.enciphered")) returned 1 [0077.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-80.png.enciphered")) returned 1 [0077.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-100.png.enciphered")) returned 1 [0077.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-140.png.enciphered")) returned 1 [0077.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-180.png.enciphered")) returned 1 [0077.536] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-80.png.enciphered")) returned 1 [0077.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-100.png.enciphered")) returned 1 [0077.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-140.png.enciphered")) returned 1 [0077.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-180.png.enciphered")) returned 1 [0077.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-80.png.enciphered")) returned 1 [0077.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-100.png.enciphered")) returned 1 [0077.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-140.png.enciphered")) returned 1 [0077.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-180.png.enciphered")) returned 1 [0077.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-80.png.enciphered")) returned 1 [0077.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-100.png.enciphered")) returned 1 [0077.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-140.png.enciphered")) returned 1 [0077.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-180.png.enciphered")) returned 1 [0077.642] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-80.png.enciphered")) returned 1 [0077.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-100.png.enciphered")) returned 1 [0077.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-140.png.enciphered")) returned 1 [0077.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-180.png.enciphered")) returned 1 [0077.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-80.png.enciphered")) returned 1 [0077.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-100.png.enciphered")) returned 1 [0077.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-140.png.enciphered")) returned 1 [0077.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-180.png.enciphered")) returned 1 [0077.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-80.png.enciphered")) returned 1 [0077.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-100.png.enciphered")) returned 1 [0077.892] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-140.png.enciphered")) returned 1 [0077.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-180.png.enciphered")) returned 1 [0077.898] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-80.png.enciphered")) returned 1 [0077.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-100.png.enciphered")) returned 1 [0077.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-140.png.enciphered")) returned 1 [0077.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-180.png.enciphered")) returned 1 [0077.909] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-80.png.enciphered")) returned 1 [0077.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-100.png.enciphered")) returned 1 [0077.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-140.png.enciphered")) returned 1 [0077.964] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-180.png.enciphered")) returned 1 [0077.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-80.png.enciphered")) returned 1 [0077.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-100.png.enciphered")) returned 1 [0077.973] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-140.png.enciphered")) returned 1 [0077.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-180.png.enciphered")) returned 1 [0077.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-80.png.enciphered")) returned 1 [0077.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-100.png.enciphered")) returned 1 [0077.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-140.png.enciphered")) returned 1 [0077.992] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-180.png.enciphered")) returned 1 [0078.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-80.png.enciphered")) returned 1 [0078.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-100.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-100.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-100.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-100.png.enciphered")) returned 1 [0078.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-140.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-140.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-140.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-140.png.enciphered")) returned 1 [0078.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-180.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-180.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-180.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-180.png.enciphered")) returned 1 [0078.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-80.png.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-80.png.enciphered")) returned 1 [0078.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Lync2013_Third_Party_Notices.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync2013_third_party_notices.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Lync2013_Third_Party_Notices.txt.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync2013_third_party_notices.txt.enciphered")) returned 1 [0078.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\applause.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\APPLAUSE.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\applause.wav.enciphered")) returned 1 [0078.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\arrow.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\ARROW.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\arrow.wav.enciphered")) returned 1 [0078.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\bomb.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\BOMB.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\bomb.wav.enciphered")) returned 1 [0078.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\breeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\BREEZE.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\breeze.wav.enciphered")) returned 1 [0078.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\camera.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CAMERA.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\camera.wav.enciphered")) returned 1 [0078.124] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\cashreg.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CASHREG.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\cashreg.wav.enciphered")) returned 1 [0078.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\chimes.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CHIMES.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\chimes.wav.enciphered")) returned 1 [0078.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\click.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CLICK.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\click.wav.enciphered")) returned 1 [0078.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\coin.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\COIN.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\coin.wav.enciphered")) returned 1 [0078.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\DefaultHold.wma" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\defaulthold.wma"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\DefaultHold.wma.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\defaulthold.wma.enciphered")) returned 1 [0078.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\drumroll.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\DRUMROLL.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\drumroll.wav.enciphered")) returned 1 [0078.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\explode.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\EXPLODE.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\explode.wav.enciphered")) returned 1 [0078.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\hammer.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\HAMMER.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\hammer.wav.enciphered")) returned 1 [0078.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LASER.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\laser.wav.enciphered")) returned 1 [0078.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_abbrdialtone.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_abbrdialtone.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_abbrdialtone.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_abbrdialtone.wav.enciphered")) returned 1 [0078.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ActivePresenterChange.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_activepresenterchange.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ActivePresenterChange.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_activepresenterchange.wav.enciphered")) returned 1 [0078.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_appinvite.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_appinvite.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_appinvite.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_appinvite.wav.enciphered")) returned 1 [0078.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_busy.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_busy.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_busy.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_busy.wav.enciphered")) returned 1 [0078.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_callended.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_callended.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_callended.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_callended.wav.enciphered")) returned 1 [0078.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ChangeModality.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_changemodality.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ChangeModality.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_changemodality.wav.enciphered")) returned 1 [0078.284] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_connecting.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_connecting.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_connecting.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_connecting.wav.enciphered")) returned 1 [0078.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dialtone.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dialtone.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dialtone.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dialtone.wav.enciphered")) returned 1 [0078.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf0.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf0.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf0.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf0.wav.enciphered")) returned 1 [0078.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf1.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf1.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf1.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf1.wav.enciphered")) returned 1 [0078.343] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf2.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf2.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf2.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf2.wav.enciphered")) returned 1 [0078.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf3.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf3.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf3.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf3.wav.enciphered")) returned 1 [0078.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf4.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf4.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf4.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf4.wav.enciphered")) returned 1 [0078.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf5.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf5.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf5.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf5.wav.enciphered")) returned 1 [0078.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf6.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf6.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf6.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf6.wav.enciphered")) returned 1 [0078.357] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf7.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf7.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf7.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf7.wav.enciphered")) returned 1 [0078.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf8.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf8.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf8.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf8.wav.enciphered")) returned 1 [0078.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf9.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf9.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf9.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf9.wav.enciphered")) returned 1 [0078.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmfpound.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmfpound.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmfpound.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmfpound.wav.enciphered")) returned 1 [0078.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmfstar.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmfstar.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmfstar.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmfstar.wav.enciphered")) returned 1 [0078.375] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_fastbusy.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_fastbusy.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_fastbusy.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_fastbusy.wav.enciphered")) returned 1 [0078.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_fsringing.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_fsringing.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_fsringing.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_fsringing.wav.enciphered")) returned 1 [0078.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_howler.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_howler.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_howler.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_howler.wav.enciphered")) returned 1 [0078.441] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_iminvite.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_iminvite.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_iminvite.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_iminvite.wav.enciphered")) returned 1 [0078.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_joinedconference.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_joinedconference.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_joinedconference.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_joinedconference.wav.enciphered")) returned 1 [0078.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_muting.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_muting.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_muting.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_muting.wav.enciphered")) returned 1 [0078.546] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_newim.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_newim.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_newim.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_newim.wav.enciphered")) returned 1 [0078.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_onhold.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_onhold.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_onhold.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_onhold.wav.enciphered")) returned 1 [0078.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_presence.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_presence.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_presence.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_presence.wav.enciphered")) returned 1 [0078.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_redirect.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_redirect.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_redirect.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_redirect.wav.enciphered")) returned 1 [0078.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringback.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringback.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringback.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringback.wav.enciphered")) returned 1 [0078.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringing.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringing.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringing.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringing.wav.enciphered")) returned 1 [0078.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone2.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone2.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone2.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone2.wav.enciphered")) returned 1 [0078.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone3.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone3.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone3.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone3.wav.enciphered")) returned 1 [0078.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone4.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone4.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone4.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone4.wav.enciphered")) returned 1 [0079.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone5.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone5.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone5.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone5.wav.enciphered")) returned 1 [0079.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone6.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone6.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone6.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone6.wav.enciphered")) returned 1 [0079.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone7.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone7.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone7.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone7.wav.enciphered")) returned 1 [0079.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_secondcall.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_secondcall.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_secondcall.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_secondcall.wav.enciphered")) returned 1 [0079.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_untag.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_untag.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_untag.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_untag.wav.enciphered")) returned 1 [0079.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_videoadded.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_videoadded.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_videoadded.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_videoadded.wav.enciphered")) returned 1 [0079.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_videocall.wav" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_videocall.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_videocall.wav.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_videocall.wav.enciphered")) returned 1 [0079.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\push.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\PUSH.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\push.wav.enciphered")) returned 1 [0079.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\suction.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\SUCTION.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\suction.wav.enciphered")) returned 1 [0079.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\type.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\TYPE.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\type.wav.enciphered")) returned 1 [0079.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\voltage.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\VOLTAGE.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\voltage.wav.enciphered")) returned 1 [0079.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\WHOOSH.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\whoosh.wav.enciphered")) returned 1 [0079.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\wind.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\WIND.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\wind.wav.enciphered")) returned 1 [0079.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Model.zip" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.model.zip"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Model.zip.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.model.zip.enciphered")) returned 1 [0079.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Utilities.Controls.zip" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.utilities.controls.zip"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Utilities.Controls.zip.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.utilities.controls.zip.enciphered")) returned 1 [0079.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Utilities.zip" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.utilities.zip"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Utilities.zip.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.utilities.zip.enciphered")) returned 1 [0079.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Ocomprivate.zip" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ocomprivate.zip"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Ocomprivate.zip.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ocomprivate.zip.enciphered")) returned 1 [0079.992] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\reminder.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\REMINDER.WAV.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\reminder.wav.enciphered")) returned 1 [0080.001] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\SAMPLES\\SOLVSAMP.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\samples\\solvsamp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\SAMPLES\\SOLVSAMP.XLS.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\samples\\solvsamp.xls.enciphered")) returned 1 [0080.006] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\System.Windows.Controls.Theming.Toolkit.zip" (normalized: "c:\\program files\\microsoft office\\root\\office16\\system.windows.controls.theming.toolkit.zip"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\System.Windows.Controls.Theming.Toolkit.zip.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\system.windows.controls.theming.toolkit.zip.enciphered")) returned 1 [0080.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.DWG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.dwg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.DWG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.dwg.enciphered")) returned 1 [0080.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.jpg.enciphered")) returned 1 [0080.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCKS.DWG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\blocks.dwg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCKS.DWG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\blocks.dwg.enciphered")) returned 1 [0080.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGDATA.TXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgdata.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGDATA.TXT.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgdata.txt.enciphered")) returned 1 [0080.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGDATA.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgdata.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGDATA.XLS.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgdata.xls.enciphered")) returned 1 [0080.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\CURRENCY.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\currency.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\CURRENCY.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\currency.gif.enciphered")) returned 1 [0080.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\CURRENCY.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\currency.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\CURRENCY.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\currency.htm.enciphered")) returned 1 [0080.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\DADSHIRT.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\dadshirt.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\DADSHIRT.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\dadshirt.gif.enciphered")) returned 1 [0080.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\DADSHIRT.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\dadshirt.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\DADSHIRT.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\dadshirt.htm.enciphered")) returned 1 [0080.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUDGESCH.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\judgesch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUDGESCH.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\judgesch.gif.enciphered")) returned 1 [0080.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUDGESCH.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\judgesch.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUDGESCH.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\judgesch.htm.enciphered")) returned 1 [0080.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUNGLE.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\jungle.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUNGLE.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\jungle.gif.enciphered")) returned 1 [0080.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\jungle.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUNGLE.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\jungle.htm.enciphered")) returned 1 [0080.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\NOTEBOOK.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\notebook.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\NOTEBOOK.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\notebook.htm.enciphered")) returned 1 [0080.922] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\notebook.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\NOTEBOOK.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\notebook.jpg.enciphered")) returned 1 [0080.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\OFFISUPP.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\offisupp.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\OFFISUPP.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\offisupp.gif.enciphered")) returned 1 [0080.927] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\OFFISUPP.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\offisupp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\OFFISUPP.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\offisupp.htm.enciphered")) returned 1 [0080.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PAWPRINT.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pawprint.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PAWPRINT.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pawprint.gif.enciphered")) returned 1 [0080.934] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PAWPRINT.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pawprint.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PAWPRINT.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pawprint.htm.enciphered")) returned 1 [0080.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PINELUMB.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pinelumb.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PINELUMB.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pinelumb.htm.enciphered")) returned 1 [0080.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pinelumb.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PINELUMB.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pinelumb.jpg.enciphered")) returned 1 [0080.941] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\SEAMARBL.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\seamarbl.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\SEAMARBL.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\seamarbl.htm.enciphered")) returned 1 [0080.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\seamarbl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\SEAMARBL.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\seamarbl.jpg.enciphered")) returned 1 [0080.947] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\TECHTOOL.GIF" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\techtool.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\TECHTOOL.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\techtool.gif.enciphered")) returned 1 [0080.949] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\TECHTOOL.HTM" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\techtool.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\TECHTOOL.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\techtool.htm.enciphered")) returned 1 [0081.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\Presentation Designs\\Maple.gif" (normalized: "c:\\program files\\microsoft office\\root\\templates\\presentation designs\\maple.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\Presentation Designs\\Maple.gif.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\templates\\presentation designs\\maple.gif.enciphered")) returned 1 [0081.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Access 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\access 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Access 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\access 2016.lnk.enciphered")) returned 1 [0081.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Excel 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\excel 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Excel 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\excel 2016.lnk.enciphered")) returned 1 [0081.140] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\database compare 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\database compare 2016.lnk.enciphered")) returned 1 [0081.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.enciphered")) returned 1 [0081.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.enciphered")) returned 1 [0081.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk.enciphered")) returned 1 [0081.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.enciphered")) returned 1 [0081.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.enciphered")) returned 1 [0081.157] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.enciphered")) returned 1 [0081.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.enciphered")) returned 1 [0081.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\OneDrive for Business.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\onedrive for business.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\OneDrive for Business.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\onedrive for business.lnk.enciphered")) returned 1 [0081.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\OneNote 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\onenote 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\OneNote 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\onenote 2016.lnk.enciphered")) returned 1 [0081.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Outlook 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\outlook 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Outlook 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\outlook 2016.lnk.enciphered")) returned 1 [0081.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\PowerPoint 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\powerpoint 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\PowerPoint 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\powerpoint 2016.lnk.enciphered")) returned 1 [0081.221] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Project 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\project 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Project 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\project 2016.lnk.enciphered")) returned 1 [0081.224] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Publisher 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\publisher 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Publisher 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\publisher 2016.lnk.enciphered")) returned 1 [0081.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Skype for Business 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\skype for business 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Skype for Business 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\skype for business 2016.lnk.enciphered")) returned 1 [0081.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Visio 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\visio 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Visio 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\visio 2016.lnk.enciphered")) returned 1 [0081.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Word 2016.lnk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\word 2016.lnk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Word 2016.lnk.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common programs\\word 2016.lnk.enciphered")) returned 1 [0081.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.gif.enciphered")) returned 1 [0081.376] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.jpg.enciphered")) returned 1 [0081.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.png.enciphered")) returned 1 [0081.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\readme.htm.enciphered")) returned 1 [0081.555] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\1033\\mcabout.htm.enciphered")) returned 1 [0081.634] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\metconv.txt.enciphered")) returned 1 [0081.651] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\preview.gif.enciphered")) returned 1 [0081.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png.enciphered")) returned 1 [0081.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\preview.gif.enciphered")) returned 1 [0081.711] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\thmbnail.png.enciphered")) returned 1 [0081.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\preview.gif.enciphered")) returned 1 [0081.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\thmbnail.png.enciphered")) returned 1 [0081.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\preview.gif.enciphered")) returned 1 [0081.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\thmbnail.png.enciphered")) returned 1 [0081.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\preview.gif.enciphered")) returned 1 [0081.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\thmbnail.png.enciphered")) returned 1 [0081.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\preview.gif.enciphered")) returned 1 [0081.998] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\thmbnail.png.enciphered")) returned 1 [0082.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\preview.gif.enciphered")) returned 1 [0082.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\thmbnail.png.enciphered")) returned 1 [0082.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\preview.gif.enciphered")) returned 1 [0082.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\thmbnail.png.enciphered")) returned 1 [0082.110] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\preview.gif.enciphered")) returned 1 [0082.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\thmbnail.png.enciphered")) returned 1 [0082.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\preview.gif.enciphered")) returned 1 [0082.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\thmbnail.png.enciphered")) returned 1 [0082.188] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\preview.gif.enciphered")) returned 1 [0082.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\thmbnail.png.enciphered")) returned 1 [0082.197] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\preview.gif.enciphered")) returned 1 [0082.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\thmbnail.png.enciphered")) returned 1 [0082.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\preview.gif.enciphered")) returned 1 [0082.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\thmbnail.png.enciphered")) returned 1 [0082.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\preview.gif.enciphered")) returned 1 [0082.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\thmbnail.png.enciphered")) returned 1 [0082.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\preview.gif.enciphered")) returned 1 [0082.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\thmbnail.png.enciphered")) returned 1 [0082.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\preview.gif.enciphered")) returned 1 [0082.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\thmbnail.png.enciphered")) returned 1 [0082.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\preview.gif.enciphered")) returned 1 [0082.358] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\thmbnail.png.enciphered")) returned 1 [0082.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\preview.gif.enciphered")) returned 1 [0082.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\thmbnail.png.enciphered")) returned 1 [0082.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\preview.gif.enciphered")) returned 1 [0082.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\thmbnail.png.enciphered")) returned 1 [0082.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\preview.gif.enciphered")) returned 1 [0082.473] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\thmbnail.png.enciphered")) returned 1 [0082.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\preview.gif.enciphered")) returned 1 [0082.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\thmbnail.png.enciphered")) returned 1 [0082.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\preview.gif.enciphered")) returned 1 [0082.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\thmbnail.png.enciphered")) returned 1 [0082.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\preview.gif.enciphered")) returned 1 [0082.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\thmbnail.png.enciphered")) returned 1 [0082.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\preview.gif.enciphered")) returned 1 [0082.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\thmbnail.png.enciphered")) returned 1 [0082.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\preview.gif.enciphered")) returned 1 [0082.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\thmbnail.png.enciphered")) returned 1 [0082.614] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\preview.gif.enciphered")) returned 1 [0082.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\thmbnail.png.enciphered")) returned 1 [0082.624] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\preview.gif.enciphered")) returned 1 [0082.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\thmbnail.png.enciphered")) returned 1 [0082.634] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\preview.gif.enciphered")) returned 1 [0082.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\thmbnail.png.enciphered")) returned 1 [0082.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\preview.gif.enciphered")) returned 1 [0082.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\thmbnail.png.enciphered")) returned 1 [0082.707] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\preview.gif.enciphered")) returned 1 [0082.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\thmbnail.png.enciphered")) returned 1 [0082.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\preview.gif.enciphered")) returned 1 [0082.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\thmbnail.png.enciphered")) returned 1 [0082.728] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\preview.gif.enciphered")) returned 1 [0082.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\thmbnail.png.enciphered")) returned 1 [0082.798] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\preview.gif.enciphered")) returned 1 [0082.804] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\thmbnail.png.enciphered")) returned 1 [0082.810] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\preview.gif.enciphered")) returned 1 [0082.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\thmbnail.png.enciphered")) returned 1 [0082.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\preview.gif.enciphered")) returned 1 [0082.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\thmbnail.png.enciphered")) returned 1 [0082.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\preview.gif.enciphered")) returned 1 [0082.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\thmbnail.png.enciphered")) returned 1 [0082.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\preview.gif.enciphered")) returned 1 [0082.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\thmbnail.png.enciphered")) returned 1 [0082.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\preview.gif.enciphered")) returned 1 [0082.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\thmbnail.png.enciphered")) returned 1 [0082.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\preview.gif.enciphered")) returned 1 [0082.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png.enciphered")) returned 1 [0082.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif.enciphered")) returned 1 [0082.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png.enciphered")) returned 1 [0082.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif.enciphered")) returned 1 [0083.017] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\thmbnail.png.enciphered")) returned 1 [0083.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\preview.gif.enciphered")) returned 1 [0083.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\thmbnail.png.enciphered")) returned 1 [0083.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\preview.gif.enciphered")) returned 1 [0083.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\thmbnail.png.enciphered")) returned 1 [0083.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\preview.gif.enciphered")) returned 1 [0083.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\thmbnail.png.enciphered")) returned 1 [0083.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\preview.gif.enciphered")) returned 1 [0083.104] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\thmbnail.png.enciphered")) returned 1 [0083.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accessmessagedismissal.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accessmessagedismissal.txt.enciphered")) returned 1 [0083.947] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\excelmessagedismissal.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\excelmessagedismissal.txt.enciphered")) returned 1 [0084.130] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\excel12.xlsx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX.EnCiPhErEd" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\excel12.xlsx.enciphered")) returned 1 [0084.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_150.png" (normalized: "c:\\program files\\mozilla firefox\\browser\\visualelements\\visualelements_150.png"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_150.png.EnCiPhErEd" (normalized: "c:\\program files\\mozilla firefox\\browser\\visualelements\\visualelements_150.png.enciphered")) returned 1 [0084.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_70.png" (normalized: "c:\\program files\\mozilla firefox\\browser\\visualelements\\visualelements_70.png"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_70.png.EnCiPhErEd" (normalized: "c:\\program files\\mozilla firefox\\browser\\visualelements\\visualelements_70.png.enciphered")) returned 1 [0084.334] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\index.html.enciphered")) returned 1 [0084.340] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\index.html.enciphered")) returned 1 [0084.346] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\index.html.enciphered")) returned 1 [0084.397] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\index.html.enciphered")) returned 1 [0084.402] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\index.html.enciphered")) returned 1 [0084.408] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\index.html.enciphered")) returned 1 [0084.413] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\index.html.enciphered")) returned 1 [0084.419] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\index.html.enciphered")) returned 1 [0084.428] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\index.html.enciphered")) returned 1 [0084.471] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\index.html.enciphered")) returned 1 [0084.481] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\index.html.enciphered")) returned 1 [0084.576] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\index.html.enciphered")) returned 1 [0084.620] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\index.html.enciphered")) returned 1 [0085.060] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\index.html.enciphered")) returned 1 [0085.067] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\index.html.enciphered")) returned 1 [0085.072] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\index.html.enciphered")) returned 1 [0085.077] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\index.html.enciphered")) returned 1 [0085.082] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\index.html.enciphered")) returned 1 [0085.088] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\index.html.enciphered")) returned 1 [0085.093] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\index.html.enciphered")) returned 1 [0085.141] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\index.html.enciphered")) returned 1 [0085.167] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\index.html.enciphered")) returned 1 [0085.174] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\index.html.enciphered")) returned 1 [0085.179] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\index.html.enciphered")) returned 1 [0085.185] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\index.html.enciphered")) returned 1 [0085.199] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\index.html.enciphered")) returned 1 [0085.205] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\index.html.enciphered")) returned 1 [0085.231] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\index.html.enciphered")) returned 1 [0085.237] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\index.html.enciphered")) returned 1 [0085.242] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\index.html.enciphered")) returned 1 [0085.256] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\index.html.enciphered")) returned 1 [0085.261] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\index.html.enciphered")) returned 1 [0085.266] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\index.html.enciphered")) returned 1 [0085.307] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\index.html.enciphered")) returned 1 [0085.313] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\index.html.enciphered")) returned 1 [0085.320] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\index.html.enciphered")) returned 1 [0085.326] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\index.html.enciphered")) returned 1 [0085.331] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\index.html.enciphered")) returned 1 [0085.394] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\index.html.enciphered")) returned 1 [0085.400] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\index.html.enciphered")) returned 1 [0085.406] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\index.html.enciphered")) returned 1 [0085.410] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\index.html.enciphered")) returned 1 [0085.416] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\index.html.enciphered")) returned 1 [0085.421] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\index.html.enciphered")) returned 1 [0085.426] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\index.html.enciphered")) returned 1 [0085.478] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\index.html.enciphered")) returned 1 [0085.484] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\index.html.enciphered")) returned 1 [0085.490] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\index.html.enciphered")) returned 1 [0085.496] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\index.html.enciphered")) returned 1 [0085.510] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\index.html.enciphered")) returned 1 [0085.557] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\index.html.enciphered")) returned 1 [0085.563] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\index.html.enciphered")) returned 1 [0085.573] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\index.html.enciphered")) returned 1 [0085.578] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\index.html.enciphered")) returned 1 [0085.583] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\index.html.enciphered")) returned 1 [0085.589] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\index.html.enciphered")) returned 1 [0085.670] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\index.html.enciphered")) returned 1 [0085.682] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\20170517_lock_200.gif"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\20170517_lock_200.gif.enciphered")) returned 1 [0085.686] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0000_hover.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0000_hover.png.enciphered")) returned 1 [0085.689] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0001_static.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0001_static.png.enciphered")) returned 1 [0085.692] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\lock-confirmation-page-350.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\lock-confirmation-page-350.png.enciphered")) returned 1 [0085.697] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\picture2_80.jpg"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\picture2_80.jpg.enciphered")) returned 1 [0085.700] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\win10_brand.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\win10_brand.png.enciphered")) returned 1 [0085.703] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\windowsupdateprivacysetting.scale-200.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\windowsupdateprivacysetting.scale-200.png.enciphered")) returned 1 [0085.712] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\index.html.enciphered")) returned 1 [0085.727] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\index.html.enciphered")) returned 1 [0085.734] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\index.html.enciphered")) returned 1 [0085.768] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\index.html.enciphered")) returned 1 [0085.811] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\index.html.enciphered")) returned 1 [0085.818] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\index.html.enciphered")) returned 1 [0085.827] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\index.html.enciphered")) returned 1 [0085.837] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\index.html.enciphered")) returned 1 [0085.846] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\index.html.enciphered")) returned 1 [0085.865] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\index.html.enciphered")) returned 1 [0085.870] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\index.html.enciphered")) returned 1 [0086.039] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\index.html.enciphered")) returned 1 [0086.107] MoveFileA (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html.EnCiPhErEd" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\index.html.enciphered")) returned 1 [0103.102] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.enciphered")) returned 1 [0103.116] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\COPYING.LGPLv2.1.txt" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\acrocef\\copying.lgplv2.1.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\COPYING.LGPLv2.1.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\acrocef\\copying.lgplv2.1.txt.enciphered")) returned 1 [0103.119] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\LICENSE.txt" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\acrocef\\license.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\LICENSE.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\acrocef\\license.txt.enciphered")) returned 1 [0103.145] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Click on 'Change' to select default PDF handler.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\click on 'change' to select default pdf handler.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Click on 'Change' to select default PDF handler.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\click on 'change' to select default pdf handler.pdf.enciphered")) returned 1 [0103.153] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\idtemplates\\enu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\idtemplates\\enu\\adobeid.pdf.enciphered")) returned 1 [0103.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\idtemplates\\enu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\idtemplates\\enu\\defaultid.pdf.enciphered")) returned 1 [0103.166] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\legal\\enu\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU\\license.html.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\legal\\enu\\license.html.enciphered")) returned 1 [0103.179] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\pdfsigqformalrep.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\PDFSigQFormalRep.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\pdfsigqformalrep.pdf.enciphered")) returned 1 [0103.204] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf.enciphered")) returned 1 [0103.210] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf.enciphered")) returned 1 [0103.214] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf.enciphered")) returned 1 [0103.258] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\words.pdf.enciphered")) returned 1 [0103.275] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\pmd.cer" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\pmd.cer"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\pmd.cer.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\pmd.cer.enciphered")) returned 1 [0103.283] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\add_reviewer.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\add_reviewer.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\add_reviewer.gif.enciphered")) returned 1 [0103.284] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\bl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\bl.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\bl.gif.enciphered")) returned 1 [0103.286] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\br.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\br.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\br.gif.enciphered")) returned 1 [0103.289] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\create_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\create_form.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\create_form.gif.enciphered")) returned 1 [0103.292] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\distribute_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\distribute_form.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\distribute_form.gif.enciphered")) returned 1 [0103.306] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\email_all.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\email_all.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\email_all.gif.enciphered")) returned 1 [0103.310] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\email_initiator.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\email_initiator.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\email_initiator.gif.enciphered")) returned 1 [0103.312] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\ended_review_or_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\ended_review_or_form.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\ended_review_or_form.gif.enciphered")) returned 1 [0103.322] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\end_review.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\end_review.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\end_review.gif.enciphered")) returned 1 [0103.327] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_distributed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_distributed.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_distributed.gif.enciphered")) returned 1 [0103.329] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_received.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_received.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_received.gif.enciphered")) returned 1 [0103.331] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_super.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_super.gif.enciphered")) returned 1 [0103.334] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\form_responses.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\form_responses.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\form_responses.gif.enciphered")) returned 1 [0103.336] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\info.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\info.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\info.gif.enciphered")) returned 1 [0103.341] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\open_original_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\open_original_form.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\open_original_form.gif.enciphered")) returned 1 [0103.343] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\pdf.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\pdf.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\pdf.gif.enciphered")) returned 1 [0103.347] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviewers.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviewers.gif.enciphered")) returned 1 [0103.353] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_joined.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_joined.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_joined.gif.enciphered")) returned 1 [0103.357] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_sent.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_sent.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_sent.gif.enciphered")) returned 1 [0103.362] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_super.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_super.gif.enciphered")) returned 1 [0103.367] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_browser.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_browser.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_browser.gif.enciphered")) returned 1 [0103.370] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_email.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_email.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_email.gif.enciphered")) returned 1 [0103.373] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_same_reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_same_reviewers.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_same_reviewers.gif.enciphered")) returned 1 [0103.376] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_shared.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_shared.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_shared.gif.enciphered")) returned 1 [0103.378] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\rss.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\rss.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\rss.gif.enciphered")) returned 1 [0103.384] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_issue.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_issue.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_issue.gif.enciphered")) returned 1 [0103.387] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_lg.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_lg.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_lg.gif.enciphered")) returned 1 [0103.389] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_ok.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_ok.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_ok.gif.enciphered")) returned 1 [0103.391] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\stop_collection_data.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\stop_collection_data.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\stop_collection_data.gif.enciphered")) returned 1 [0103.394] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\submission_history.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\submission_history.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\submission_history.gif.enciphered")) returned 1 [0103.397] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\tl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\tl.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\tl.gif.enciphered")) returned 1 [0103.399] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\tr.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\tr.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\tr.gif.enciphered")) returned 1 [0103.402] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\trash.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\trash.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\trash.gif.enciphered")) returned 1 [0103.405] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnoffnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnoffnotificationinacrobat.gif.enciphered")) returned 1 [0103.408] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnoffnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOffNotificationInTray.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnoffnotificationintray.gif.enciphered")) returned 1 [0103.411] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnonnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnonnotificationinacrobat.gif.enciphered")) returned 1 [0103.414] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnonnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOnNotificationInTray.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnonnotificationintray.gif.enciphered")) returned 1 [0103.416] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\warning.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\warning.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\warning.gif.enciphered")) returned 1 [0103.427] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\index.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\index.html.enciphered")) returned 1 [0103.449] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner.gif.enciphered")) returned 1 [0103.455] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_2x.gif.enciphered")) returned 1 [0103.458] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_int.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_int.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_int.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_int.gif.enciphered")) returned 1 [0103.462] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_int_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_int_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_int_2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_int_2x.gif.enciphered")) returned 1 [0103.465] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adc_logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adc_logo.png.enciphered")) returned 1 [0103.467] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adobe_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adobe_spinner.gif.enciphered")) returned 1 [0103.470] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner_mini.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adobe_spinner_mini.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner_mini.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adobe_spinner_mini.gif.enciphered")) returned 1 [0103.473] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-114x114-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-114x114-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-114x114-precomposed.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-114x114-precomposed.png.enciphered")) returned 1 [0103.476] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-144x144-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-144x144-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-144x144-precomposed.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-144x144-precomposed.png.enciphered")) returned 1 [0103.479] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-57x57-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-57x57-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-57x57-precomposed.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-57x57-precomposed.png.enciphered")) returned 1 [0103.482] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-72x72-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-72x72-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-72x72-precomposed.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-72x72-precomposed.png.enciphered")) returned 1 [0103.485] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ccloud.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ccloud.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ccloud.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ccloud.png.enciphered")) returned 1 [0103.488] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ccloud_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ccloud_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ccloud_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ccloud_retina.png.enciphered")) returned 1 [0103.491] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\close_x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\close_x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\close_x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\close_x.png.enciphered")) returned 1 [0103.494] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\core_icons.png.enciphered")) returned 1 [0103.499] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\core_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\core_icons_retina.png.enciphered")) returned 1 [0103.503] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\dd_arrow_small.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\dd_arrow_small.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\dd_arrow_small.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\dd_arrow_small.png.enciphered")) returned 1 [0103.515] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\aic_file_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\aic_file_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\aic_file_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\aic_file_icons.png.enciphered")) returned 1 [0103.521] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\aic_file_icons_retina_thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\aic_file_icons_retina_thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\aic_file_icons_retina_thumb.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\aic_file_icons_retina_thumb.png.enciphered")) returned 1 [0103.537] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\cloud_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\cloud_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\cloud_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\cloud_icon.png.enciphered")) returned 1 [0103.546] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hiContrast_bow.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hicontrast_bow.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hiContrast_bow.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hicontrast_bow.png.enciphered")) returned 1 [0103.557] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hiContrast_wob.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hicontrast_wob.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hiContrast_wob.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hicontrast_wob.png.enciphered")) returned 1 [0103.562] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_highcontrast.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_highcontrast.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_highcontrast.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_highcontrast.png.enciphered")) returned 1 [0103.566] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highContrast_bow.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highcontrast_bow.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highContrast_bow.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highcontrast_bow.png.enciphered")) returned 1 [0103.570] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highContrast_wob.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highcontrast_wob.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highContrast_wob.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highcontrast_wob.png.enciphered")) returned 1 [0103.580] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons.png.enciphered")) returned 1 [0103.585] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons_retina_thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons_retina_thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons_retina_thumb.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons_retina_thumb.png.enciphered")) returned 1 [0103.589] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\cloud_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\cloud_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\cloud_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\cloud_icon.png.enciphered")) returned 1 [0103.597] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_hiContrast_bow.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_hicontrast_bow.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_hiContrast_bow.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_hicontrast_bow.png.enciphered")) returned 1 [0103.653] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_hiContrast_wob.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_hicontrast_wob.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_hiContrast_wob.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_hicontrast_wob.png.enciphered")) returned 1 [0103.657] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_highcontrast.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_highcontrast.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_highcontrast.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_highcontrast.png.enciphered")) returned 1 [0103.660] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_highcontrast_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_highcontrast_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_highcontrast_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_highcontrast_retina.png.enciphered")) returned 1 [0103.663] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons__retina_hiContrast_bow.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons__retina_hicontrast_bow.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons__retina_hiContrast_bow.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons__retina_hicontrast_bow.png.enciphered")) returned 1 [0103.666] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons__retina_hiContrast_wob.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons__retina_hicontrast_wob.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons__retina_hiContrast_wob.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons__retina_hicontrast_wob.png.enciphered")) returned 1 [0103.669] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\illustrations.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\illustrations.png.enciphered")) returned 1 [0103.671] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\illustrations_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\illustrations_retina.png.enciphered")) returned 1 [0103.675] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ind_prog.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ind_prog.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ind_prog.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ind_prog.gif.enciphered")) returned 1 [0103.677] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\japanese_over.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\japanese_over.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\japanese_over.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\japanese_over.png.enciphered")) returned 1 [0103.680] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\large_trefoil.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\large_trefoil.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\large_trefoil.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\large_trefoil.png.enciphered")) returned 1 [0103.682] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\large_trefoil_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\large_trefoil_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\large_trefoil_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\large_trefoil_2x.png.enciphered")) returned 1 [0103.686] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\logo_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\logo_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\logo_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\logo_retina.png.enciphered")) returned 1 [0103.689] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress-indeterminate.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress-indeterminate.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress-indeterminate.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress-indeterminate.gif.enciphered")) returned 1 [0103.692] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner.gif.enciphered")) returned 1 [0103.699] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner2x.gif.enciphered")) returned 1 [0103.702] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner_dark.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner_dark.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner_dark.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner_dark.gif.enciphered")) returned 1 [0103.704] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner_dark2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner_dark2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner_dark2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner_dark2x.gif.enciphered")) returned 1 [0103.711] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\RHP_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\rhp_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\RHP_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\rhp_icons.png.enciphered")) returned 1 [0103.714] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\RHP_icons_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\rhp_icons_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\RHP_icons_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\rhp_icons_2x.png.enciphered")) returned 1 [0103.717] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\selection-actions.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\selection-actions.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\selection-actions.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\selection-actions.png.enciphered")) returned 1 [0103.720] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\selection-actions2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\selection-actions2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\selection-actions2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\selection-actions2x.png.enciphered")) returned 1 [0103.728] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner.gif.enciphered")) returned 1 [0103.732] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_2x.gif.enciphered")) returned 1 [0103.735] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_int.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_int.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_int.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_int.gif.enciphered")) returned 1 [0103.738] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_int_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_int_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_int_2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_int_2x.gif.enciphered")) returned 1 [0103.745] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adc_logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adc_logo.png.enciphered")) returned 1 [0103.748] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adobe_spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adobe_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adobe_spinner.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adobe_spinner.gif.enciphered")) returned 1 [0103.750] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adobe_spinner_mini.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adobe_spinner_mini.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adobe_spinner_mini.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adobe_spinner_mini.gif.enciphered")) returned 1 [0103.753] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-114x114-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-114x114-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-114x114-precomposed.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-114x114-precomposed.png.enciphered")) returned 1 [0103.756] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-144x144-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-144x144-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-144x144-precomposed.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-144x144-precomposed.png.enciphered")) returned 1 [0103.759] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-57x57-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-57x57-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-57x57-precomposed.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-57x57-precomposed.png.enciphered")) returned 1 [0103.761] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-72x72-precomposed.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-72x72-precomposed.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-72x72-precomposed.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-72x72-precomposed.png.enciphered")) returned 1 [0103.764] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ccloud.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ccloud.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ccloud.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ccloud.png.enciphered")) returned 1 [0103.771] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ccloud_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ccloud_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ccloud_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ccloud_retina.png.enciphered")) returned 1 [0103.786] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\close_x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\close_x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\close_x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\close_x.png.enciphered")) returned 1 [0103.868] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\core_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\core_icons.png.enciphered")) returned 1 [0103.884] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\core_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\core_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\core_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\core_icons_retina.png.enciphered")) returned 1 [0103.888] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\dd_arrow_small.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\dd_arrow_small.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\dd_arrow_small.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\dd_arrow_small.png.enciphered")) returned 1 [0103.891] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\illustrations.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\illustrations.png.enciphered")) returned 1 [0103.902] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\illustrations_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\illustrations_retina.png.enciphered")) returned 1 [0103.906] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ind_prog.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ind_prog.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ind_prog.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ind_prog.gif.enciphered")) returned 1 [0103.908] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\japanese_over.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\japanese_over.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\japanese_over.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\japanese_over.png.enciphered")) returned 1 [0103.911] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\large_trefoil.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\large_trefoil.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\large_trefoil.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\large_trefoil.png.enciphered")) returned 1 [0103.914] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\large_trefoil_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\large_trefoil_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\large_trefoil_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\large_trefoil_2x.png.enciphered")) returned 1 [0103.916] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\logo_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\logo_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\logo_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\logo_retina.png.enciphered")) returned 1 [0103.919] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress-indeterminate.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress-indeterminate.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress-indeterminate.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress-indeterminate.gif.enciphered")) returned 1 [0103.922] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner.gif.enciphered")) returned 1 [0103.925] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner2x.gif.enciphered")) returned 1 [0103.928] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner_dark.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner_dark.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner_dark.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner_dark.gif.enciphered")) returned 1 [0103.942] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner_dark2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner_dark2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner_dark2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner_dark2x.gif.enciphered")) returned 1 [0104.028] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\RHP_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\rhp_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\RHP_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\rhp_icons.png.enciphered")) returned 1 [0104.141] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\RHP_icons_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\rhp_icons_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\RHP_icons_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\rhp_icons_2x.png.enciphered")) returned 1 [0104.144] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\selection-actions.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\selection-actions.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\selection-actions.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\selection-actions.png.enciphered")) returned 1 [0104.148] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\selection-actions2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\selection-actions2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\selection-actions2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\selection-actions2x.png.enciphered")) returned 1 [0104.152] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-down.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-down.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-down.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-down.png.enciphered")) returned 1 [0104.159] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-left.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-left.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-left.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-left.png.enciphered")) returned 1 [0104.161] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-right.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-right.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-right.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-right.png.enciphered")) returned 1 [0104.166] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-up.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-up.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-up.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-up.png.enciphered")) returned 1 [0104.168] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\hscroll-thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\hscroll-thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\hscroll-thumb.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\hscroll-thumb.png.enciphered")) returned 1 [0104.174] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-down.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-down.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-down.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-down.png.enciphered")) returned 1 [0104.176] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-left.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-left.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-left.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-left.png.enciphered")) returned 1 [0104.178] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-right.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-right.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-right.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-right.png.enciphered")) returned 1 [0104.180] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-up.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-up.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-up.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-up.png.enciphered")) returned 1 [0104.182] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\hscroll-thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\hscroll-thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\hscroll-thumb.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\hscroll-thumb.png.enciphered")) returned 1 [0104.184] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\vscroll-thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\vscroll-thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\vscroll-thumb.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\vscroll-thumb.png.enciphered")) returned 1 [0104.189] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png.enciphered")) returned 1 [0104.194] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-down-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-down-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-down-pressed.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-down-pressed.gif.enciphered")) returned 1 [0104.196] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-down.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-down.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-down.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-down.gif.enciphered")) returned 1 [0104.197] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-left-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-left-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-left-pressed.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-left-pressed.gif.enciphered")) returned 1 [0104.198] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-left.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-left.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-left.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-left.gif.enciphered")) returned 1 [0104.199] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-right-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-right-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-right-pressed.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-right-pressed.gif.enciphered")) returned 1 [0104.200] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-right.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-right.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-right.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-right.gif.enciphered")) returned 1 [0104.201] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-up-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-up-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-up-pressed.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-up-pressed.gif.enciphered")) returned 1 [0104.202] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-up.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-up.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-up.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-up.gif.enciphered")) returned 1 [0104.208] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down-pressed.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down-pressed.gif.enciphered")) returned 1 [0104.210] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down.gif.enciphered")) returned 1 [0104.211] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left-pressed.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left-pressed.gif.enciphered")) returned 1 [0104.212] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left.gif.enciphered")) returned 1 [0104.213] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right-pressed.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right-pressed.gif.enciphered")) returned 1 [0104.214] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right.gif.enciphered")) returned 1 [0104.215] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up-pressed.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up-pressed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up-pressed.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up-pressed.gif.enciphered")) returned 1 [0104.216] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up.gif.enciphered")) returned 1 [0104.436] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\bg_patterns_header.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\bg_patterns_header.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\bg_patterns_header.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\bg_patterns_header.png.enciphered")) returned 1 [0104.444] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\bg_pattern_RHP.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\bg_pattern_rhp.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\bg_pattern_RHP.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\bg_pattern_rhp.png.enciphered")) returned 1 [0104.447] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons.png.enciphered")) returned 1 [0104.450] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons_ie8.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons_ie8.gif.enciphered")) returned 1 [0104.453] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons_retina.png.enciphered")) returned 1 [0104.456] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\illustrations.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\illustrations.png.enciphered")) returned 1 [0104.458] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\illustrations_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\illustrations_retina.png.enciphered")) returned 1 [0104.462] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\new_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\new_icons.png.enciphered")) returned 1 [0104.464] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\new_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\new_icons_retina.png.enciphered")) returned 1 [0104.471] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_patterns_header.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_patterns_header.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_patterns_header.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_patterns_header.png.enciphered")) returned 1 [0104.473] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_pattern_RHP.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_pattern_rhp.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_pattern_RHP.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_pattern_rhp.png.enciphered")) returned 1 [0104.476] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons.png.enciphered")) returned 1 [0104.479] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_ie8.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_ie8.gif.enciphered")) returned 1 [0104.482] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_retina.png.enciphered")) returned 1 [0104.545] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations.png.enciphered")) returned 1 [0104.647] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations_retina.png.enciphered")) returned 1 [0104.652] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons.png.enciphered")) returned 1 [0104.655] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons_retina.png.enciphered")) returned 1 [0104.746] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png.enciphered")) returned 1 [0104.753] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_2x.png.enciphered")) returned 1 [0104.756] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover.png.enciphered")) returned 1 [0104.758] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0104.764] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon.png.enciphered")) returned 1 [0104.766] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_2x.png.enciphered")) returned 1 [0104.768] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover.png.enciphered")) returned 1 [0104.770] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0104.772] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning.png.enciphered")) returned 1 [0104.775] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning_2x.png.enciphered")) returned 1 [0104.778] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\warning.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\warning.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\warning.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\warning.png.enciphered")) returned 1 [0104.783] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\warning_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\warning_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\warning_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\warning_2x.png.enciphered")) returned 1 [0104.870] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons.png.enciphered")) returned 1 [0104.873] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons2x.png.enciphered")) returned 1 [0104.875] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon.png.enciphered")) returned 1 [0104.878] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_2x.png.enciphered")) returned 1 [0104.880] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover.png.enciphered")) returned 1 [0104.882] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0104.887] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons.png.enciphered")) returned 1 [0104.891] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons2x.png.enciphered")) returned 1 [0104.896] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon.png.enciphered")) returned 1 [0104.898] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_2x.png.enciphered")) returned 1 [0104.900] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover.png.enciphered")) returned 1 [0104.904] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0104.987] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons.png.enciphered")) returned 1 [0104.991] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons2x.png.enciphered")) returned 1 [0104.993] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon.png.enciphered")) returned 1 [0104.996] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_2x.png.enciphered")) returned 1 [0105.000] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover.png.enciphered")) returned 1 [0105.005] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0105.054] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons.png.enciphered")) returned 1 [0105.057] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons2x.png.enciphered")) returned 1 [0105.059] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png.enciphered")) returned 1 [0105.061] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png.enciphered")) returned 1 [0105.064] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png.enciphered")) returned 1 [0105.066] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0105.296] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons.png.enciphered")) returned 1 [0105.300] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons_2x.png.enciphered")) returned 1 [0105.305] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons.png.enciphered")) returned 1 [0105.308] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons_2x.png.enciphered")) returned 1 [0105.385] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\example_icons.png.enciphered")) returned 1 [0105.388] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\example_icons2x.png.enciphered")) returned 1 [0105.391] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon.png.enciphered")) returned 1 [0105.394] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_2x.png.enciphered")) returned 1 [0105.399] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover.png.enciphered")) returned 1 [0105.402] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0105.408] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons.png.enciphered")) returned 1 [0105.411] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons2x.png.enciphered")) returned 1 [0105.413] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon.png.enciphered")) returned 1 [0105.416] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_2x.png.enciphered")) returned 1 [0105.422] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover.png.enciphered")) returned 1 [0105.424] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0105.556] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons.png.enciphered")) returned 1 [0105.560] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons2x.png.enciphered")) returned 1 [0105.562] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon.png.enciphered")) returned 1 [0105.565] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_2x.png.enciphered")) returned 1 [0105.568] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover.png.enciphered")) returned 1 [0105.574] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0105.582] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons.png.enciphered")) returned 1 [0105.586] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons2x.png.enciphered")) returned 1 [0105.588] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png.enciphered")) returned 1 [0105.590] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png.enciphered")) returned 1 [0105.592] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png.enciphered")) returned 1 [0105.597] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0105.712] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag.png.enciphered")) returned 1 [0105.715] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag_retina.png.enciphered")) returned 1 [0105.718] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons.png.enciphered")) returned 1 [0105.722] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons_fw.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons_fw.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons_fw.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons_fw.png.enciphered")) returned 1 [0105.730] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons_retina.png.enciphered")) returned 1 [0105.732] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_field_grabber.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_field_grabber.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_field_grabber.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_field_grabber.png.enciphered")) returned 1 [0105.735] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_icons.png.enciphered")) returned 1 [0105.739] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_icons_retina.png.enciphered")) returned 1 [0105.743] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\Handler@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\handler@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\Handler@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\handler@1x.png.enciphered")) returned 1 [0105.745] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\sample-thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\sample-thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\sample-thumb.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\sample-thumb.png.enciphered")) returned 1 [0105.754] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag.png.enciphered")) returned 1 [0105.758] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag_retina.png.enciphered")) returned 1 [0105.762] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons.png.enciphered")) returned 1 [0105.766] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_fw.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_fw.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_fw.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_fw.png.enciphered")) returned 1 [0105.770] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_retina.png.enciphered")) returned 1 [0105.773] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_field_grabber.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_field_grabber.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_field_grabber.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_field_grabber.png.enciphered")) returned 1 [0105.776] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons.png.enciphered")) returned 1 [0105.780] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons_retina.png.enciphered")) returned 1 [0105.783] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\Handler@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\handler@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\Handler@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\handler@1x.png.enciphered")) returned 1 [0105.786] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png.enciphered")) returned 1 [0105.794] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_addblue@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_addblue@1x.png.enciphered")) returned 1 [0105.796] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_checkmark_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_checkmark_white@1x.png.enciphered")) returned 1 [0105.799] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_crossmark_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_crossmark_white@1x.png.enciphered")) returned 1 [0105.801] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_delete@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_delete@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_delete@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_delete@1x.png.enciphered")) returned 1 [0105.803] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_FilledDot_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_filleddot_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_FilledDot_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_filleddot_white@1x.png.enciphered")) returned 1 [0105.851] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_line_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_line_white@1x.png.enciphered")) returned 1 [0105.857] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_roundrect_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_roundrect_white@1x.png.enciphered")) returned 1 [0105.860] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_sign_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_sign_white@1x.png.enciphered")) returned 1 [0105.862] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_TypeTextFields_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_typetextfields_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_TypeTextFields_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_typetextfields_white@1x.png.enciphered")) returned 1 [0105.865] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\Comb_field_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\comb_field_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\Comb_field_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\comb_field_white@1x.png.enciphered")) returned 1 [0105.871] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_AddBlue@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_addblue@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_AddBlue@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_addblue@1x.png.enciphered")) returned 1 [0105.874] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Checkmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_checkmark_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Checkmark_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_checkmark_white@1x.png.enciphered")) returned 1 [0105.878] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Crossmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_crossmark_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Crossmark_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_crossmark_white@1x.png.enciphered")) returned 1 [0105.881] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_delete@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_delete@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_delete@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_delete@1x.png.enciphered")) returned 1 [0105.883] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_FilledDot_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_filleddot_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_FilledDot_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_filleddot_white@1x.png.enciphered")) returned 1 [0105.886] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Line_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_line_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Line_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_line_white@1x.png.enciphered")) returned 1 [0105.888] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Roundrect_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_roundrect_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Roundrect_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_roundrect_white@1x.png.enciphered")) returned 1 [0105.890] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Sign_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_sign_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Sign_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_sign_white@1x.png.enciphered")) returned 1 [0105.894] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_TypeTextFields_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_typetextfields_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_TypeTextFields_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_typetextfields_white@1x.png.enciphered")) returned 1 [0105.897] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\Comb_field_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\comb_field_white@1x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\Comb_field_White@1x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\comb_field_white@1x.png.enciphered")) returned 1 [0105.901] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\check_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\check_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\check_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\check_2x.png.enciphered")) returned 1 [0105.904] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\circle_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\circle_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\circle_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\circle_2x.png.enciphered")) returned 1 [0105.906] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\dot_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\dot_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\dot_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\dot_2x.png.enciphered")) returned 1 [0105.909] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\line_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\line_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\line_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\line_2x.png.enciphered")) returned 1 [0105.911] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\text_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\text_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\text_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\text_2x.png.enciphered")) returned 1 [0105.918] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\check_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\check_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\check_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\check_2x.png.enciphered")) returned 1 [0105.921] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\circle_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\circle_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\circle_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\circle_2x.png.enciphered")) returned 1 [0105.924] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\dot_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\dot_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\dot_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\dot_2x.png.enciphered")) returned 1 [0105.926] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\line_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\line_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\line_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\line_2x.png.enciphered")) returned 1 [0105.929] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\text_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\text_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\text_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\text_2x.png.enciphered")) returned 1 [0105.931] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\x_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\x_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\x_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\x_2x.png.enciphered")) returned 1 [0105.961] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\x_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\x_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\x_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\x_2x.png.enciphered")) returned 1 [0106.121] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons.png.enciphered")) returned 1 [0106.125] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons2x.png.enciphered")) returned 1 [0106.127] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon.png.enciphered")) returned 1 [0106.130] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_2x.png.enciphered")) returned 1 [0106.133] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover.png.enciphered")) returned 1 [0106.136] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0106.152] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons.png.enciphered")) returned 1 [0106.156] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons2x.png.enciphered")) returned 1 [0106.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon.png.enciphered")) returned 1 [0106.160] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_2x.png.enciphered")) returned 1 [0106.162] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover.png.enciphered")) returned 1 [0106.164] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0106.184] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\files_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\files_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\files_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\files_icons.png.enciphered")) returned 1 [0106.191] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\files_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\files_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\files_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\files_icons2x.png.enciphered")) returned 1 [0106.195] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons.png.enciphered")) returned 1 [0106.198] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons_ie8.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons_ie8.gif.enciphered")) returned 1 [0106.202] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons_retina.png.enciphered")) returned 1 [0106.205] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\new_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\new_icons.png.enciphered")) returned 1 [0106.209] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\new_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\new_icons_retina.png.enciphered")) returned 1 [0106.215] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons.png.enciphered")) returned 1 [0106.217] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons2x.png.enciphered")) returned 1 [0106.221] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons.png.enciphered")) returned 1 [0106.227] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_ie8.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_ie8.gif.enciphered")) returned 1 [0106.230] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_retina.png.enciphered")) returned 1 [0106.233] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons.png.enciphered")) returned 1 [0106.242] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons_retina.png.enciphered")) returned 1 [0106.286] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\bg_patterns_header.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\bg_patterns_header.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\bg_patterns_header.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\bg_patterns_header.png.enciphered")) returned 1 [0106.298] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\bg_pattern_RHP.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\bg_pattern_rhp.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\bg_pattern_RHP.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\bg_pattern_rhp.png.enciphered")) returned 1 [0106.302] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\file_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\file_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\file_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\file_icons.png.enciphered")) returned 1 [0106.304] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons.png.enciphered")) returned 1 [0106.308] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons_ie8.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons_ie8.gif.enciphered")) returned 1 [0106.311] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons_retina.png.enciphered")) returned 1 [0106.314] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\illustrations.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\illustrations.png.enciphered")) returned 1 [0106.317] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\illustrations_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\illustrations_retina.png.enciphered")) returned 1 [0106.319] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\new_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\new_icons.png.enciphered")) returned 1 [0106.322] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\new_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\new_icons_retina.png.enciphered")) returned 1 [0106.329] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_patterns_header.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_patterns_header.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_patterns_header.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_patterns_header.png.enciphered")) returned 1 [0106.332] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_pattern_RHP.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_pattern_rhp.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_pattern_RHP.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_pattern_rhp.png.enciphered")) returned 1 [0106.359] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\file_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\file_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\file_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\file_icons.png.enciphered")) returned 1 [0106.363] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons.png.enciphered")) returned 1 [0106.366] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_ie8.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_ie8.gif.enciphered")) returned 1 [0106.370] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_retina.png.enciphered")) returned 1 [0106.373] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations.png.enciphered")) returned 1 [0106.376] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations_retina.png.enciphered")) returned 1 [0106.379] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons.png.enciphered")) returned 1 [0106.405] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons_retina.png.enciphered")) returned 1 [0106.685] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\bg_patterns_header.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\bg_patterns_header.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\bg_patterns_header.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\bg_patterns_header.png.enciphered")) returned 1 [0106.689] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\bg_pattern_RHP.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\bg_pattern_rhp.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\bg_pattern_RHP.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\bg_pattern_rhp.png.enciphered")) returned 1 [0106.693] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons.png.enciphered")) returned 1 [0106.699] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons_ie8.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons_ie8.gif.enciphered")) returned 1 [0106.703] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons_retina.png.enciphered")) returned 1 [0106.706] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\illustrations.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\illustrations.png.enciphered")) returned 1 [0106.720] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\illustrations_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\illustrations_retina.png.enciphered")) returned 1 [0106.724] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\new_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\new_icons.png.enciphered")) returned 1 [0106.727] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\new_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\new_icons_retina.png.enciphered")) returned 1 [0106.736] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_patterns_header.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_patterns_header.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_patterns_header.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_patterns_header.png.enciphered")) returned 1 [0106.739] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_pattern_RHP.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_pattern_rhp.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_pattern_RHP.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_pattern_rhp.png.enciphered")) returned 1 [0106.746] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons.png.enciphered")) returned 1 [0106.749] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_ie8.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_ie8.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_ie8.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_ie8.gif.enciphered")) returned 1 [0106.752] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_retina.png.enciphered")) returned 1 [0106.756] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations.png.enciphered")) returned 1 [0106.759] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations_retina.png.enciphered")) returned 1 [0106.801] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons.png.enciphered")) returned 1 [0106.805] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons_retina.png.enciphered")) returned 1 [0108.131] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster.jpg.enciphered")) returned 1 [0108.136] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster2x.jpg.enciphered")) returned 1 [0108.140] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster.jpg.enciphered")) returned 1 [0108.144] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster2x.jpg.enciphered")) returned 1 [0108.148] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster.jpg.enciphered")) returned 1 [0108.151] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster2x.jpg.enciphered")) returned 1 [0108.155] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons.png.enciphered")) returned 1 [0108.177] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons2x.png.enciphered")) returned 1 [0108.182] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster.jpg.enciphered")) returned 1 [0108.186] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster2x.jpg.enciphered")) returned 1 [0108.191] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster.jpg.enciphered")) returned 1 [0108.194] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x-dark.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x-dark.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x-dark.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x-dark.jpg.enciphered")) returned 1 [0108.199] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x.jpg.enciphered")) returned 1 [0108.310] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster.jpg.enciphered")) returned 1 [0108.314] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster2x.jpg.enciphered")) returned 1 [0108.318] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster.jpg.enciphered")) returned 1 [0108.322] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster2x.jpg.enciphered")) returned 1 [0108.326] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster.jpg.enciphered")) returned 1 [0108.329] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster2x.jpg.enciphered")) returned 1 [0108.363] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster.jpg.enciphered")) returned 1 [0108.368] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster2x.jpg.enciphered")) returned 1 [0108.372] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster.jpg.enciphered")) returned 1 [0108.381] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster2x.jpg.enciphered")) returned 1 [0108.384] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster.jpg.enciphered")) returned 1 [0108.388] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster2x.jpg.enciphered")) returned 1 [0108.390] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons.png.enciphered")) returned 1 [0108.401] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons2x.png.enciphered")) returned 1 [0108.404] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster.jpg.enciphered")) returned 1 [0108.408] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster2x.jpg.enciphered")) returned 1 [0108.411] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster.jpg.enciphered")) returned 1 [0108.415] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster2x.jpg.enciphered")) returned 1 [0108.418] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster.jpg.enciphered")) returned 1 [0108.423] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster2x.jpg.enciphered")) returned 1 [0108.426] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster.jpg.enciphered")) returned 1 [0108.432] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster2x.jpg.enciphered")) returned 1 [0108.435] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster.jpg.enciphered")) returned 1 [0108.439] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster2x.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster2x.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster2x.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster2x.jpg.enciphered")) returned 1 [0108.520] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools-2x.png.enciphered")) returned 1 [0108.591] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\activate-more-tools.png.enciphered")) returned 1 [0108.595] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment-2x.png.enciphered")) returned 1 [0108.599] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\add-comment.png.enciphered")) returned 1 [0108.604] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf-2x.png.enciphered")) returned 1 [0108.607] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-dynamic-pdf.png.enciphered")) returned 1 [0108.654] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback-2x.png.enciphered")) returned 1 [0108.658] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-feedback.png.enciphered")) returned 1 [0108.663] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started-2x.png.enciphered")) returned 1 [0108.667] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-getting-started.png.enciphered")) returned 1 [0108.670] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile-2x.png.enciphered")) returned 1 [0108.673] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\beta-mobile.png.enciphered")) returned 1 [0108.678] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\BringContenttoLife-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\bringcontenttolife-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\BringContenttoLife-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\bringcontenttolife-2x.png.enciphered")) returned 1 [0108.686] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\BringContenttoLife.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\bringcontenttolife.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\BringContenttoLife.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\bringcontenttolife.png.enciphered")) returned 1 [0108.691] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext-2x.png.enciphered")) returned 1 [0108.700] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\chrome-ext.png.enciphered")) returned 1 [0108.703] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\close.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\close.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\close.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\close.png.enciphered")) returned 1 [0108.707] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files-2x.png.enciphered")) returned 1 [0108.710] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\combine-files.png.enciphered")) returned 1 [0108.714] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare-2x.png.enciphered")) returned 1 [0108.717] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\compare.png.enciphered")) returned 1 [0108.721] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig-2x.png.enciphered")) returned 1 [0108.724] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\digsig.png.enciphered")) returned 1 [0108.727] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf-2x.png.enciphered")) returned 1 [0108.731] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\edit-pdf.png.enciphered")) returned 1 [0108.777] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\editvideoimage.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\editvideoimage.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\editvideoimage.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\editvideoimage.png.enciphered")) returned 1 [0108.784] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\error-icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\error-icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\error-icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\error-icon.png.enciphered")) returned 1 [0108.789] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign-2x.png.enciphered")) returned 1 [0108.793] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\fill-sign.png.enciphered")) returned 1 [0108.798] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text-2x.png.enciphered")) returned 1 [0108.801] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\find-text.png.enciphered")) returned 1 [0108.805] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags.png.enciphered")) returned 1 [0108.846] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags@2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags@2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags@2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\flags@2x.png.enciphered")) returned 1 [0108.851] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures-2x.png.enciphered")) returned 1 [0108.855] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\get-e-signatures.png.enciphered")) returned 1 [0108.858] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Getmobile-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\getmobile-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Getmobile-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\getmobile-2x.png.enciphered")) returned 1 [0108.862] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\GetMobile.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\getmobile.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\GetMobile.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\getmobile.png.enciphered")) returned 1 [0108.866] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile-2x.png.enciphered")) returned 1 [0108.869] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\go-mobile.png.enciphered")) returned 1 [0108.872] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf-2x.png.enciphered")) returned 1 [0108.875] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\improved-office-to-pdf.png.enciphered")) returned 1 [0108.878] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started-2x.png.enciphered")) returned 1 [0108.881] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\lets-get-started.png.enciphered")) returned 1 [0108.956] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view-2x.png.enciphered")) returned 1 [0108.960] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\multi-tab-file-view.png.enciphered")) returned 1 [0108.965] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages-2x.png.enciphered")) returned 1 [0108.968] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\organize-pages.png.enciphered")) returned 1 [0108.977] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text-2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text-2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text-2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text-2x.gif.enciphered")) returned 1 [0108.985] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-no-text.gif.enciphered")) returned 1 [0108.993] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de.gif.enciphered")) returned 1 [0109.033] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de_2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-de_de_2x.gif.enciphered")) returned 1 [0109.043] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us.gif.enciphered")) returned 1 [0109.065] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us_2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-en_us_2x.gif.enciphered")) returned 1 [0109.106] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es.gif.enciphered")) returned 1 [0109.121] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es_2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-es_es_2x.gif.enciphered")) returned 1 [0109.130] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr.gif.enciphered")) returned 1 [0109.180] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr_2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-fr_fr_2x.gif.enciphered")) returned 1 [0109.189] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp.gif.enciphered")) returned 1 [0109.205] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp_2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp_2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp_2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-rdr-ja_jp_2x.gif.enciphered")) returned 1 [0109.246] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2-2x.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2-2x.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2-2x.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2-2x.gif.enciphered")) returned 1 [0109.289] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdf-ownership-variant2.gif.enciphered")) returned 1 [0109.294] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\PDFInWord-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdfinword-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\PDFInWord-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdfinword-2x.png.enciphered")) returned 1 [0109.297] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\PDFInWord.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdfinword.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\PDFInWord.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\pdfinword.png.enciphered")) returned 1 [0109.300] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode-2x.png.enciphered")) returned 1 [0109.303] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\reduced_mode.png.enciphered")) returned 1 [0109.308] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan-2x.png.enciphered")) returned 1 [0109.311] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\scan.png.enciphered")) returned 1 [0109.314] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\ShareFeedback-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sharefeedback-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\ShareFeedback-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sharefeedback-2x.png.enciphered")) returned 1 [0109.317] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\ShareFeedback.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sharefeedback.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\ShareFeedback.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sharefeedback.png.enciphered")) returned 1 [0109.323] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in-2x.png.enciphered")) returned 1 [0109.326] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\sign-in.png.enciphered")) returned 1 [0109.330] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme-2x.png.enciphered")) returned 1 [0109.332] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\theme.png.enciphered")) returned 1 [0109.336] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search-2x.png.enciphered")) returned 1 [0109.339] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\tool-search.png.enciphered")) returned 1 [0109.343] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell-2x.png.enciphered")) returned 1 [0109.346] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\upsell.png.enciphered")) returned 1 [0109.350] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome-2x.png.enciphered")) returned 1 [0109.356] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\welcome.png.enciphered")) returned 1 [0109.359] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WordContent-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\wordcontent-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WordContent-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\wordcontent-2x.png.enciphered")) returned 1 [0109.362] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WordContent.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\wordcontent.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WordContent.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\wordcontent.png.enciphered")) returned 1 [0109.373] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WorkBetter-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\workbetter-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WorkBetter-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\workbetter-2x.png.enciphered")) returned 1 [0109.377] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WorkBetter.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\workbetter.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\WorkBetter.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\workbetter.png.enciphered")) returned 1 [0109.494] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\example_icons.png.enciphered")) returned 1 [0109.497] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\example_icons2x.png.enciphered")) returned 1 [0109.499] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon.png.enciphered")) returned 1 [0109.502] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_2x.png.enciphered")) returned 1 [0109.506] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover.png.enciphered")) returned 1 [0109.508] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0109.517] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons.png.enciphered")) returned 1 [0109.520] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\example_icons2x.png.enciphered")) returned 1 [0109.548] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon.png.enciphered")) returned 1 [0109.550] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_2x.png.enciphered")) returned 1 [0109.552] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover.png.enciphered")) returned 1 [0109.555] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.enciphered")) returned 1 [0109.696] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\Adobe Sign White Paper.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\assets\\sample files\\adobe sign white paper.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\Adobe Sign White Paper.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\assets\\sample files\\adobe sign white paper.pdf.enciphered")) returned 1 [0109.735] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\Document Cloud for Government.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\assets\\sample files\\document cloud for government.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\Document Cloud for Government.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\assets\\sample files\\document cloud for government.pdf.enciphered")) returned 1 [0109.753] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\Travelocity.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\assets\\sample files\\travelocity.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\Travelocity.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\sample-files\\assets\\sample files\\travelocity.pdf.enciphered")) returned 1 [0109.944] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\appstore.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\appstore.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\appstore.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\appstore.png.enciphered")) returned 1 [0109.950] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags.png.enciphered")) returned 1 [0109.979] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags@2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags@2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags@2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\flags@2x.png.enciphered")) returned 1 [0109.996] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\playstore.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\playstore.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\playstore.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\playstore.png.enciphered")) returned 1 [0110.000] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanAppLogo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanapplogo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanAppLogo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanapplogo.png.enciphered")) returned 1 [0110.004] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanAppLogo@2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanapplogo@2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanAppLogo@2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\scanapplogo@2x.png.enciphered")) returned 1 [0110.069] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured.png.enciphered")) returned 1 [0110.092] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured_lg.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured_lg.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured_lg.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\cloud_secured_lg.png.enciphered")) returned 1 [0110.097] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\core_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\core_icons.png.enciphered")) returned 1 [0110.100] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\faf_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\faf_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\faf_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\faf_icons.png.enciphered")) returned 1 [0110.103] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\progress.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\progress.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\progress.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\progress.gif.enciphered")) returned 1 [0110.109] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured.png.enciphered")) returned 1 [0110.112] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured_lg.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured_lg.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured_lg.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\cloud_secured_lg.png.enciphered")) returned 1 [0110.115] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\core_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\core_icons.png.enciphered")) returned 1 [0110.118] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\faf_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\faf_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\faf_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\faf_icons.png.enciphered")) returned 1 [0110.123] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\progress.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\progress.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\progress.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\progress.gif.enciphered")) returned 1 [0110.410] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\adc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\adc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\adc_logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\adc_logo.png.enciphered")) returned 1 [0110.414] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\adobe_spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\adobe_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\adobe_spinner.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\adobe_spinner.gif.enciphered")) returned 1 [0110.418] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons.png.enciphered")) returned 1 [0110.422] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\core_icons_retina.png.enciphered")) returned 1 [0110.425] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\download-btn.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\download-btn.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\download-btn.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\download-btn.png.enciphered")) returned 1 [0110.431] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adc_logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adc_logo.png.enciphered")) returned 1 [0110.435] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adobe_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adobe_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adobe_logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\adobe_logo.png.enciphered")) returned 1 [0110.438] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dc_logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dc_logo.png.enciphered")) returned 1 [0110.443] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\adobe-old-logo.jpg" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\adobe-old-logo.jpg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\adobe-old-logo.jpg.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\adobe-old-logo.jpg.enciphered")) returned 1 [0110.446] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\fake_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\fake_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\fake_logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\fake_logo.png.enciphered")) returned 1 [0110.456] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\empty.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\empty.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\empty.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\empty.png.enciphered")) returned 1 [0110.462] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adc_logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adc_logo.png.enciphered")) returned 1 [0110.467] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adobe_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adobe_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adobe_logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\adobe_logo.png.enciphered")) returned 1 [0110.469] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\file_info.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\file_info.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\file_info.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\file_info.png.enciphered")) returned 1 [0110.472] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\file_info2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\file_info2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\file_info2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\file_info2x.png.enciphered")) returned 1 [0110.475] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations.png.enciphered")) returned 1 [0110.478] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\illustrations_retina.png.enciphered")) returned 1 [0110.481] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\logo_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\logo_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\logo_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\logo_retina.png.enciphered")) returned 1 [0110.484] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\new_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\new_icons.png.enciphered")) returned 1 [0110.490] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adc_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adc_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adc_logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adc_logo.png.enciphered")) returned 1 [0110.494] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adobe_spinner.gif" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adobe_spinner.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adobe_spinner.gif.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\adobe_spinner.gif.enciphered")) returned 1 [0110.536] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons.png.enciphered")) returned 1 [0110.541] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\core_icons_retina.png.enciphered")) returned 1 [0110.544] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\download-btn.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\download-btn.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\download-btn.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\download-btn.png.enciphered")) returned 1 [0110.547] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info.png.enciphered")) returned 1 [0110.561] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\file_info2x.png.enciphered")) returned 1 [0110.565] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations.png.enciphered")) returned 1 [0110.573] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\illustrations_retina.png.enciphered")) returned 1 [0110.577] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\logo_retina.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\logo_retina.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\logo_retina.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\logo_retina.png.enciphered")) returned 1 [0110.580] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\new_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\new_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\new_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\new_icons.png.enciphered")) returned 1 [0110.595] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\bun.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\bun.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\bun.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\bun.png.enciphered")) returned 1 [0110.597] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview.png.enciphered")) returned 1 [0110.601] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\cstm_brand_preview2x.png.enciphered")) returned 1 [0110.603] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small.png.enciphered")) returned 1 [0110.606] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\dd_arrow_small2x.png.enciphered")) returned 1 [0110.609] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\nub.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\nub.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\nub.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\nub.png.enciphered")) returned 1 [0110.612] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo.png.enciphered")) returned 1 [0110.615] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\sat_logo_2x.png.enciphered")) returned 1 [0110.618] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons.png.enciphered")) returned 1 [0110.621] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\share_icons2x.png.enciphered")) returned 1 [0110.629] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\bun.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\bun.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\bun.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\bun.png.enciphered")) returned 1 [0110.636] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview.png.enciphered")) returned 1 [0110.640] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\cstm_brand_preview2x.png.enciphered")) returned 1 [0110.642] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small.png.enciphered")) returned 1 [0110.645] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\dd_arrow_small2x.png.enciphered")) returned 1 [0110.649] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\nub.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\nub.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\nub.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\nub.png.enciphered")) returned 1 [0110.653] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo.png.enciphered")) returned 1 [0110.656] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo_2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo_2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo_2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\sat_logo_2x.png.enciphered")) returned 1 [0110.659] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons.png.enciphered")) returned 1 [0110.662] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\share_icons2x.png.enciphered")) returned 1 [0110.773] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\checkmark-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\checkmark-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\checkmark-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\checkmark-2x.png.enciphered")) returned 1 [0110.777] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\checkmark.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\checkmark.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\checkmark.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\checkmark.png.enciphered")) returned 1 [0110.874] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark-2x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark-2x.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark-2x.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark-2x.png.enciphered")) returned 1 [0110.878] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark.png"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\checkmark.png.enciphered")) returned 1 [0110.953] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Welcome.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\welcome.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Welcome.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\welcome.pdf.enciphered")) returned 1 [0110.958] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\readme.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\ReadMe.htm.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\readme.htm.enciphered")) returned 1 [0110.965] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\enutxt.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\ENUtxt.pdf.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\enutxt.pdf.enciphered")) returned 1 [0110.978] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt.enciphered")) returned 1 [0110.984] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt.enciphered")) returned 1 [0111.055] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\centeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\centeuro.txt.enciphered")) returned 1 [0111.061] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\corpchar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\corpchar.txt.enciphered")) returned 1 [0111.065] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\croatian.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\croatian.txt.enciphered")) returned 1 [0111.068] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\cyrillic.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\cyrillic.txt.enciphered")) returned 1 [0111.076] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\greek.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\greek.txt.enciphered")) returned 1 [0111.080] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\iceland.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\iceland.txt.enciphered")) returned 1 [0111.127] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\roman.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\roman.txt.enciphered")) returned 1 [0111.132] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\romanian.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\romanian.txt.enciphered")) returned 1 [0111.138] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\symbol.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\symbol.txt.enciphered")) returned 1 [0111.143] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\turkish.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\turkish.txt.enciphered")) returned 1 [0111.146] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\ukraine.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\mac\\ukraine.txt.enciphered")) returned 1 [0111.152] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1250.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1250.txt.enciphered")) returned 1 [0111.156] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1251.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1251.txt.enciphered")) returned 1 [0111.159] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1252.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1252.txt.enciphered")) returned 1 [0111.162] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1253.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1253.txt.enciphered")) returned 1 [0111.205] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1254.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1254.txt.enciphered")) returned 1 [0111.209] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1257.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1257.txt.enciphered")) returned 1 [0111.212] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1258.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT.EnCiPhErEd" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\resource\\typesupport\\unicode\\mappings\\win\\cp1258.txt.enciphered")) returned 1 [0111.232] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt.enciphered")) returned 1 [0111.236] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt.enciphered")) returned 1 [0111.240] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt.enciphered")) returned 1 [0111.280] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt.enciphered")) returned 1 [0111.284] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt.enciphered")) returned 1 [0111.294] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_CA\\List.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\abbreviations\\en_ca\\list.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_CA\\List.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\abbreviations\\en_ca\\list.txt.enciphered")) returned 1 [0111.300] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_GB\\List.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\abbreviations\\en_gb\\list.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_GB\\List.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\abbreviations\\en_gb\\list.txt.enciphered")) returned 1 [0111.307] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_US\\List.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\abbreviations\\en_us\\list.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_US\\List.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\abbreviations\\en_us\\list.txt.enciphered")) returned 1 [0111.367] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_CA\\README_en_CA.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_ca\\readme_en_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_CA\\README_en_CA.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_ca\\readme_en_ca.txt.enciphered")) returned 1 [0111.375] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_CA\\README_th_en_CA_v2.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_ca\\readme_th_en_ca_v2.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_CA\\README_th_en_CA_v2.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_ca\\readme_th_en_ca_v2.txt.enciphered")) returned 1 [0111.383] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\affDescription.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\affdescription.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\affDescription.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\affdescription.txt.enciphered")) returned 1 [0111.387] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\changelog.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\changelog.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\changelog.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\changelog.txt.enciphered")) returned 1 [0111.392] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\license.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\license.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\license.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\license.txt.enciphered")) returned 1 [0111.397] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\README.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\readme.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\README.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\readme.txt.enciphered")) returned 1 [0111.443] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\README_en_GB.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\readme_en_gb.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\README_en_GB.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\readme_en_gb.txt.enciphered")) returned 1 [0111.447] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\WordNet_license.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\wordnet_license.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\WordNet_license.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_gb\\wordnet_license.txt.enciphered")) returned 1 [0111.454] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_US\\README_en_US.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_us\\readme_en_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_US\\README_en_US.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\dictionaries\\en_us\\readme_en_us.txt.enciphered")) returned 1 [0111.461] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_CA\\added.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_ca\\added.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_CA\\added.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_ca\\added.txt.enciphered")) returned 1 [0111.464] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_CA\\excluded.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_ca\\excluded.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_CA\\excluded.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_ca\\excluded.txt.enciphered")) returned 1 [0111.470] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_GB\\added.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_gb\\added.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_GB\\added.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_gb\\added.txt.enciphered")) returned 1 [0111.473] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_GB\\excluded.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_gb\\excluded.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_GB\\excluded.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_gb\\excluded.txt.enciphered")) returned 1 [0111.484] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_US\\Added.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_us\\added.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_US\\Added.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_us\\added.txt.enciphered")) returned 1 [0111.487] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_US\\Excluded.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_us\\excluded.txt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_US\\Excluded.txt.EnCiPhErEd" (normalized: "c:\\program files (x86)\\common files\\adobe\\reader\\dc\\linguistics\\providers\\plugins2\\adobehunspellplugin\\supplementaldictionaries\\en_us\\excluded.txt.enciphered")) returned 1 [0111.775] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\installer\\chrome.7z"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\Installer\\chrome.7z.EnCiPhErEd" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\installer\\chrome.7z.enciphered")) returned 1 [0111.797] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logo.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logo.png.enciphered")) returned 1 [0111.801] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logobeta.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logobeta.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logobeta.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logobeta.png.enciphered")) returned 1 [0111.805] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logocanary.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logocanary.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logocanary.png.enciphered")) returned 1 [0111.847] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logodev.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logodev.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\logodev.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\logodev.png.enciphered")) returned 1 [0111.851] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogo.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogo.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogo.png.enciphered")) returned 1 [0111.854] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogobeta.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogobeta.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogobeta.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogobeta.png.enciphered")) returned 1 [0111.857] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogocanary.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogocanary.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogocanary.png.enciphered")) returned 1 [0111.860] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogodev.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogodev.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\smalllogodev.png.EnCiPhErEd" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\61.0.3163.79\\visualelements\\smalllogodev.png.enciphered")) returned 1 [0113.111] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp.enciphered")) returned 1 [0113.116] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png.enciphered")) returned 1 [0113.121] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png.enciphered")) returned 1 [0113.123] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png.enciphered")) returned 1 [0113.125] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png.enciphered")) returned 1 [0113.127] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png.enciphered")) returned 1 [0113.146] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp.enciphered")) returned 1 [0113.148] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png.enciphered")) returned 1 [0114.270] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.enciphered")) returned 1 [0114.278] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.enciphered")) returned 1 [0114.289] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk.enciphered")) returned 1 [0114.298] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.enciphered")) returned 1 [0114.309] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.enciphered")) returned 1 [0114.313] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk.enciphered")) returned 1 [0114.316] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.enciphered")) returned 1 [0114.319] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.enciphered")) returned 1 [0114.322] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk.enciphered")) returned 1 [0114.328] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.enciphered")) returned 1 [0114.332] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk.enciphered")) returned 1 [0114.335] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk.enciphered")) returned 1 [0114.339] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.enciphered")) returned 1 [0114.342] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk.enciphered")) returned 1 [0114.345] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk.enciphered")) returned 1 [0114.353] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.enciphered")) returned 1 [0114.512] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.enciphered")) returned 1 [0114.517] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk.enciphered")) returned 1 [0114.520] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk.enciphered")) returned 1 [0114.523] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.enciphered")) returned 1 [0114.527] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.enciphered")) returned 1 [0114.532] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.enciphered")) returned 1 [0114.535] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk.enciphered")) returned 1 [0114.538] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk.enciphered")) returned 1 [0114.614] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.enciphered")) returned 1 [0114.618] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.enciphered")) returned 1 [0114.622] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk.enciphered")) returned 1 [0114.627] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.enciphered")) returned 1 [0114.631] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.enciphered")) returned 1 [0114.646] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.enciphered")) returned 1 [0114.652] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk.enciphered")) returned 1 [0114.655] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.enciphered")) returned 1 [0114.658] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.enciphered")) returned 1 [0114.661] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.enciphered")) returned 1 [0114.664] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.enciphered")) returned 1 [0114.887] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.enciphered")) returned 1 [0115.058] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.enciphered")) returned 1 [0115.261] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.enciphered")) returned 1 [0115.274] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.enciphered")) returned 1 [0115.277] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.enciphered")) returned 1 [0115.280] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.enciphered")) returned 1 [0115.283] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk.enciphered")) returned 1 [0115.286] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.enciphered")) returned 1 [0115.289] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.enciphered")) returned 1 [0115.292] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.enciphered")) returned 1 [0115.295] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.enciphered")) returned 1 [0115.298] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.enciphered")) returned 1 [0115.301] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.enciphered")) returned 1 [0115.544] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.enciphered")) returned 1 [0115.569] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.enciphered")) returned 1 [0115.573] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.enciphered")) returned 1 [0115.598] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk.enciphered")) returned 1 [0115.602] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.enciphered")) returned 1 [0115.604] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.enciphered")) returned 1 [0115.611] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk.enciphered")) returned 1 [0115.880] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk.enciphered")) returned 1 [0115.941] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk.enciphered")) returned 1 [0115.948] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk.enciphered")) returned 1 [0115.952] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.enciphered")) returned 1 [0115.956] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk.enciphered")) returned 1 [0115.961] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\01 - file explorer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\01 - file explorer.lnk.enciphered")) returned 1 [0115.964] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\03 - documents.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\03 - documents.lnk.enciphered")) returned 1 [0115.966] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\04 - downloads.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\04 - downloads.lnk.enciphered")) returned 1 [0115.970] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\05 - music.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\05 - music.lnk.enciphered")) returned 1 [0115.972] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\06 - pictures.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\06 - pictures.lnk.enciphered")) returned 1 [0115.974] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\07 - videos.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\07 - videos.lnk.enciphered")) returned 1 [0115.977] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\08 - homegroup.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\08 - homegroup.lnk.enciphered")) returned 1 [0115.980] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\09 - network.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\09 - network.lnk.enciphered")) returned 1 [0116.014] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\10 - userprofile.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows\\start menu places\\10 - userprofile.lnk.enciphered")) returned 1 [0116.031] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.enciphered")) returned 1 [0116.196] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png.EnCiPhErEd" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png.enciphered")) returned 1 [0117.425] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.enciphered")) returned 1 [0117.431] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.enciphered")) returned 1 [0117.483] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.enciphered")) returned 1 [0117.489] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.enciphered")) returned 1 [0117.491] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.enciphered")) returned 1 [0117.494] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.enciphered")) returned 1 [0117.500] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.enciphered")) returned 1 [0117.508] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.enciphered")) returned 1 [0117.517] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.enciphered")) returned 1 [0117.520] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.enciphered")) returned 1 [0117.540] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.enciphered")) returned 1 [0117.544] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.enciphered")) returned 1 [0117.561] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk.enciphered")) returned 1 [0117.565] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.enciphered")) returned 1 [0117.568] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk.enciphered")) returned 1 [0117.571] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.enciphered")) returned 1 [0117.573] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk.enciphered")) returned 1 [0117.576] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.enciphered")) returned 1 [0117.579] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk.enciphered")) returned 1 [0117.587] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.enciphered")) returned 1 [0117.591] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.enciphered")) returned 1 [0117.602] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.enciphered")) returned 1 [0117.623] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.enciphered")) returned 1 [0117.626] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.enciphered")) returned 1 [0117.629] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.enciphered")) returned 1 [0117.633] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.enciphered")) returned 1 [0117.641] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.enciphered")) returned 1 [0117.643] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.enciphered")) returned 1 [0117.652] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.enciphered")) returned 1 [0117.655] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.enciphered")) returned 1 [0117.658] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.enciphered")) returned 1 [0117.664] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.enciphered")) returned 1 [0117.666] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.enciphered")) returned 1 [0117.669] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.enciphered")) returned 1 [0117.672] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.enciphered")) returned 1 [0117.810] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.enciphered")) returned 1 [0117.813] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.enciphered")) returned 1 [0117.815] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.enciphered")) returned 1 [0117.940] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.enciphered")) returned 1 [0117.943] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.enciphered")) returned 1 [0117.944] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.enciphered")) returned 1 [0118.133] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.enciphered")) returned 1 [0118.233] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.enciphered")) returned 1 [0118.435] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.enciphered")) returned 1 [0118.913] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\craw_window.html.enciphered")) returned 1 [0118.939] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\flapper.gif.enciphered")) returned 1 [0118.945] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_128.png.enciphered")) returned 1 [0118.947] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\icon_16.png.enciphered")) returned 1 [0118.949] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button.png.enciphered")) returned 1 [0118.952] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_close.png.enciphered")) returned 1 [0118.954] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_hover.png.enciphered")) returned 1 [0118.956] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_maximize.png.enciphered")) returned 1 [0118.958] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\topbar_floating_button_pressed.png.enciphered")) returned 1 [0119.069] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.enciphered")) returned 1 [0119.182] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_route_details.html.enciphered")) returned 1 [0119.190] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\chromecast_logo_grey.png.enciphered")) returned 1 [0119.192] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\devices.html.enciphered")) returned 1 [0119.195] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\index.html.enciphered")) returned 1 [0119.196] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\offers.html.enciphered")) returned 1 [0119.197] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\setup.html.enciphered")) returned 1 [0119.208] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\view.html.enciphered")) returned 1 [0119.212] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\feedback.html.enciphered")) returned 1 [0119.463] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.enciphered")) returned 1 [0119.717] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppBlue.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appblue.png.enciphered")) returned 1 [0119.739] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AppWhite.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\appwhite.png.enciphered")) returned 1 [0119.749] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.gif.enciphered")) returned 1 [0119.755] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\AutoPlayOptIn.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\autoplayoptin.png.enciphered")) returned 1 [0119.757] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppBlue.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappblue.png.enciphered")) returned 1 [0119.760] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ElevatedAppWhite.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\elevatedappwhite.png.enciphered")) returned 1 [0119.762] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Error.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\error.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Error.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\error.png.enciphered")) returned 1 [0119.855] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\OneDriveLogo.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\onedrivelogo.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\OneDriveLogo.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\onedrivelogo.png.enciphered")) returned 1 [0119.894] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaCritical.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotacritical.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaCritical.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotacritical.png.enciphered")) returned 1 [0119.899] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaError.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotaerror.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaError.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotaerror.png.enciphered")) returned 1 [0119.902] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaNearing.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotanearing.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\QuotaNearing.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\quotanearing.png.enciphered")) returned 1 [0119.908] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ScreenshotOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\screenshotoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ScreenshotOptIn.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\screenshotoptin.gif.enciphered")) returned 1 [0119.913] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ThirdPartyNotices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\thirdpartynotices.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ThirdPartyNotices.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\thirdpartynotices.txt.enciphered")) returned 1 [0119.917] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Warning.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\warning.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\Warning.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.6816.0313_1\\warning.png.enciphered")) returned 1 [0119.931] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png.enciphered")) returned 1 [0119.941] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png.enciphered")) returned 1 [0119.944] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png.enciphered")) returned 1 [0119.947] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png.enciphered")) returned 1 [0119.950] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png.enciphered")) returned 1 [0119.959] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.gif.enciphered")) returned 1 [0119.962] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.png.enciphered")) returned 1 [0119.966] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppBlue.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappblue.png.enciphered")) returned 1 [0119.969] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppWhite.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappwhite.png.enciphered")) returned 1 [0119.973] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\Error.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\error.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\Error.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\error.png.enciphered")) returned 1 [0119.976] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ErrorPage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\errorpage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ErrorPage.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\errorpage.html.enciphered")) returned 1 [0119.998] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\LoadingPage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\loadingpage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\LoadingPage.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\loadingpage.html.enciphered")) returned 1 [0120.007] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\OneDriveLogo.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\onedrivelogo.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\OneDriveLogo.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7076.1026\\onedrivelogo.png.enciphered")) returned 1 [0120.024] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\alertIcon.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\alerticon.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\alertIcon.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\alerticon.png.enciphered")) returned 1 [0120.075] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\appblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppBlue.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\appblue.png.enciphered")) returned 1 [0120.079] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppErrorBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\apperrorblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppErrorBlue.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\apperrorblue.png.enciphered")) returned 1 [0120.083] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppErrorWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\apperrorwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppErrorWhite.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\apperrorwhite.png.enciphered")) returned 1 [0120.085] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\appwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AppWhite.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\appwhite.png.enciphered")) returned 1 [0120.102] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AutoPlayOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AutoPlayOptIn.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\autoplayoptin.gif.enciphered")) returned 1 [0120.105] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AutoPlayOptIn.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\autoplayoptin.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\AutoPlayOptIn.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\autoplayoptin.png.enciphered")) returned 1 [0120.139] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ElevatedAppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\elevatedappblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ElevatedAppBlue.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\elevatedappblue.png.enciphered")) returned 1 [0120.143] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ElevatedAppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\elevatedappwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ElevatedAppWhite.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\elevatedappwhite.png.enciphered")) returned 1 [0120.151] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\Error.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\error.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\Error.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\error.png.enciphered")) returned 1 [0120.182] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ErrorPage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\errorpage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ErrorPage.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\errorpage.html.enciphered")) returned 1 [0120.255] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\images\\blurrect.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\images\\blurrect.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\images\\blurrect.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\images\\blurrect.png.enciphered")) returned 1 [0120.298] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\LoadingPage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\loadingpage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\LoadingPage.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\loadingpage.html.enciphered")) returned 1 [0120.335] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\OneDriveLogo.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\onedrivelogo.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\OneDriveLogo.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\onedrivelogo.png.enciphered")) returned 1 [0120.369] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\QuotaCritical.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quotacritical.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\QuotaCritical.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quotacritical.png.enciphered")) returned 1 [0120.374] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\QuotaError.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quotaerror.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\QuotaError.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quotaerror.png.enciphered")) returned 1 [0120.378] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\QuotaNearing.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quotanearing.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\QuotaNearing.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\quotanearing.png.enciphered")) returned 1 [0120.397] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ScreenshotOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\screenshotoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ScreenshotOptIn.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\screenshotoptin.gif.enciphered")) returned 1 [0120.523] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\TestSharePage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\testsharepage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\TestSharePage.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\testsharepage.html.enciphered")) returned 1 [0120.532] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ThirdPartyNotices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\thirdpartynotices.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ThirdPartyNotices.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\thirdpartynotices.txt.enciphered")) returned 1 [0120.567] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\Warning.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\warning.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\Warning.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7131.1115\\warning.png.enciphered")) returned 1 [0120.593] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\alertIcon.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\alerticon.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\alertIcon.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\alerticon.png.enciphered")) returned 1 [0120.613] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\appblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppBlue.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\appblue.png.enciphered")) returned 1 [0120.617] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppErrorBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\apperrorblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppErrorBlue.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\apperrorblue.png.enciphered")) returned 1 [0120.621] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppErrorWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\apperrorwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppErrorWhite.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\apperrorwhite.png.enciphered")) returned 1 [0120.623] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\appwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AppWhite.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\appwhite.png.enciphered")) returned 1 [0120.642] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AutoPlayOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AutoPlayOptIn.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\autoplayoptin.gif.enciphered")) returned 1 [0120.646] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AutoPlayOptIn.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\autoplayoptin.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\AutoPlayOptIn.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\autoplayoptin.png.enciphered")) returned 1 [0120.679] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ElevatedAppBlue.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\elevatedappblue.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ElevatedAppBlue.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\elevatedappblue.png.enciphered")) returned 1 [0120.683] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ElevatedAppWhite.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\elevatedappwhite.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ElevatedAppWhite.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\elevatedappwhite.png.enciphered")) returned 1 [0120.698] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\Error.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\error.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\Error.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\error.png.enciphered")) returned 1 [0120.701] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ErrorPage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\errorpage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ErrorPage.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\errorpage.html.enciphered")) returned 1 [0120.757] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\images\\blurrect.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\images\\blurrect.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\images\\blurrect.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\images\\blurrect.png.enciphered")) returned 1 [0120.807] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\LoadingPage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\loadingpage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\LoadingPage.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\loadingpage.html.enciphered")) returned 1 [0120.848] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\OneDriveLogo.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\onedrivelogo.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\OneDriveLogo.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\onedrivelogo.png.enciphered")) returned 1 [0120.934] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\QuotaCritical.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\quotacritical.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\QuotaCritical.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\quotacritical.png.enciphered")) returned 1 [0120.938] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\QuotaError.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\quotaerror.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\QuotaError.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\quotaerror.png.enciphered")) returned 1 [0120.941] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\QuotaNearing.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\quotanearing.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\QuotaNearing.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\quotanearing.png.enciphered")) returned 1 [0120.968] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ScreenshotOptIn.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\screenshotoptin.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ScreenshotOptIn.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\screenshotoptin.gif.enciphered")) returned 1 [0120.998] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\TestSharePage.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\testsharepage.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\TestSharePage.html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\testsharepage.html.enciphered")) returned 1 [0121.009] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ThirdPartyNotices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\thirdpartynotices.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ThirdPartyNotices.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\thirdpartynotices.txt.enciphered")) returned 1 [0121.036] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\Warning.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\warning.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\Warning.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\onedrive\\17.3.7294.0108\\warning.png.enciphered")) returned 1 [0121.183] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\353d8595.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\353d8595.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\353d8595.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\353d8595.jpg.enciphered")) returned 1 [0121.192] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\ca910921.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\ca910921.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\ca910921.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\ca910921.jpg.enciphered")) returned 1 [0121.238] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.enciphered")) returned 1 [0121.244] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.enciphered")) returned 1 [0121.251] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.enciphered")) returned 1 [0121.254] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.enciphered")) returned 1 [0121.257] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.enciphered")) returned 1 [0121.260] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.enciphered")) returned 1 [0121.267] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.enciphered")) returned 1 [0121.274] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.enciphered")) returned 1 [0121.277] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.enciphered")) returned 1 [0121.281] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.enciphered")) returned 1 [0121.289] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.enciphered")) returned 1 [0121.291] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.enciphered")) returned 1 [0121.296] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk.enciphered")) returned 1 [0121.299] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk.enciphered")) returned 1 [0121.302] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.enciphered")) returned 1 [0121.305] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk.enciphered")) returned 1 [0121.334] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk.enciphered")) returned 1 [0121.338] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.enciphered")) returned 1 [0121.340] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk.enciphered")) returned 1 [0121.343] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk.enciphered")) returned 1 [0121.347] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.enciphered")) returned 1 [0121.351] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk.enciphered")) returned 1 [0121.355] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk.enciphered")) returned 1 [0122.305] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FE83WYZ0.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fe83wyz0.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FE83WYZ0.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fe83wyz0.txt.enciphered")) returned 1 [0122.309] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\K7RPYYP8.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\k7rpyyp8.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\K7RPYYP8.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\k7rpyyp8.txt.enciphered")) returned 1 [0122.312] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LA7BUP1E.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\la7bup1e.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LA7BUP1E.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\la7bup1e.txt.enciphered")) returned 1 [0122.316] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\NBLJVIM8.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\nbljvim8.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\NBLJVIM8.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\nbljvim8.txt.enciphered")) returned 1 [0122.318] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\ODUED5IU.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\odued5iu.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\ODUED5IU.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\odued5iu.txt.enciphered")) returned 1 [0122.320] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\S7Q1EH8Y.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\s7q1eh8y.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\S7Q1EH8Y.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\s7q1eh8y.txt.enciphered")) returned 1 [0122.322] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\UZ3Q0402.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\uz3q0402.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\UZ3Q0402.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\uz3q0402.txt.enciphered")) returned 1 [0123.585] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\AFIOGFFU.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\afiogffu.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\AFIOGFFU.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\afiogffu.txt.enciphered")) returned 1 [0123.607] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\Init[1].htm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\init[1].htm"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\Init[1].htm.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\1\\init[1].htm.enciphered")) returned 1 [0123.658] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\Init[1].htm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\init[1].htm"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\Init[1].htm.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\vcc8d03d\\3\\init[1].htm.enciphered")) returned 1 [0125.818] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_COOBE[1].html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_coobe[1].html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_COOBE[1].html.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_coobe[1].html.enciphered")) returned 1 [0125.875] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_cortanaicon[1].png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_cortanaicon[1].png.enciphered")) returned 1 [0126.011] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_10[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_10[1].txt.enciphered")) returned 1 [0126.023] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_11[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_11[1].txt.enciphered")) returned 1 [0126.125] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_12[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_12[1].txt.enciphered")) returned 1 [0126.135] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_13[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_13[1].txt.enciphered")) returned 1 [0126.188] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_14[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_14[1].txt.enciphered")) returned 1 [0126.221] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_15[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_15[1].txt.enciphered")) returned 1 [0126.255] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_16[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_16[1].txt.enciphered")) returned 1 [0126.262] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_17[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_17[1].txt.enciphered")) returned 1 [0126.269] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_18[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_18[1].txt.enciphered")) returned 1 [0126.277] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_19[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_19[1].txt.enciphered")) returned 1 [0126.284] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_20[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_20[1].txt.enciphered")) returned 1 [0126.289] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_2[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_2[1].txt.enciphered")) returned 1 [0126.298] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_3[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_3[1].txt.enciphered")) returned 1 [0126.302] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_4[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_4[1].txt.enciphered")) returned 1 [0126.309] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_5[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_5[1].txt.enciphered")) returned 1 [0126.313] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_6[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_6[1].txt.enciphered")) returned 1 [0126.319] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_7[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_7[1].txt.enciphered")) returned 1 [0126.326] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_8[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_8[1].txt.enciphered")) returned 1 [0126.333] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_9[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_9[1].txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_9[1].txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_9[1].txt.enciphered")) returned 1 [0126.463] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt.enciphered")) returned 1 [0126.510] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt.enciphered")) returned 1 [0126.518] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt.enciphered")) returned 1 [0126.526] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt.enciphered")) returned 1 [0126.534] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt.enciphered")) returned 1 [0126.542] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt.enciphered")) returned 1 [0126.546] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt.enciphered")) returned 1 [0126.560] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt.enciphered")) returned 1 [0126.566] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt.enciphered")) returned 1 [0126.573] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt.enciphered")) returned 1 [0126.583] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt.enciphered")) returned 1 [0126.590] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache131509115860744759.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache131509115860744759.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache131509115860744759.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache131509115860744759.txt.enciphered")) returned 1 [0126.597] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\SettingsCache.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\settingscache.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\SettingsCache.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\settingscache.txt.enciphered")) returned 1 [0127.223] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\0JVrvQ8.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\0jvrvq8.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\0JVrvQ8.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\0jvrvq8.gif.enciphered")) returned 1 [0127.227] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\0XvpJ7N.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\0xvpj7n.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\0XvpJ7N.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\0xvpj7n.mp3.enciphered")) returned 1 [0127.231] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1X4O.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1x4o.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1X4O.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1x4o.flv.enciphered")) returned 1 [0127.236] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\75R194n5XzH7.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\75r194n5xzh7.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\75R194n5XzH7.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\75r194n5xzh7.mp3.enciphered")) returned 1 [0127.239] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\7LK0VtrCogD9tZQRp.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\7lk0vtrcogd9tzqrp.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\7LK0VtrCogD9tZQRp.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\7lk0vtrcogd9tzqrp.gif.enciphered")) returned 1 [0127.241] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\a5Zn72eHA-7.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\a5zn72eha-7.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\a5Zn72eHA-7.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\a5zn72eha-7.wav.enciphered")) returned 1 [0127.245] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ATtljMDjNANr.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\attljmdjnanr.avi"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ATtljMDjNANr.avi.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\attljmdjnanr.avi.enciphered")) returned 1 [0127.248] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\aXZnQ5bs.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\axznq5bs.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\aXZnQ5bs.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\axznq5bs.jpg.enciphered")) returned 1 [0127.250] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BCC0_q.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\bcc0_q.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\BCC0_q.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\bcc0_q.png.enciphered")) returned 1 [0127.254] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\bz3H4JBNnkxEC2.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\bz3h4jbnnkxec2.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\bz3H4JBNnkxEC2.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\bz3h4jbnnkxec2.flv.enciphered")) returned 1 [0127.256] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\dCBBjO7-I.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\dcbbjo7-i.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\dCBBjO7-I.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\dcbbjo7-i.mp3.enciphered")) returned 1 [0127.260] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\DfDzZV_B9.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\dfdzzv_b9.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\DfDzZV_B9.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\dfdzzv_b9.mp3.enciphered")) returned 1 [0127.262] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\fKOEXEvGGW.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\fkoexevggw.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\fKOEXEvGGW.mp4.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\fkoexevggw.mp4.enciphered")) returned 1 [0127.264] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ib83YH4g o.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ib83yh4g o.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Ib83YH4g o.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ib83yh4g o.png.enciphered")) returned 1 [0127.266] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\JT4R7fjqr.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\jt4r7fjqr.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\JT4R7fjqr.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\jt4r7fjqr.flv.enciphered")) returned 1 [0127.268] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\lbIt9fM.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\lbit9fm.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\lbIt9fM.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\lbit9fm.jpg.enciphered")) returned 1 [0127.271] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\lFqj5bmTfO.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\lfqj5bmtfo.avi"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\lFqj5bmTfO.avi.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\lfqj5bmtfo.avi.enciphered")) returned 1 [0127.273] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\lUB_JM9.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\lub_jm9.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\lUB_JM9.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\lub_jm9.mkv.enciphered")) returned 1 [0127.277] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\o-EZ B4c.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\o-ez b4c.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\o-EZ B4c.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\o-ez b4c.mp3.enciphered")) returned 1 [0127.280] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ODxT9e5.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\odxt9e5.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ODxT9e5.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\odxt9e5.flv.enciphered")) returned 1 [0127.282] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\q7FtTwkW3QtzCUds_h.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\q7fttwkw3qtzcuds_h.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\q7FtTwkW3QtzCUds_h.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\q7fttwkw3qtzcuds_h.mkv.enciphered")) returned 1 [0127.285] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\QgSlqyX3 rsD6n1-Wahl.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\qgslqyx3 rsd6n1-wahl.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\QgSlqyX3 rsD6n1-Wahl.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\qgslqyx3 rsd6n1-wahl.png.enciphered")) returned 1 [0127.289] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\s5T1Cy8KGRf8d.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\s5t1cy8kgrf8d.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\s5T1Cy8KGRf8d.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\s5t1cy8kgrf8d.gif.enciphered")) returned 1 [0127.292] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\t1_MdCDiLa.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\t1_mdcdila.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\t1_MdCDiLa.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\t1_mdcdila.mkv.enciphered")) returned 1 [0127.294] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\tvdLk txPkevgCKU3h3X.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\tvdlk txpkevgcku3h3x.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\tvdLk txPkevgCKU3h3X.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\tvdlk txpkevgcku3h3x.bmp.enciphered")) returned 1 [0127.297] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\uRcD i-A2zz1Rya.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\urcd i-a2zz1rya.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\uRcD i-A2zz1Rya.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\urcd i-a2zz1rya.flv.enciphered")) returned 1 [0127.300] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\uy4Z1W1KT3BXBexa.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\uy4z1w1kt3bxbexa.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\uy4Z1W1KT3BXBexa.xlsx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\uy4z1w1kt3bxbexa.xlsx.enciphered")) returned 1 [0127.302] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yOiOZGI49lcBm.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\yoiozgi49lcbm.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\yOiOZGI49lcBm.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\yoiozgi49lcbm.jpg.enciphered")) returned 1 [0127.304] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZdPV4O_RmQY1-ll.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zdpv4o_rmqy1-ll.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\ZdPV4O_RmQY1-ll.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zdpv4o_rmqy1-ll.mkv.enciphered")) returned 1 [0127.335] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\-rw-wpI4PW.pdf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\-rw-wpi4pw.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\-rw-wpI4PW.pdf.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\-rw-wpi4pw.pdf.enciphered")) returned 1 [0127.339] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0ol_.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0ol_.avi"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0ol_.avi.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0ol_.avi.enciphered")) returned 1 [0127.342] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\3kJMvR_ 9eNziYf7V.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\3kjmvr_ 9enziyf7v.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\3kJMvR_ 9eNziYf7V.pptx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\3kjmvr_ 9enziyf7v.pptx.enciphered")) returned 1 [0127.344] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\5wG4HsZeQoA2aY2erlk.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\5wg4hszeqoa2ay2erlk.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\5wG4HsZeQoA2aY2erlk.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\5wg4hszeqoa2ay2erlk.wav.enciphered")) returned 1 [0127.346] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\61I6wq1.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\61i6wq1.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\61I6wq1.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\61i6wq1.png.enciphered")) returned 1 [0127.348] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\6lclCgI5xiVmBH0gCYb.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\6lclcgi5xivmbh0gcyb.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\6lclCgI5xiVmBH0gCYb.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\6lclcgi5xivmbh0gcyb.wav.enciphered")) returned 1 [0127.351] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\82sxPHYQN.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\82sxphyqn.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\82sxPHYQN.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\82sxphyqn.mkv.enciphered")) returned 1 [0127.356] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\8BGkFH2gg8CSITlQbA.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\8bgkfh2gg8csitlqba.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\8BGkFH2gg8CSITlQbA.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\8bgkfh2gg8csitlqba.wav.enciphered")) returned 1 [0127.359] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\8vKabOX.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\8vkabox.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\8vKabOX.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\8vkabox.bmp.enciphered")) returned 1 [0127.380] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\bdFcqIl5WqLk9Xl.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bdfcqil5wqlk9xl.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\bdFcqIl5WqLk9Xl.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bdfcqil5wqlk9xl.jpg.enciphered")) returned 1 [0127.383] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\bJ7x0s6IdEPwjSn4w.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bj7x0s6idepwjsn4w.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\bJ7x0s6IdEPwjSn4w.xlsx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bj7x0s6idepwjsn4w.xlsx.enciphered")) returned 1 [0127.386] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\bMPGp6LD8yiL48FwS.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bmpgp6ld8yil48fws.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\bMPGp6LD8yiL48FwS.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bmpgp6ld8yil48fws.mp3.enciphered")) returned 1 [0127.389] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\bTffIEkl-riu.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\btffiekl-riu.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\bTffIEkl-riu.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\btffiekl-riu.flv.enciphered")) returned 1 [0127.391] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\dDUth4jf.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\dduth4jf.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\dDUth4jf.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\dduth4jf.mkv.enciphered")) returned 1 [0127.394] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\dzEmGBta.pdf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\dzemgbta.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\dzEmGBta.pdf.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\dzemgbta.pdf.enciphered")) returned 1 [0127.397] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fi2pmnlPhtufJg2i.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fi2pmnlphtufjg2i.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fi2pmnlPhtufJg2i.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fi2pmnlphtufjg2i.bmp.enciphered")) returned 1 [0127.399] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\grzKP1DxTYZYOe5.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\grzkp1dxtyzyoe5.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\grzKP1DxTYZYOe5.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\grzkp1dxtyzyoe5.wav.enciphered")) returned 1 [0127.403] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KfAoh7V5Dp6Z.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\kfaoh7v5dp6z.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KfAoh7V5Dp6Z.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\kfaoh7v5dp6z.wav.enciphered")) returned 1 [0127.405] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KRgP.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\krgp.avi"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KRgP.avi.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\krgp.avi.enciphered")) returned 1 [0127.408] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\m71Q7DqQoWJUXONwkG.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\m71q7dqqowjuxonwkg.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\m71Q7DqQoWJUXONwkG.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\m71q7dqqowjuxonwkg.mp3.enciphered")) returned 1 [0127.442] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.enciphered")) returned 1 [0127.447] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk.enciphered")) returned 1 [0127.454] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.enciphered")) returned 1 [0127.457] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk.enciphered")) returned 1 [0127.459] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.enciphered")) returned 1 [0127.477] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\con2.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\con2.lnk.enciphered")) returned 1 [0127.481] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\database1.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\database1.lnk.enciphered")) returned 1 [0127.484] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\documents.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\documents.lnk.enciphered")) returned 1 [0127.487] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk.enciphered")) returned 1 [0127.490] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.enciphered")) returned 1 [0127.523] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\consolehost_history.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\consolehost_history.txt.enciphered")) returned 1 [0127.529] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-ALup8a.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-alup8a.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-ALup8a.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-alup8a.lnk.enciphered")) returned 1 [0127.532] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-HwM G7ck2oZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-hwm g7ck2oz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-HwM G7ck2oZ.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-hwm g7ck2oz.lnk.enciphered")) returned 1 [0127.534] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-KjuUGr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-kjuugr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-KjuUGr.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-kjuugr.lnk.enciphered")) returned 1 [0127.535] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0ol_.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0ol_.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0ol_.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0ol_.lnk.enciphered")) returned 1 [0127.536] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0P0The.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0p0the.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0P0The.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0p0the.lnk.enciphered")) returned 1 [0127.538] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\18kROR5q11cdb4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\18kror5q11cdb4.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\18kROR5q11cdb4.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\18kror5q11cdb4.lnk.enciphered")) returned 1 [0127.540] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1TYaZ6b_AHUkW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1tyaz6b_ahukw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1TYaZ6b_AHUkW.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1tyaz6b_ahukw.lnk.enciphered")) returned 1 [0127.542] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\24WZ aKxnI.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\24wz akxni.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\24WZ aKxnI.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\24wz akxni.lnk.enciphered")) returned 1 [0127.543] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A54LTf33o0W.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2a54ltf33o0w.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A54LTf33o0W.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2a54ltf33o0w.lnk.enciphered")) returned 1 [0127.545] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2oHa-IM5JSDVaM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2oha-im5jsdvam.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2oHa-IM5JSDVaM.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2oha-im5jsdvam.lnk.enciphered")) returned 1 [0127.547] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2SRRoXrhKsPD9i.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2srroxrhkspd9i.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2SRRoXrhKsPD9i.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2srroxrhkspd9i.lnk.enciphered")) returned 1 [0127.549] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2sxE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2sxe.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2sxE.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2sxe.lnk.enciphered")) returned 1 [0127.550] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2WM TSnIl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2wm tsnil.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2WM TSnIl.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2wm tsnil.lnk.enciphered")) returned 1 [0127.570] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3IQm1FHslaSYVBne1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\3iqm1fhslasyvbne1.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3IQm1FHslaSYVBne1.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\3iqm1fhslasyvbne1.lnk.enciphered")) returned 1 [0127.591] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3kJMvR_ 9eNziYf7V.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\3kjmvr_ 9enziyf7v.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3kJMvR_ 9eNziYf7V.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\3kjmvr_ 9enziyf7v.lnk.enciphered")) returned 1 [0127.594] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4CZw51.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4czw51.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4CZw51.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4czw51.lnk.enciphered")) returned 1 [0127.596] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4fu60qvQEUL5NDw.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4fu60qvqeul5ndw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4fu60qvQEUL5NDw.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4fu60qvqeul5ndw.lnk.enciphered")) returned 1 [0127.598] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5OP147JtpMFtJgxy5yY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5op147jtpmftjgxy5yy.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5OP147JtpMFtJgxy5yY.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5op147jtpmftjgxy5yy.lnk.enciphered")) returned 1 [0127.600] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5SsgfJej.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5ssgfjej.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5SsgfJej.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5ssgfjej.lnk.enciphered")) returned 1 [0127.602] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\61I6wq1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\61i6wq1.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\61I6wq1.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\61i6wq1.lnk.enciphered")) returned 1 [0127.608] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\636Csmf5s.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\636csmf5s.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\636Csmf5s.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\636csmf5s.lnk.enciphered")) returned 1 [0127.609] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6D8WmkqQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6d8wmkqq.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6D8WmkqQ.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6d8wmkqq.lnk.enciphered")) returned 1 [0127.611] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6dGUK281b_6 jxiA_ZaR.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6dguk281b_6 jxia_zar.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6dGUK281b_6 jxiA_ZaR.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6dguk281b_6 jxia_zar.lnk.enciphered")) returned 1 [0127.612] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6DUdtC3BQI.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6dudtc3bqi.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6DUdtC3BQI.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6dudtc3bqi.lnk.enciphered")) returned 1 [0127.621] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6lclCgI5xiVmBH0gCYb.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6lclcgi5xivmbh0gcyb.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6lclCgI5xiVmBH0gCYb.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6lclcgi5xivmbh0gcyb.lnk.enciphered")) returned 1 [0127.623] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6_8jP2ix4JNJwrFz83BI.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6_8jp2ix4jnjwrfz83bi.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6_8jP2ix4JNJwrFz83BI.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6_8jp2ix4jnjwrfz83bi.lnk.enciphered")) returned 1 [0127.625] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\78YKVYd.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\78ykvyd.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\78YKVYd.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\78ykvyd.lnk.enciphered")) returned 1 [0127.627] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7fFAWqFLX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7ffawqflx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7fFAWqFLX.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7ffawqflx.lnk.enciphered")) returned 1 [0127.628] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7LvJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7lvj.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7LvJ.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7lvj.lnk.enciphered")) returned 1 [0127.630] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7pP14n90glYM7mu04B.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7pp14n90glym7mu04b.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7pP14n90glYM7mu04B.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7pp14n90glym7mu04b.lnk.enciphered")) returned 1 [0127.633] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\82sxPHYQN.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\82sxphyqn.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\82sxPHYQN.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\82sxphyqn.lnk.enciphered")) returned 1 [0127.635] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8dmABAPOHzw4f-qwzb.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8dmabapohzw4f-qwzb.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8dmABAPOHzw4f-qwzb.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8dmabapohzw4f-qwzb.lnk.enciphered")) returned 1 [0127.638] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8gWIZx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8gwizx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8gWIZx.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8gwizx.lnk.enciphered")) returned 1 [0127.640] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8tWvIo.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8twvio.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8tWvIo.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8twvio.lnk.enciphered")) returned 1 [0127.642] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8vKabOX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8vkabox.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8vKabOX.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8vkabox.lnk.enciphered")) returned 1 [0127.643] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9CpPHE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9cpphe.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9CpPHE.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9cpphe.lnk.enciphered")) returned 1 [0127.645] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A2g_ 2FlHMa5aL-dO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\a2g_ 2flhma5al-do.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A2g_ 2FlHMa5aL-dO.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\a2g_ 2flhma5al-do.lnk.enciphered")) returned 1 [0127.646] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aDFPIGsftmm4q.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\adfpigsftmm4q.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aDFPIGsftmm4q.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\adfpigsftmm4q.lnk.enciphered")) returned 1 [0127.648] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aP5zV7Vnr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ap5zv7vnr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aP5zV7Vnr.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ap5zv7vnr.lnk.enciphered")) returned 1 [0127.651] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQ7efC4Oy13DAcIP-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aq7efc4oy13dacip-.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQ7efC4Oy13DAcIP-.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aq7efc4oy13dacip-.lnk.enciphered")) returned 1 [0127.652] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Arzd848c.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\arzd848c.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Arzd848c.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\arzd848c.lnk.enciphered")) returned 1 [0127.660] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ay7vkQ_gxGuJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ay7vkq_gxguj.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ay7vkQ_gxGuJ.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ay7vkq_gxguj.lnk.enciphered")) returned 1 [0127.662] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B5Of2YYzjWXhMKYJx9Ho.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b5of2yyzjwxhmkyjx9ho.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B5Of2YYzjWXhMKYJx9Ho.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b5of2yyzjwxhmkyjx9ho.lnk.enciphered")) returned 1 [0127.663] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bJ7x0s6IdEPwjSn4w.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bj7x0s6idepwjsn4w.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bJ7x0s6IdEPwjSn4w.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bj7x0s6idepwjsn4w.lnk.enciphered")) returned 1 [0127.667] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bMPGp6LD8yiL48FwS.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bmpgp6ld8yil48fws.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bMPGp6LD8yiL48FwS.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bmpgp6ld8yil48fws.lnk.enciphered")) returned 1 [0127.668] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bTffIEkl-riu.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\btffiekl-riu.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bTffIEkl-riu.flv.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\btffiekl-riu.flv.lnk.enciphered")) returned 1 [0127.670] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c2wRZXisa03.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\c2wrzxisa03.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c2wRZXisa03.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\c2wrzxisa03.lnk.enciphered")) returned 1 [0127.671] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDp zjoDcqQW-QlrhtG.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cdp zjodcqqw-qlrhtg.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDp zjoDcqQW-QlrhtG.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cdp zjodcqqw-qlrhtg.lnk.enciphered")) returned 1 [0127.672] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cemoYF0m9bgq8ADA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cemoyf0m9bgq8ada.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cemoYF0m9bgq8ADA.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cemoyf0m9bgq8ada.lnk.enciphered")) returned 1 [0127.674] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cQYeXic-HeNeVAv5.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cqyexic-henevav5.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cQYeXic-HeNeVAv5.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cqyexic-henevav5.lnk.enciphered")) returned 1 [0127.679] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CTwMAb6 (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ctwmab6 (2).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CTwMAb6 (2).lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ctwmab6 (2).lnk.enciphered")) returned 1 [0127.681] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CTwMAb6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ctwmab6.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CTwMAb6.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ctwmab6.lnk.enciphered")) returned 1 [0127.683] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CtygEcs.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ctygecs.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CtygEcs.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ctygecs.lnk.enciphered")) returned 1 [0127.688] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D6Xoz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\d6xoz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D6Xoz.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\d6xoz.lnk.enciphered")) returned 1 [0127.690] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dDUth4jf.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dduth4jf.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dDUth4jf.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dduth4jf.lnk.enciphered")) returned 1 [0127.691] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DjCor95SBU.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\djcor95sbu.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DjCor95SBU.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\djcor95sbu.lnk.enciphered")) returned 1 [0127.693] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DlQfohSG0T3EIPns.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dlqfohsg0t3eipns.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DlQfohSG0T3EIPns.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dlqfohsg0t3eipns.lnk.enciphered")) returned 1 [0127.696] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dzEmGBta.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dzemgbta.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dzEmGBta.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dzemgbta.lnk.enciphered")) returned 1 [0127.697] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EeA5wnlpj4dY2.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eea5wnlpj4dy2.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EeA5wnlpj4dY2.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eea5wnlpj4dy2.lnk.enciphered")) returned 1 [0127.699] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EK-srFlceA8iCpd.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ek-srflcea8icpd.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EK-srFlceA8iCpd.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ek-srflcea8icpd.lnk.enciphered")) returned 1 [0127.701] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ekHVgf9UMb9gThmP5.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ekhvgf9umb9gthmp5.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ekHVgf9UMb9gThmP5.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ekhvgf9umb9gthmp5.lnk.enciphered")) returned 1 [0127.702] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evJVrWHI.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\evjvrwhi.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evJVrWHI.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\evjvrwhi.lnk.enciphered")) returned 1 [0127.704] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fi2pmnlPhtufJg2i.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fi2pmnlphtufjg2i.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fi2pmnlPhtufJg2i.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fi2pmnlphtufjg2i.lnk.enciphered")) returned 1 [0127.705] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fmXbB6nI5B9W6Cx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fmxbb6ni5b9w6cx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fmXbB6nI5B9W6Cx.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fmxbb6ni5b9w6cx.lnk.enciphered")) returned 1 [0127.707] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GaXAtBM.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gaxatbm.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GaXAtBM.flv.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gaxatbm.flv.lnk.enciphered")) returned 1 [0127.708] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gdyJuGgAVPQLEWfD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gdyjuggavpqlewfd.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gdyJuGgAVPQLEWfD.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gdyjuggavpqlewfd.lnk.enciphered")) returned 1 [0127.709] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\grNNN7T9j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\grnnn7t9j.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\grNNN7T9j.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\grnnn7t9j.lnk.enciphered")) returned 1 [0127.711] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gSD4YYTJGjXD3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gsd4yytjgjxd3.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gSD4YYTJGjXD3.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gsd4yytjgjxd3.lnk.enciphered")) returned 1 [0127.713] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gUpJwWkaQZOoFMab.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gupjwwkaqzoofmab.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gUpJwWkaQZOoFMab.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gupjwwkaqzoofmab.lnk.enciphered")) returned 1 [0127.715] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hFU0HF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hfu0hf.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hFU0HF.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hfu0hf.lnk.enciphered")) returned 1 [0127.717] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHcXdbKYOc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hhcxdbkyoc.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHcXdbKYOc.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hhcxdbkyoc.lnk.enciphered")) returned 1 [0127.719] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hSG6ua6f07EEqB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hsg6ua6f07eeqb.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hSG6ua6f07EEqB.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hsg6ua6f07eeqb.lnk.enciphered")) returned 1 [0127.721] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HvR5Zu-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hvr5zu-.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HvR5Zu-.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hvr5zu-.lnk.enciphered")) returned 1 [0127.723] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1_RD-sxstLx90WrxK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i1_rd-sxstlx90wrxk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1_RD-sxstLx90WrxK.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i1_rd-sxstlx90wrxk.lnk.enciphered")) returned 1 [0127.725] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IbikfxWUJud3zTTX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ibikfxwujud3zttx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IbikfxWUJud3zTTX.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ibikfxwujud3zttx.lnk.enciphered")) returned 1 [0127.726] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\id7sg3YOm9jRCHOq8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\id7sg3yom9jrchoq8.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\id7sg3YOm9jRCHOq8.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\id7sg3yom9jrchoq8.lnk.enciphered")) returned 1 [0127.728] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ISrMV3LY8uL4w_TAzG3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\isrmv3ly8ul4w_tazg3.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ISrMV3LY8uL4w_TAzG3.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\isrmv3ly8ul4w_tazg3.lnk.enciphered")) returned 1 [0127.729] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jcNT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jcnt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jcNT.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jcnt.lnk.enciphered")) returned 1 [0127.731] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jfNiRy6AUz lirEuD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jfniry6auz lireud.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jfNiRy6AUz lirEuD.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jfniry6auz lireud.lnk.enciphered")) returned 1 [0127.732] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jjb_Y_lFR.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jjb_y_lfr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jjb_Y_lFR.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jjb_y_lfr.lnk.enciphered")) returned 1 [0127.733] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jQoMEt- N.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jqomet- n.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jQoMEt- N.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jqomet- n.lnk.enciphered")) returned 1 [0127.735] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kk4N4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kk4n4.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kk4N4.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kk4n4.lnk.enciphered")) returned 1 [0127.736] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KMeCxKKoD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kmecxkkod.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KMeCxKKoD.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kmecxkkod.lnk.enciphered")) returned 1 [0127.738] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kmu3 vwKv8IQpIB3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kmu3 vwkv8iqpib3.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kmu3 vwKv8IQpIB3.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kmu3 vwkv8iqpib3.lnk.enciphered")) returned 1 [0127.741] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KMxtk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kmxtk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KMxtk.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kmxtk.lnk.enciphered")) returned 1 [0127.743] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kr6TM2CdpNTHB.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kr6tm2cdpnthb.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kr6TM2CdpNTHB.flv.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kr6tm2cdpnthb.flv.lnk.enciphered")) returned 1 [0127.746] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KRgP.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\krgp.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KRgP.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\krgp.lnk.enciphered")) returned 1 [0127.751] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kyF96Q0CjmtY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kyf96q0cjmty.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kyF96Q0CjmtY.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kyf96q0cjmty.lnk.enciphered")) returned 1 [0127.754] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1Fym.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l1fym.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1Fym.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l1fym.lnk.enciphered")) returned 1 [0127.755] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l4sTV-WQ7E-IvrJfbmC_.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l4stv-wq7e-ivrjfbmc_.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l4sTV-WQ7E-IvrJfbmC_.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l4stv-wq7e-ivrjfbmc_.lnk.enciphered")) returned 1 [0127.757] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LJ1UB0hFCUImwaIcqO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lj1ub0hfcuimwaicqo.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LJ1UB0hFCUImwaIcqO.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lj1ub0hfcuimwaicqo.lnk.enciphered")) returned 1 [0127.759] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M2SzmlC.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m2szmlc.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M2SzmlC.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m2szmlc.lnk.enciphered")) returned 1 [0127.761] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MDDCQYQIOtSHh1kRv.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mddcqyqiotshh1krv.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MDDCQYQIOtSHh1kRv.flv.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mddcqyqiotshh1krv.flv.lnk.enciphered")) returned 1 [0127.763] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MqWHN.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mqwhn.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MqWHN.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mqwhn.lnk.enciphered")) returned 1 [0127.764] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk.enciphered")) returned 1 [0127.766] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxH0dcXU3iNS v.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mxh0dcxu3ins v.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxH0dcXU3iNS v.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mxh0dcxu3ins v.lnk.enciphered")) returned 1 [0127.768] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mXmnIDhWq3qC8bRnt (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mxmnidhwq3qc8brnt (2).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mXmnIDhWq3qC8bRnt (2).lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mxmnidhwq3qc8brnt (2).lnk.enciphered")) returned 1 [0127.770] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mXmnIDhWq3qC8bRnt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mxmnidhwq3qc8brnt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mXmnIDhWq3qC8bRnt.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mxmnidhwq3qc8brnt.lnk.enciphered")) returned 1 [0127.772] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nPVHyn_GaDfCKr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\npvhyn_gadfckr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nPVHyn_GaDfCKr.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\npvhyn_gadfckr.lnk.enciphered")) returned 1 [0127.773] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nxs22CqHfFIR1k2c1i.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nxs22cqhffir1k2c1i.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nxs22CqHfFIR1k2c1i.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nxs22cqhffir1k2c1i.lnk.enciphered")) returned 1 [0127.776] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oawjQhUk (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oawjqhuk (2).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oawjQhUk (2).lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oawjqhuk (2).lnk.enciphered")) returned 1 [0127.779] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oawjQhUk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oawjqhuk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oawjQhUk.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oawjqhuk.lnk.enciphered")) returned 1 [0127.780] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OCLB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oclb.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OCLB.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oclb.lnk.enciphered")) returned 1 [0127.782] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ojT1WViopbTWmQMB6YD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ojt1wviopbtwmqmb6yd.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ojT1WViopbTWmQMB6YD.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ojt1wviopbtwmqmb6yd.lnk.enciphered")) returned 1 [0127.789] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P0LvCZHlxgEFLw60.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\p0lvczhlxgeflw60.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P0LvCZHlxgEFLw60.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\p0lvczhlxgeflw60.lnk.enciphered")) returned 1 [0127.792] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PhI2XjkNnTdDKjt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\phi2xjknntddkjt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PhI2XjkNnTdDKjt.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\phi2xjknntddkjt.lnk.enciphered")) returned 1 [0127.794] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk.enciphered")) returned 1 [0127.795] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pj ciaI96 _k.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pj ciai96 _k.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pj ciaI96 _k.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pj ciai96 _k.lnk.enciphered")) returned 1 [0127.797] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pJ3 E6HMMcu ttxy.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pj3 e6hmmcu ttxy.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pJ3 E6HMMcu ttxy.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pj3 e6hmmcu ttxy.lnk.enciphered")) returned 1 [0127.799] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppFyZ2GyV7zXiZ00otx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ppfyz2gyv7zxiz00otx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppFyZ2GyV7zXiZ00otx.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ppfyz2gyv7zxiz00otx.lnk.enciphered")) returned 1 [0127.801] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pxirr0c.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pxirr0c.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pxirr0c.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pxirr0c.lnk.enciphered")) returned 1 [0127.811] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q8dZMbJhVnmMe_VULhL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q8dzmbjhvnmme_vulhl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q8dZMbJhVnmMe_VULhL.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q8dzmbjhvnmme_vulhl.lnk.enciphered")) returned 1 [0127.813] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qf4EAXyLXe-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qf4eaxylxe-.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qf4EAXyLXe-.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qf4eaxylxe-.lnk.enciphered")) returned 1 [0127.814] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qGK 4wwReVayU7Hbu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qgk 4wwrevayu7hbu.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qGK 4wwReVayU7Hbu.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qgk 4wwrevayu7hbu.lnk.enciphered")) returned 1 [0127.817] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qMuBuwKIVZ_pyBXk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qmubuwkivz_pybxk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qMuBuwKIVZ_pyBXk.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qmubuwkivz_pybxk.lnk.enciphered")) returned 1 [0127.820] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QwtcQkIqlpLS_.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qwtcqkiqlpls_.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QwtcQkIqlpLS_.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qwtcqkiqlpls_.lnk.enciphered")) returned 1 [0127.822] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qx4SV9z6bXic-xBEI.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qx4sv9z6bxic-xbei.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qx4SV9z6bXic-xBEI.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qx4sv9z6bxic-xbei.lnk.enciphered")) returned 1 [0127.824] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r8lyHeaYh9N6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r8lyheayh9n6.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r8lyHeaYh9N6.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r8lyheayh9n6.lnk.enciphered")) returned 1 [0127.825] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.enciphered")) returned 1 [0127.827] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rqcr7VcvQ3pYQ9.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rqcr7vcvq3pyq9.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rqcr7VcvQ3pYQ9.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rqcr7vcvq3pyq9.lnk.enciphered")) returned 1 [0127.828] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RVJ1_MS6Fugs8LqNoKcp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rvj1_ms6fugs8lqnokcp.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RVJ1_MS6Fugs8LqNoKcp.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rvj1_ms6fugs8lqnokcp.lnk.enciphered")) returned 1 [0127.830] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SCwXp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\scwxp.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SCwXp.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\scwxp.lnk.enciphered")) returned 1 [0127.831] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SL0dt6gk8up.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sl0dt6gk8up.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SL0dt6gk8up.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sl0dt6gk8up.lnk.enciphered")) returned 1 [0127.833] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\StRe1Uk9.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\stre1uk9.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\StRe1Uk9.flv.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\stre1uk9.flv.lnk.enciphered")) returned 1 [0127.838] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tyWpFVtCeaJR3QT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tywpfvtceajr3qt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tyWpFVtCeaJR3QT.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tywpfvtceajr3qt.lnk.enciphered")) returned 1 [0127.839] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tzE9zv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tze9zv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tzE9zv.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tze9zv.lnk.enciphered")) returned 1 [0127.841] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U1NK7L5X3d06hoCi_N_.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u1nk7l5x3d06hoci_n_.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U1NK7L5X3d06hoCi_N_.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u1nk7l5x3d06hoci_n_.lnk.enciphered")) returned 1 [0127.843] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u8JH-O-UH1IwUaB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u8jh-o-uh1iwuab.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u8JH-O-UH1IwUaB.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u8jh-o-uh1iwuab.lnk.enciphered")) returned 1 [0127.845] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uDIJO3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\udijo3.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uDIJO3.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\udijo3.lnk.enciphered")) returned 1 [0127.847] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uIwE19bL_jeAFMi2glM.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uiwe19bl_jeafmi2glm.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uIwE19bL_jeAFMi2glM.flv.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uiwe19bl_jeafmi2glm.flv.lnk.enciphered")) returned 1 [0127.848] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UMUJlM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\umujlm.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UMUJlM.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\umujlm.lnk.enciphered")) returned 1 [0127.850] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UUSF1ZGE (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uusf1zge (2).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UUSF1ZGE (2).lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uusf1zge (2).lnk.enciphered")) returned 1 [0127.858] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UUSF1ZGE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uusf1zge.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UUSF1ZGE.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uusf1zge.lnk.enciphered")) returned 1 [0127.860] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UxBGyvRf9j4pi_.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uxbgyvrf9j4pi_.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UxBGyvRf9j4pi_.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uxbgyvrf9j4pi_.lnk.enciphered")) returned 1 [0127.862] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uy-3ekPEV_TOAWtf.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uy-3ekpev_toawtf.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Uy-3ekPEV_TOAWtf.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uy-3ekpev_toawtf.lnk.enciphered")) returned 1 [0127.864] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V2VMlO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v2vmlo.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V2VMlO.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v2vmlo.lnk.enciphered")) returned 1 [0127.866] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VaDE053.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vade053.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VaDE053.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vade053.lnk.enciphered")) returned 1 [0127.867] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk.enciphered")) returned 1 [0127.869] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VIfy2VoE5QSRYxKSc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vify2voe5qsryxksc.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VIfy2VoE5QSRYxKSc.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vify2voe5qsryxksc.lnk.enciphered")) returned 1 [0127.870] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vTtCmK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vttcmk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vTtCmK.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vttcmk.lnk.enciphered")) returned 1 [0127.872] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vzVEGxpLPeY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vzvegxplpey.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vzVEGxpLPeY.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vzvegxplpey.lnk.enciphered")) returned 1 [0127.874] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W-CLABjUW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w-clabjuw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W-CLABjUW.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w-clabjuw.lnk.enciphered")) returned 1 [0127.877] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W1gTfHzZlUzqwa.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w1gtfhzzluzqwa.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W1gTfHzZlUzqwa.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w1gtfhzzluzqwa.lnk.enciphered")) returned 1 [0127.878] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wkeiRm.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wkeirm.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wkeiRm.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wkeirm.lnk.enciphered")) returned 1 [0127.880] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wQAp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wqap.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wQAp.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wqap.lnk.enciphered")) returned 1 [0127.882] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wx-5YguAgjtUkDS-F9.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wx-5yguagjtukds-f9.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wx-5YguAgjtUkDS-F9.flv.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wx-5yguagjtukds-f9.flv.lnk.enciphered")) returned 1 [0127.922] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X2TZD-Z0SwQEWtAc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\x2tzd-z0swqewtac.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X2TZD-Z0SwQEWtAc.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\x2tzd-z0swqewtac.lnk.enciphered")) returned 1 [0127.924] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XWzgyQikeYa4Z0fK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xwzgyqikeya4z0fk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XWzgyQikeYa4Z0fK.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xwzgyqikeya4z0fk.lnk.enciphered")) returned 1 [0127.927] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBvxsrA-xBL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zbvxsra-xbl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBvxsrA-xBL.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zbvxsra-xbl.lnk.enciphered")) returned 1 [0127.929] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zdnW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zdnw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zdnW.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zdnw.lnk.enciphered")) returned 1 [0127.937] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZhhWOoz0.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zhhwooz0.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZhhWOoz0.flv.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zhhwooz0.flv.lnk.enciphered")) returned 1 [0127.939] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_CypphmHOj5u0g6yL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_cypphmhoj5u0g6yl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_CypphmHOj5u0g6yL.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_cypphmhoj5u0g6yl.lnk.enciphered")) returned 1 [0127.941] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ER-4uSX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_er-4usx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ER-4uSX.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_er-4usx.lnk.enciphered")) returned 1 [0127.943] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_F qNJ-a.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_f qnj-a.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_F qNJ-a.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_f qnj-a.lnk.enciphered")) returned 1 [0127.944] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_QSVjZD-R.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_qsvjzd-r.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_QSVjZD-R.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_qsvjzd-r.lnk.enciphered")) returned 1 [0127.949] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\bluetooth file transfer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\bluetooth file transfer.lnk.enciphered")) returned 1 [0127.952] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.enciphered")) returned 1 [0127.960] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.enciphered")) returned 1 [0127.964] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.enciphered")) returned 1 [0127.971] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.enciphered")) returned 1 [0127.984] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk.enciphered")) returned 1 [0127.993] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.enciphered")) returned 1 [0128.002] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk.enciphered")) returned 1 [0128.008] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.enciphered")) returned 1 [0128.011] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.enciphered")) returned 1 [0128.013] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.enciphered")) returned 1 [0128.015] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.enciphered")) returned 1 [0128.017] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.enciphered")) returned 1 [0128.022] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk.enciphered")) returned 1 [0128.035] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.enciphered")) returned 1 [0128.047] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.enciphered")) returned 1 [0128.050] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.enciphered")) returned 1 [0128.053] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.enciphered")) returned 1 [0128.058] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg.enciphered")) returned 1 [0128.088] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\license.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\license.txt.enciphered")) returned 1 [0128.100] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sitesecurityservicestate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sitesecurityservicestate.txt.enciphered")) returned 1 [0128.240] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OCLB.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\oclb.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\OCLB.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\oclb.mp3.enciphered")) returned 1 [0128.244] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Otc.ppt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\otc.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Otc.ppt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\otc.ppt.enciphered")) returned 1 [0128.252] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vp5W7N6.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vp5w7n6.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vp5W7N6.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vp5w7n6.mkv.enciphered")) returned 1 [0128.255] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\x1PO8CRt9VJ r6OIFda.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\x1po8crt9vj r6oifda.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\x1PO8CRt9VJ r6OIFda.mp4.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\x1po8crt9vj r6oifda.mp4.enciphered")) returned 1 [0128.257] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XJ7c7xJ.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xj7c7xj.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\XJ7c7xJ.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xj7c7xj.gif.enciphered")) returned 1 [0128.264] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Zd29Hgt1i.xls" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zd29hgt1i.xls"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Zd29Hgt1i.xls.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zd29hgt1i.xls.enciphered")) returned 1 [0128.267] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\_CypphmHOj5u0g6yL.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_cypphmhoj5u0g6yl.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\_CypphmHOj5u0g6yL.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_cypphmhoj5u0g6yl.bmp.enciphered")) returned 1 [0128.270] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\_nFaJXEF7k_HwCfflc02.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_nfajxef7k_hwcfflc02.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\_nFaJXEF7k_HwCfflc02.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_nfajxef7k_hwcfflc02.mp3.enciphered")) returned 1 [0128.279] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\1.exe.lnk" (normalized: "c:\\users\\fd1hvy\\desktop\\1.exe.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\1.exe.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\1.exe.lnk.enciphered")) returned 1 [0128.285] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\aDFPIGsftmm4q.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\adfpigsftmm4q.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\aDFPIGsftmm4q.doc.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\adfpigsftmm4q.doc.enciphered")) returned 1 [0128.295] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Ay7vkQ_gxGuJ\\GaXAtBM.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\ay7vkq_gxguj\\gaxatbm.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Ay7vkQ_gxGuJ\\GaXAtBM.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\ay7vkq_gxguj\\gaxatbm.flv.enciphered")) returned 1 [0128.304] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Ay7vkQ_gxGuJ\\nHMc5MT8mD3S2 Q4THwk.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\ay7vkq_gxguj\\nhmc5mt8md3s2 q4thwk.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Ay7vkQ_gxGuJ\\nHMc5MT8mD3S2 Q4THwk.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\ay7vkq_gxguj\\nhmc5mt8md3s2 q4thwk.wav.enciphered")) returned 1 [0128.312] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\B5Of2YYzjWXhMKYJx9Ho.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\b5of2yyzjwxhmkyjx9ho.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\B5Of2YYzjWXhMKYJx9Ho.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\b5of2yyzjwxhmkyjx9ho.mp3.enciphered")) returned 1 [0128.321] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\c2wRZXisa03.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\c2wrzxisa03.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\c2wRZXisa03.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\c2wrzxisa03.wav.enciphered")) returned 1 [0128.326] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cemoYF0m9bgq8ADA.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\cemoyf0m9bgq8ada.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\cemoYF0m9bgq8ADA.odt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\cemoyf0m9bgq8ada.odt.enciphered")) returned 1 [0128.331] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\I1_RD-sxstLx90WrxK.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\i1_rd-sxstlx90wrxk.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\I1_RD-sxstLx90WrxK.pdf.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\i1_rd-sxstlx90wrxk.pdf.enciphered")) returned 1 [0128.336] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Jjb_Y_lFR.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\jjb_y_lfr.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Jjb_Y_lFR.docx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\jjb_y_lfr.docx.enciphered")) returned 1 [0128.344] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\jQoMEt- N.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\jqomet- n.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\jQoMEt- N.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\jqomet- n.wav.enciphered")) returned 1 [0128.357] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\KMeCxKKoD\\1TYaZ6b_AHUkW.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\kmecxkkod\\1tyaz6b_ahukw.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\KMeCxKKoD\\1TYaZ6b_AHUkW.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\kmecxkkod\\1tyaz6b_ahukw.mkv.enciphered")) returned 1 [0128.362] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\KMeCxKKoD\\tGaJRBP3U_1.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\kmecxkkod\\tgajrbp3u_1.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\KMeCxKKoD\\tGaJRBP3U_1.doc.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\kmecxkkod\\tgajrbp3u_1.doc.enciphered")) returned 1 [0128.371] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\KMeCxKKoD\\xhHJ VKQ.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\kmecxkkod\\xhhj vkq.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\KMeCxKKoD\\xhHJ VKQ.mp4.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\kmecxkkod\\xhhj vkq.mp4.enciphered")) returned 1 [0128.376] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\mNODcusOqP-xP16O.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\mnodcusoqp-xp16o.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\mNODcusOqP-xP16O.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\mnodcusoqp-xp16o.mkv.enciphered")) returned 1 [0128.380] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ppFyZ2GyV7zXiZ00otx.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\ppfyz2gyv7zxiz00otx.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ppFyZ2GyV7zXiZ00otx.doc.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\ppfyz2gyv7zxiz00otx.doc.enciphered")) returned 1 [0128.385] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\qGK 4wwReVayU7Hbu.png" (normalized: "c:\\users\\fd1hvy\\desktop\\qgk 4wwrevayu7hbu.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\qGK 4wwReVayU7Hbu.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\qgk 4wwrevayu7hbu.png.enciphered")) returned 1 [0128.392] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\2A54LTf33o0W.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\2a54ltf33o0w.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\2A54LTf33o0W.avi.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\2a54ltf33o0w.avi.enciphered")) returned 1 [0128.437] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\8dmABAPOHzw4f-qwzb.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\8dmabapohzw4f-qwzb.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\8dmABAPOHzw4f-qwzb.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\8dmabapohzw4f-qwzb.wav.enciphered")) returned 1 [0128.441] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\hHcXdbKYOc.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\hhcxdbkyoc.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\hHcXdbKYOc.avi.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\hhcxdbkyoc.avi.enciphered")) returned 1 [0128.443] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\pkSWbLxbvCyrRI.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\pkswblxbvcyrri.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\pkSWbLxbvCyrRI.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\pkswblxbvcyrri.mp3.enciphered")) returned 1 [0128.446] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\Pxirr0c.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\pxirr0c.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\Pxirr0c.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\pxirr0c.bmp.enciphered")) returned 1 [0128.449] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\r8lyHeaYh9N6.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\r8lyheayh9n6.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\r8lyHeaYh9N6.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\r8lyheayh9n6.wav.enciphered")) returned 1 [0128.451] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\Y4Oelw M7iumFWRY.png" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\y4oelw m7iumfwry.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\ISrMV3LY8uL4w_TAzG3\\Y4Oelw M7iumFWRY.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\isrmv3ly8ul4w_tazg3\\y4oelw m7iumfwry.png.enciphered")) returned 1 [0128.453] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\LV-19O4JLV7WnoBCiVY2.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\lv-19o4jlv7wnobcivy2.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\LV-19O4JLV7WnoBCiVY2.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\lv-19o4jlv7wnobcivy2.mp3.enciphered")) returned 1 [0128.456] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\uIwE19bL_jeAFMi2glM.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\uiwe19bl_jeafmi2glm.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\uIwE19bL_jeAFMi2glM.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\uiwe19bl_jeafmi2glm.flv.enciphered")) returned 1 [0128.459] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\zkp-M3RKQQOnCoZ.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\zkp-m3rkqqoncoz.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QwtcQkIqlpLS_\\zkp-M3RKQQOnCoZ.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\qwtcqkiqlpls_\\zkp-m3rkqqoncoz.mp3.enciphered")) returned 1 [0128.462] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\rgBLWfrLXzk oTg.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\rgblwfrlxzk otg.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\rgBLWfrLXzk oTg.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\rgblwfrlxzk otg.wav.enciphered")) returned 1 [0128.501] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\rXxfWAIRa33LDEB1.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\rxxfwaira33ldeb1.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\rXxfWAIRa33LDEB1.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\rxxfwaira33ldeb1.wav.enciphered")) returned 1 [0128.503] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\S1qJhAo.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\s1qjhao.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\S1qJhAo.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\s1qjhao.jpg.enciphered")) returned 1 [0128.506] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\SL0dt6gk8up.png" (normalized: "c:\\users\\fd1hvy\\desktop\\sl0dt6gk8up.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\SL0dt6gk8up.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\sl0dt6gk8up.png.enciphered")) returned 1 [0128.508] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\StRe1Uk9.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\stre1uk9.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\StRe1Uk9.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\stre1uk9.flv.enciphered")) returned 1 [0128.512] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\W1gTfHzZlUzqwa.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\w1gtfhzzluzqwa.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\W1gTfHzZlUzqwa.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\w1gtfhzzluzqwa.mp3.enciphered")) returned 1 [0128.514] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\wLJ DI8O.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\wlj di8o.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\wLJ DI8O.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\wlj di8o.bmp.enciphered")) returned 1 [0128.516] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XWzgyQikeYa4Z0fK.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\xwzgyqikeya4z0fk.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XWzgyQikeYa4Z0fK.mp4.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\xwzgyqikeya4z0fk.mp4.enciphered")) returned 1 [0128.519] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ZBvxsrA-xBL.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\zbvxsra-xbl.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ZBvxsrA-xBL.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\desktop\\zbvxsra-xbl.gif.enciphered")) returned 1 [0128.522] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\1_pOiT.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\1_poit.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\1_pOiT.xlsx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\1_poit.xlsx.enciphered")) returned 1 [0128.525] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\6dGUK281b_6 jxiA_ZaR.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\6dguk281b_6 jxia_zar.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\6dGUK281b_6 jxiA_ZaR.xlsx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\6dguk281b_6 jxia_zar.xlsx.enciphered")) returned 1 [0128.527] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\kyF96Q0CjmtY.docx" (normalized: "c:\\users\\fd1hvy\\documents\\kyf96q0cjmty.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\kyF96Q0CjmtY.docx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\kyf96q0cjmty.docx.enciphered")) returned 1 [0128.529] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\LJ1UB0hFCUImwaIcqO.docx" (normalized: "c:\\users\\fd1hvy\\documents\\lj1ub0hfcuimwaicqo.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\LJ1UB0hFCUImwaIcqO.docx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\lj1ub0hfcuimwaicqo.docx.enciphered")) returned 1 [0128.531] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\LWK457CneEwWeqqb5v.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lwk457cneewweqqb5v.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\LWK457CneEwWeqqb5v.xlsx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\lwk457cneewweqqb5v.xlsx.enciphered")) returned 1 [0128.533] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\MqWHN.doc" (normalized: "c:\\users\\fd1hvy\\documents\\mqwhn.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\MqWHN.doc.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\mqwhn.doc.enciphered")) returned 1 [0128.688] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\P0CV8q1HzmlVhsttW.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\p0cv8q1hzmlvhsttw.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\P0CV8q1HzmlVhsttW.pptx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\p0cv8q1hzmlvhsttw.pptx.enciphered")) returned 1 [0128.693] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\pC68Cc.docx" (normalized: "c:\\users\\fd1hvy\\documents\\pc68cc.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\pC68Cc.docx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\pc68cc.docx.enciphered")) returned 1 [0128.697] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SCwXp.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\scwxp.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SCwXp.pptx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\scwxp.pptx.enciphered")) returned 1 [0128.701] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SVEp.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\svep.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SVEp.pptx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\svep.pptx.enciphered")) returned 1 [0128.704] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Uy-3ekPEV_TOAWtf.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\uy-3ekpev_toawtf.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Uy-3ekPEV_TOAWtf.xlsx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\uy-3ekpev_toawtf.xlsx.enciphered")) returned 1 [0128.707] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\V2VMlO.odt" (normalized: "c:\\users\\fd1hvy\\documents\\v2vmlo.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\V2VMlO.odt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\v2vmlo.odt.enciphered")) returned 1 [0128.710] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VIfy2VoE5QSRYxKSc.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vify2voe5qsryxksc.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VIfy2VoE5QSRYxKSc.docx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\vify2voe5qsryxksc.docx.enciphered")) returned 1 [0128.739] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\W-CLABjUW.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\w-clabjuw.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\W-CLABjUW.pptx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\w-clabjuw.pptx.enciphered")) returned 1 [0128.762] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\4fu60qvQEUL5NDw.odt" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\4fu60qvqeul5ndw.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\4fu60qvQEUL5NDw.odt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\4fu60qvqeul5ndw.odt.enciphered")) returned 1 [0128.771] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\9CpPHE.doc" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\9cpphe.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\9CpPHE.doc.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\9cpphe.doc.enciphered")) returned 1 [0128.777] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\-HwM G7ck2oZ\\gdyJuGgAVPQLEWfD\\D6Xoz.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\-hwm g7ck2oz\\gdyjuggavpqlewfd\\d6xoz.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\-HwM G7ck2oZ\\gdyJuGgAVPQLEWfD\\D6Xoz.pdf.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\-hwm g7ck2oz\\gdyjuggavpqlewfd\\d6xoz.pdf.enciphered")) returned 1 [0128.780] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\-HwM G7ck2oZ\\gdyJuGgAVPQLEWfD\\HSD4aQnRRJ4l.doc" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\-hwm g7ck2oz\\gdyjuggavpqlewfd\\hsd4aqnrrj4l.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\-HwM G7ck2oZ\\gdyJuGgAVPQLEWfD\\HSD4aQnRRJ4l.doc.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\-hwm g7ck2oz\\gdyjuggavpqlewfd\\hsd4aqnrrj4l.doc.enciphered")) returned 1 [0128.784] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\0uxIcLaAEVhWqpFn pKp.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\0uxiclaaevhwqpfn pkp.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\0uxIcLaAEVhWqpFn pKp.pptx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\0uxiclaaevhwqpfn pkp.pptx.enciphered")) returned 1 [0128.787] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\4CZw51.docx" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\4czw51.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\4CZw51.docx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\4czw51.docx.enciphered")) returned 1 [0128.792] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\Arzd848c\\2yeEUOVWIt10KU.xls" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\arzd848c\\2yeeuovwit10ku.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\Arzd848c\\2yeEUOVWIt10KU.xls.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\arzd848c\\2yeeuovwit10ku.xls.enciphered")) returned 1 [0128.795] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\Arzd848c\\cQYeXic-HeNeVAv5.xls" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\arzd848c\\cqyexic-henevav5.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\Arzd848c\\cQYeXic-HeNeVAv5.xls.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\arzd848c\\cqyexic-henevav5.xls.enciphered")) returned 1 [0128.829] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\Arzd848c\\CtygEcs\\jfNiRy6AUz lirEuD.doc" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\arzd848c\\ctygecs\\jfniry6auz lireud.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\Arzd848c\\CtygEcs\\jfNiRy6AUz lirEuD.doc.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\arzd848c\\ctygecs\\jfniry6auz lireud.doc.enciphered")) returned 1 [0128.833] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\Arzd848c\\HvR5Zu-.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\arzd848c\\hvr5zu-.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\Arzd848c\\HvR5Zu-.ppt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\arzd848c\\hvr5zu-.ppt.enciphered")) returned 1 [0128.835] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\Arzd848c\\J2-vLqzbGnO2bqre8c1.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\arzd848c\\j2-vlqzbgno2bqre8c1.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\Arzd848c\\J2-vLqzbGnO2bqre8c1.ppt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\arzd848c\\j2-vlqzbgno2bqre8c1.ppt.enciphered")) returned 1 [0128.838] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\Arzd848c\\Ksa9wZ-TILpJ7Ht.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\arzd848c\\ksa9wz-tilpj7ht.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\Arzd848c\\Ksa9wZ-TILpJ7Ht.pdf.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\arzd848c\\ksa9wz-tilpj7ht.pdf.enciphered")) returned 1 [0128.841] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\qf4EAXyLXe-.odt" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\qf4eaxylxe-.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\6DUdtC3BQI\\UMUJlM\\qf4EAXyLXe-.odt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\6dudtc3bqi\\umujlm\\qf4eaxylxe-.odt.enciphered")) returned 1 [0128.844] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\gDOeAOY1JhrWlcw9IWsV.doc" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\gdoeaoy1jhrwlcw9iwsv.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\gDOeAOY1JhrWlcw9IWsV.doc.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\gdoeaoy1jhrwlcw9iwsv.doc.enciphered")) returned 1 [0128.847] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\GssZLNn8tqCDXnEr_B.odt" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\gsszlnn8tqcdxner_b.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\GssZLNn8tqCDXnEr_B.odt.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\gsszlnn8tqcdxner_b.odt.enciphered")) returned 1 [0128.849] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\xjGhZDGl2 P.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\xjghzdgl2 p.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wQAp\\xjGhZDGl2 P.pdf.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\wqap\\xjghzdgl2 p.pdf.enciphered")) returned 1 [0128.851] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\yeKfepUGfF7T70Pm.docx" (normalized: "c:\\users\\fd1hvy\\documents\\yekfepugff7t70pm.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\yeKfepUGfF7T70Pm.docx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\yekfepugff7t70pm.docx.enciphered")) returned 1 [0128.854] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zH5Fmfj33NjexR30ibc.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\zh5fmfj33njexr30ibc.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zH5Fmfj33NjexR30ibc.pptx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\zh5fmfj33njexr30ibc.pptx.enciphered")) returned 1 [0128.856] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_F qNJ-a.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\_f qnj-a.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_F qNJ-a.xlsx.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\documents\\_f qnj-a.xlsx.enciphered")) returned 1 [0128.879] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk.enciphered")) returned 1 [0128.882] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk.enciphered")) returned 1 [0128.916] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk.enciphered")) returned 1 [0128.921] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\1gDmpZsXRJq4YrLvnY.wav" (normalized: "c:\\users\\fd1hvy\\music\\1gdmpzsxrjq4yrlvny.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\1gDmpZsXRJq4YrLvnY.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\1gdmpzsxrjq4yrlvny.wav.enciphered")) returned 1 [0128.925] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\2SRRoXrhKsPD9i.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\2srroxrhkspd9i.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\2SRRoXrhKsPD9i.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\2srroxrhkspd9i.mp3.enciphered")) returned 1 [0128.929] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\3 e-G.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\3 e-g.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\3 e-G.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\3 e-g.mp3.enciphered")) returned 1 [0128.932] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\78YKVYd.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\78ykvyd.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\78YKVYd.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\78ykvyd.mp3.enciphered")) returned 1 [0128.937] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\7pP14n90glYM7mu04B.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\7pp14n90glym7mu04b.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\7pP14n90glYM7mu04B.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\7pp14n90glym7mu04b.mp3.enciphered")) returned 1 [0128.940] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\KMxtk.wav" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\kmxtk.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\KMxtk.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\kmxtk.wav.enciphered")) returned 1 [0128.943] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\mxH0dcXU3iNS v.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\mxh0dcxu3ins v.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\mxH0dcXU3iNS v.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\mxh0dcxu3ins v.mp3.enciphered")) returned 1 [0128.945] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\VaDE053.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\vade053.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\VaDE053.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\vade053.mp3.enciphered")) returned 1 [0128.961] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\_dQV41_XvUU.wav" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\_dqv41_xvuu.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\6_8jP2ix4JNJwrFz83BI\\_dQV41_XvUU.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\6_8jp2ix4jnjwrfz83bi\\_dqv41_xvuu.wav.enciphered")) returned 1 [0128.965] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\Kmu3 vwKv8IQpIB3.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\kmu3 vwkv8iqpib3.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\Kmu3 vwKv8IQpIB3.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\kmu3 vwkv8iqpib3.mp3.enciphered")) returned 1 [0128.967] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\lc4YD9eunS-CfVgz.wav" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\lc4yd9euns-cfvgz.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\CTwMAb6\\lc4YD9eunS-CfVgz.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\ctwmab6\\lc4yd9euns-cfvgz.wav.enciphered")) returned 1 [0128.970] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\grNNN7T9j.mp3" (normalized: "c:\\users\\fd1hvy\\music\\grnnn7t9j.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\grNNN7T9j.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\grnnn7t9j.mp3.enciphered")) returned 1 [0128.973] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Qx4SV9z6bXic-xBEI\\6D8WmkqQ.wav" (normalized: "c:\\users\\fd1hvy\\music\\qx4sv9z6bxic-xbei\\6d8wmkqq.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Qx4SV9z6bXic-xBEI\\6D8WmkqQ.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\qx4sv9z6bxic-xbei\\6d8wmkqq.wav.enciphered")) returned 1 [0128.976] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Qx4SV9z6bXic-xBEI\\evJVrWHI.mp3" (normalized: "c:\\users\\fd1hvy\\music\\qx4sv9z6bxic-xbei\\evjvrwhi.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Qx4SV9z6bXic-xBEI\\evJVrWHI.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\qx4sv9z6bxic-xbei\\evjvrwhi.mp3.enciphered")) returned 1 [0128.979] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Qx4SV9z6bXic-xBEI\\PhI2XjkNnTdDKjt.mp3" (normalized: "c:\\users\\fd1hvy\\music\\qx4sv9z6bxic-xbei\\phi2xjknntddkjt.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Qx4SV9z6bXic-xBEI\\PhI2XjkNnTdDKjt.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\qx4sv9z6bxic-xbei\\phi2xjknntddkjt.mp3.enciphered")) returned 1 [0128.981] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Qx4SV9z6bXic-xBEI\\UxBGyvRf9j4pi_.mp3" (normalized: "c:\\users\\fd1hvy\\music\\qx4sv9z6bxic-xbei\\uxbgyvrf9j4pi_.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Qx4SV9z6bXic-xBEI\\UxBGyvRf9j4pi_.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\qx4sv9z6bxic-xbei\\uxbgyvrf9j4pi_.mp3.enciphered")) returned 1 [0128.984] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Qx4SV9z6bXic-xBEI\\vRvUHOpyiTgRfAZeW.wav" (normalized: "c:\\users\\fd1hvy\\music\\qx4sv9z6bxic-xbei\\vrvuhopyitgrfazew.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Qx4SV9z6bXic-xBEI\\vRvUHOpyiTgRfAZeW.wav.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\qx4sv9z6bxic-xbei\\vrvuhopyitgrfazew.wav.enciphered")) returned 1 [0128.987] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\rf3PPMhIw.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rf3ppmhiw.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\rf3PPMhIw.mp3.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\music\\rf3ppmhiw.mp3.enciphered")) returned 1 [0129.283] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\0GUatTsQ.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\0guattsq.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\0GUatTsQ.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\0guattsq.gif.enciphered")) returned 1 [0129.286] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\2sxE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\2sxe.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\2sxE.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\2sxe.png.enciphered")) returned 1 [0129.290] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\A2g_ 2FlHMa5aL-dO\\18kROR5q11cdb4.png" (normalized: "c:\\users\\fd1hvy\\pictures\\a2g_ 2flhma5al-do\\18kror5q11cdb4.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\A2g_ 2FlHMa5aL-dO\\18kROR5q11cdb4.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\a2g_ 2flhma5al-do\\18kror5q11cdb4.png.enciphered")) returned 1 [0129.293] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\A2g_ 2FlHMa5aL-dO\\g7jiL0Bk0h5I.png" (normalized: "c:\\users\\fd1hvy\\pictures\\a2g_ 2flhma5al-do\\g7jil0bk0h5i.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\A2g_ 2FlHMa5aL-dO\\g7jiL0Bk0h5I.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\a2g_ 2flhma5al-do\\g7jil0bk0h5i.png.enciphered")) returned 1 [0129.295] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\A2g_ 2FlHMa5aL-dO\\oHzIxd.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\a2g_ 2flhma5al-do\\ohzixd.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\A2g_ 2FlHMa5aL-dO\\oHzIxd.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\a2g_ 2flhma5al-do\\ohzixd.bmp.enciphered")) returned 1 [0129.297] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\A2g_ 2FlHMa5aL-dO\\pj ciaI96 _k.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\a2g_ 2flhma5al-do\\pj ciai96 _k.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\A2g_ 2FlHMa5aL-dO\\pj ciaI96 _k.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\a2g_ 2flhma5al-do\\pj ciai96 _k.bmp.enciphered")) returned 1 [0129.300] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\f0dhtgzO44Yk8Y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\f0dhtgzo44yk8y.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\f0dhtgzO44Yk8Y.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\f0dhtgzo44yk8y.png.enciphered")) returned 1 [0129.320] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\id7sg3YOm9jRCHOq8\\0P0The.png" (normalized: "c:\\users\\fd1hvy\\pictures\\id7sg3yom9jrchoq8\\0p0the.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\id7sg3YOm9jRCHOq8\\0P0The.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\id7sg3yom9jrchoq8\\0p0the.png.enciphered")) returned 1 [0129.323] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\id7sg3YOm9jRCHOq8\\IbikfxWUJud3zTTX.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\id7sg3yom9jrchoq8\\ibikfxwujud3zttx.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\id7sg3YOm9jRCHOq8\\IbikfxWUJud3zTTX.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\id7sg3yom9jrchoq8\\ibikfxwujud3zttx.jpg.enciphered")) returned 1 [0129.325] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\id7sg3YOm9jRCHOq8\\N5upfZEdj_i.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\id7sg3yom9jrchoq8\\n5upfzedj_i.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\id7sg3YOm9jRCHOq8\\N5upfZEdj_i.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\id7sg3yom9jrchoq8\\n5upfzedj_i.gif.enciphered")) returned 1 [0129.327] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\id7sg3YOm9jRCHOq8\\u8JH-O-UH1IwUaB.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\id7sg3yom9jrchoq8\\u8jh-o-uh1iwuab.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\id7sg3YOm9jRCHOq8\\u8JH-O-UH1IwUaB.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\id7sg3yom9jrchoq8\\u8jh-o-uh1iwuab.bmp.enciphered")) returned 1 [0129.331] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\mXmnIDhWq3qC8bRnt\\-KjuUGr.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\mxmnidhwq3qc8brnt\\-kjuugr.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\mXmnIDhWq3qC8bRnt\\-KjuUGr.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\mxmnidhwq3qc8brnt\\-kjuugr.gif.enciphered")) returned 1 [0129.334] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\mXmnIDhWq3qC8bRnt\\3IQm1FHslaSYVBne1.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\mxmnidhwq3qc8brnt\\3iqm1fhslasyvbne1.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\mXmnIDhWq3qC8bRnt\\3IQm1FHslaSYVBne1.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\mxmnidhwq3qc8brnt\\3iqm1fhslasyvbne1.jpg.enciphered")) returned 1 [0129.337] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\mXmnIDhWq3qC8bRnt\\DlQfohSG0T3EIPns.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\mxmnidhwq3qc8brnt\\dlqfohsg0t3eipns.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\mXmnIDhWq3qC8bRnt\\DlQfohSG0T3EIPns.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\mxmnidhwq3qc8brnt\\dlqfohsg0t3eipns.jpg.enciphered")) returned 1 [0129.340] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\mXmnIDhWq3qC8bRnt\\l4sTV-WQ7E-IvrJfbmC_.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\mxmnidhwq3qc8brnt\\l4stv-wq7e-ivrjfbmc_.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\mXmnIDhWq3qC8bRnt\\l4sTV-WQ7E-IvrJfbmC_.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\mxmnidhwq3qc8brnt\\l4stv-wq7e-ivrjfbmc_.jpg.enciphered")) returned 1 [0129.343] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\mXmnIDhWq3qC8bRnt\\ojT1WViopbTWmQMB6YD.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\mxmnidhwq3qc8brnt\\ojt1wviopbtwmqmb6yd.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\mXmnIDhWq3qC8bRnt\\ojT1WViopbTWmQMB6YD.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\mxmnidhwq3qc8brnt\\ojt1wviopbtwmqmb6yd.bmp.enciphered")) returned 1 [0129.345] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\mXmnIDhWq3qC8bRnt\\VVqhwtBVOQBauC.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\mxmnidhwq3qc8brnt\\vvqhwtbvoqbauc.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\mXmnIDhWq3qC8bRnt\\VVqhwtBVOQBauC.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\mxmnidhwq3qc8brnt\\vvqhwtbvoqbauc.jpg.enciphered")) returned 1 [0129.351] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\qMuBuwKIVZ_pyBXk.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qmubuwkivz_pybxk.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\qMuBuwKIVZ_pyBXk.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\qmubuwkivz_pybxk.jpg.enciphered")) returned 1 [0129.359] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\rN2hR0s3DOQtXUl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\rn2hr0s3doqtxul.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\rN2hR0s3DOQtXUl.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\rn2hr0s3doqtxul.jpg.enciphered")) returned 1 [0129.364] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\-ALup8a.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\-alup8a.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\-ALup8a.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\-alup8a.bmp.enciphered")) returned 1 [0129.366] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\7LvJ.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\7lvj.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\7LvJ.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\7lvj.gif.enciphered")) returned 1 [0129.369] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\dv74zZJ6UsLjY11w.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\dv74zzj6usljy11w.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\dv74zZJ6UsLjY11w.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\dv74zzj6usljy11w.gif.enciphered")) returned 1 [0129.372] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\EK-srFlceA8iCpd.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\ek-srflcea8icpd.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\EK-srFlceA8iCpd.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\ek-srflcea8icpd.jpg.enciphered")) returned 1 [0129.374] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\f5gDqXAxtIJMu83_e5.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\f5gdqxaxtijmu83_e5.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\f5gDqXAxtIJMu83_e5.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\f5gdqxaxtijmu83_e5.gif.enciphered")) returned 1 [0129.376] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\NdqCYV3BUZ.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\ndqcyv3buz.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\NdqCYV3BUZ.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\ndqcyv3buz.gif.enciphered")) returned 1 [0129.379] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\tRmp7-8d5.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\trmp7-8d5.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\tRmp7-8d5.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\trmp7-8d5.bmp.enciphered")) returned 1 [0129.382] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\vzVEGxpLPeY.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\vzvegxplpey.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\vzVEGxpLPeY.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\vzvegxplpey.gif.enciphered")) returned 1 [0129.386] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\636Csmf5s.png" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\636csmf5s.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\636Csmf5s.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\636csmf5s.png.enciphered")) returned 1 [0129.389] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\7dluZIwwLdCn2fSbO72.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\7dluziwwldcn2fsbo72.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\7dluZIwwLdCn2fSbO72.jpg.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\7dluziwwldcn2fsbo72.jpg.enciphered")) returned 1 [0129.392] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\cDp zjoDcqQW-QlrhtG\\4LndZa1P96LMPd0XX.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\cdp zjodcqqw-qlrhtg\\4lndza1p96lmpd0xx.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\cDp zjoDcqQW-QlrhtG\\4LndZa1P96LMPd0XX.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\cdp zjodcqqw-qlrhtg\\4lndza1p96lmpd0xx.bmp.enciphered")) returned 1 [0129.395] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\cDp zjoDcqQW-QlrhtG\\AVLL_xbMS5AA-.png" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\cdp zjodcqqw-qlrhtg\\avll_xbms5aa-.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\cDp zjoDcqQW-QlrhtG\\AVLL_xbMS5AA-.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\cdp zjodcqqw-qlrhtg\\avll_xbms5aa-.png.enciphered")) returned 1 [0129.397] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\cDp zjoDcqQW-QlrhtG\\dLEZnVuPmKCK.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\cdp zjodcqqw-qlrhtg\\dleznvupmkck.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\cDp zjoDcqQW-QlrhtG\\dLEZnVuPmKCK.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\cdp zjodcqqw-qlrhtg\\dleznvupmkck.bmp.enciphered")) returned 1 [0129.399] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\cDp zjoDcqQW-QlrhtG\\hFU0HF.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\cdp zjodcqqw-qlrhtg\\hfu0hf.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\cDp zjoDcqQW-QlrhtG\\hFU0HF.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\cdp zjodcqqw-qlrhtg\\hfu0hf.gif.enciphered")) returned 1 [0129.505] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\cDp zjoDcqQW-QlrhtG\\nPVHyn_GaDfCKr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\cdp zjodcqqw-qlrhtg\\npvhyn_gadfckr.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\cDp zjoDcqQW-QlrhtG\\nPVHyn_GaDfCKr.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\cdp zjodcqqw-qlrhtg\\npvhyn_gadfckr.png.enciphered")) returned 1 [0129.508] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\kmpDMlLa8tzuhsxW0x.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\kmpdmlla8tzuhsxw0x.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\kmpDMlLa8tzuhsxW0x.gif.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\kmpdmlla8tzuhsxw0x.gif.enciphered")) returned 1 [0129.511] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\q0hgn.png" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\q0hgn.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\q0hgn.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\q0hgn.png.enciphered")) returned 1 [0129.513] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\SzrfiHGbIXLQdDz.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\szrfihgbixlqddz.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\SzrfiHGbIXLQdDz.bmp.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\szrfihgbixlqddz.bmp.enciphered")) returned 1 [0129.515] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\wY0wF5U1mskTqL-T.png" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\wy0wf5u1msktql-t.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wkeiRm\\wY0wF5U1mskTqL-T.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wkeirm\\wy0wf5u1msktql-t.png.enciphered")) returned 1 [0129.518] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\WPwRAqtJps4nHXD- Y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wpwraqtjps4nhxd- y.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\WPwRAqtJps4nHXD- Y.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wpwraqtjps4nhxd- y.png.enciphered")) returned 1 [0129.521] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wvZ0FLkwSxUr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wvz0flkwsxur.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vTtCmK\\wvZ0FLkwSxUr.png.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\pictures\\vttcmk\\wvz0flkwsxur.png.enciphered")) returned 1 [0129.533] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\24WZ aKxnI.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\24wz akxni.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\24WZ aKxnI.mp4.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\24wz akxni.mp4.enciphered")) returned 1 [0129.536] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\2oHa-IM5JSDVaM.avi" (normalized: "c:\\users\\fd1hvy\\videos\\2oha-im5jsdvam.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\2oHa-IM5JSDVaM.avi.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\2oha-im5jsdvam.avi.enciphered")) returned 1 [0129.541] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\oawjQhUk\\5OP147JtpMFtJgxy5yY.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\oawjqhuk\\5op147jtpmftjgxy5yy.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\oawjQhUk\\5OP147JtpMFtJgxy5yY.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\oawjqhuk\\5op147jtpmftjgxy5yy.mkv.enciphered")) returned 1 [0129.543] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\oawjQhUk\\6m 3fWt.flv" (normalized: "c:\\users\\fd1hvy\\videos\\oawjqhuk\\6m 3fwt.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\oawjQhUk\\6m 3fWt.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\oawjqhuk\\6m 3fwt.flv.enciphered")) returned 1 [0129.546] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\oawjQhUk\\M2SzmlC.avi" (normalized: "c:\\users\\fd1hvy\\videos\\oawjqhuk\\m2szmlc.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\oawjQhUk\\M2SzmlC.avi.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\oawjqhuk\\m2szmlc.avi.enciphered")) returned 1 [0129.547] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\oawjQhUk\\nIgBOrIxvp.flv" (normalized: "c:\\users\\fd1hvy\\videos\\oawjqhuk\\nigborixvp.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\oawjQhUk\\nIgBOrIxvp.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\oawjqhuk\\nigborixvp.flv.enciphered")) returned 1 [0129.550] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\oawjQhUk\\NPpc4u.flv" (normalized: "c:\\users\\fd1hvy\\videos\\oawjqhuk\\nppc4u.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\oawjQhUk\\NPpc4u.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\oawjqhuk\\nppc4u.flv.enciphered")) returned 1 [0129.552] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\oawjQhUk\\q8dZMbJhVnmMe_VULhL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\oawjqhuk\\q8dzmbjhvnmme_vulhl.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\oawjQhUk\\q8dZMbJhVnmMe_VULhL.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\oawjqhuk\\q8dzmbjhvnmme_vulhl.mkv.enciphered")) returned 1 [0129.615] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\UUSF1ZGE\\RH5zLnUjUPz39bZpK.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\uusf1zge\\rh5zlnujupz39bzpk.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\UUSF1ZGE\\RH5zLnUjUPz39bZpK.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\uusf1zge\\rh5zlnujupz39bzpk.mkv.enciphered")) returned 1 [0129.620] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\UUSF1ZGE\\Wx-5YguAgjtUkDS-F9.flv" (normalized: "c:\\users\\fd1hvy\\videos\\uusf1zge\\wx-5yguagjtukds-f9.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\UUSF1ZGE\\Wx-5YguAgjtUkDS-F9.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\uusf1zge\\wx-5yguagjtukds-f9.flv.enciphered")) returned 1 [0129.622] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\UUSF1ZGE\\wxjuSKJQOfB1W.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\uusf1zge\\wxjuskjqofb1w.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\UUSF1ZGE\\wxjuSKJQOfB1W.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\uusf1zge\\wxjuskjqofb1w.mkv.enciphered")) returned 1 [0129.625] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\UUSF1ZGE\\ZhhWOoz0.flv" (normalized: "c:\\users\\fd1hvy\\videos\\uusf1zge\\zhhwooz0.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\UUSF1ZGE\\ZhhWOoz0.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\uusf1zge\\zhhwooz0.flv.enciphered")) returned 1 [0129.630] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\DjCor95SBU.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\djcor95sbu.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\DjCor95SBU.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\djcor95sbu.mkv.enciphered")) returned 1 [0129.632] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\l1Fym.avi" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\l1fym.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\l1Fym.avi.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\l1fym.avi.enciphered")) returned 1 [0129.634] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\MDDCQYQIOtSHh1kRv.flv" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\mddcqyqiotshh1krv.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\MDDCQYQIOtSHh1kRv.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\mddcqyqiotshh1krv.flv.enciphered")) returned 1 [0129.638] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\nxs22CqHfFIR1k2c1i\\BsV_ oMw.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\nxs22cqhffir1k2c1i\\bsv_ omw.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\nxs22CqHfFIR1k2c1i\\BsV_ oMw.mp4.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\nxs22cqhffir1k2c1i\\bsv_ omw.mp4.enciphered")) returned 1 [0129.641] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\nxs22CqHfFIR1k2c1i\\hSG6ua6f07EEqB.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\nxs22cqhffir1k2c1i\\hsg6ua6f07eeqb.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\nxs22CqHfFIR1k2c1i\\hSG6ua6f07EEqB.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\nxs22cqhffir1k2c1i\\hsg6ua6f07eeqb.mkv.enciphered")) returned 1 [0129.643] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\nxs22CqHfFIR1k2c1i\\Kr6TM2CdpNTHB.flv" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\nxs22cqhffir1k2c1i\\kr6tm2cdpnthb.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\nxs22CqHfFIR1k2c1i\\Kr6TM2CdpNTHB.flv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\nxs22cqhffir1k2c1i\\kr6tm2cdpnthb.flv.enciphered")) returned 1 [0129.646] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\nxs22CqHfFIR1k2c1i\\tzE9zv.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\nxs22cqhffir1k2c1i\\tze9zv.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\nxs22CqHfFIR1k2c1i\\tzE9zv.mkv.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\nxs22cqhffir1k2c1i\\tze9zv.mkv.enciphered")) returned 1 [0129.648] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\rqcr7VcvQ3pYQ9.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\rqcr7vcvq3pyq9.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\_ER-4uSX\\rqcr7VcvQ3pYQ9.mp4.EnCiPhErEd" (normalized: "c:\\users\\fd1hvy\\videos\\_er-4usx\\rqcr7vcvq3pyq9.mp4.enciphered")) returned 1 [0129.785] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.EnCiPhErEd" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk.enciphered")) returned 1 [0129.788] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.EnCiPhErEd" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.enciphered")) returned 1 [0129.791] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.EnCiPhErEd" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.enciphered")) returned 1 [0129.818] MoveFileA (lpExistingFileName="C:\\Windows\\appcompat\\UA\\GenericApp.png" (normalized: "c:\\windows\\appcompat\\ua\\genericapp.png"), lpNewFileName="C:\\Windows\\appcompat\\UA\\GenericApp.png.EnCiPhErEd" (normalized: "c:\\windows\\appcompat\\ua\\genericapp.png.enciphered")) returned 1 [0130.026] MoveFileA (lpExistingFileName="C:\\Windows\\appcompat\\UA\\GenericError.png" (normalized: "c:\\windows\\appcompat\\ua\\genericerror.png"), lpNewFileName="C:\\Windows\\appcompat\\UA\\GenericError.png.EnCiPhErEd" (normalized: "c:\\windows\\appcompat\\ua\\genericerror.png.enciphered")) returned 1 [0135.349] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.349] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.351] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.351] CloseHandle (hObject=0x214) returned 1 [0135.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.zip") returned 0 [0135.353] lstrlenA (lpString="*.zip") returned 5 [0135.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.rar") returned 0 [0135.353] lstrlenA (lpString="*.rar") returned 5 [0135.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.7z") returned 0 [0135.353] lstrlenA (lpString="*.7z") returned 4 [0135.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.tar") returned 0 [0135.353] lstrlenA (lpString="*.tar") returned 5 [0135.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.gzip") returned 0 [0135.353] lstrlenA (lpString="*.gzip") returned 6 [0135.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.jpg") returned 0 [0135.353] lstrlenA (lpString="*.jpg") returned 5 [0135.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.jpeg") returned 0 [0135.353] lstrlenA (lpString="*.jpeg") returned 6 [0135.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.psd") returned 0 [0135.353] lstrlenA (lpString="*.psd") returned 5 [0135.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.cdr") returned 0 [0135.353] lstrlenA (lpString="*.cdr") returned 5 [0135.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.dwg") returned 0 [0135.353] lstrlenA (lpString="*.dwg") returned 5 [0135.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.max") returned 0 [0135.354] lstrlenA (lpString="*.max") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.bmp") returned 0 [0135.354] lstrlenA (lpString="*.bmp") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.gif") returned 0 [0135.354] lstrlenA (lpString="*.gif") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.png") returned 0 [0135.354] lstrlenA (lpString="*.png") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.doc") returned 0 [0135.354] lstrlenA (lpString="*.doc") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.docx") returned 0 [0135.354] lstrlenA (lpString="*.docx") returned 6 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.xls") returned 0 [0135.354] lstrlenA (lpString="*.xls") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.xlsx") returned 0 [0135.354] lstrlenA (lpString="*.xlsx") returned 6 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.ppt") returned 0 [0135.354] lstrlenA (lpString="*.ppt") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.pptx") returned 0 [0135.354] lstrlenA (lpString="*.pptx") returned 6 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.txt") returned 0 [0135.354] lstrlenA (lpString="*.txt") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.pdf") returned 0 [0135.354] lstrlenA (lpString="*.pdf") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.djvu") returned 0 [0135.354] lstrlenA (lpString="*.djvu") returned 6 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.htm") returned 0 [0135.354] lstrlenA (lpString="*.htm") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.html") returned 0 [0135.354] lstrlenA (lpString="*.html") returned 6 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.mdb") returned 0 [0135.354] lstrlenA (lpString="*.mdb") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.cer") returned 0 [0135.354] lstrlenA (lpString="*.cer") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.p12") returned 0 [0135.354] lstrlenA (lpString="*.p12") returned 5 [0135.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.pfx") returned 0 [0135.354] lstrlenA (lpString="*.pfx") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.kwm") returned 0 [0135.355] lstrlenA (lpString="*.kwm") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.pwm") returned 0 [0135.355] lstrlenA (lpString="*.pwm") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.1cd") returned 0 [0135.355] lstrlenA (lpString="*.1cd") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.md") returned 0 [0135.355] lstrlenA (lpString="*.md") returned 4 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.mdf") returned 0 [0135.355] lstrlenA (lpString="*.mdf") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.dbf") returned 0 [0135.355] lstrlenA (lpString="*.dbf") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.odt") returned 0 [0135.355] lstrlenA (lpString="*.odt") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.vob") returned 0 [0135.355] lstrlenA (lpString="*.vob") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.ifo") returned 0 [0135.355] lstrlenA (lpString="*.ifo") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.lnk") returned 0 [0135.355] lstrlenA (lpString="*.lnk") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.torrent") returned 0 [0135.355] lstrlenA (lpString="*.torrent") returned 9 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.mov") returned 0 [0135.355] lstrlenA (lpString="*.mov") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.m2v") returned 0 [0135.355] lstrlenA (lpString="*.m2v") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.3gp") returned 0 [0135.355] lstrlenA (lpString="*.3gp") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.mpeg") returned 0 [0135.355] lstrlenA (lpString="*.mpeg") returned 6 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.mpg") returned 0 [0135.355] lstrlenA (lpString="*.mpg") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.flv") returned 0 [0135.355] lstrlenA (lpString="*.flv") returned 5 [0135.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.avi") returned 0 [0135.355] lstrlenA (lpString="*.avi") returned 5 [0135.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.mp4") returned 0 [0135.356] lstrlenA (lpString="*.mp4") returned 5 [0135.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.wmv") returned 0 [0135.356] lstrlenA (lpString="*.wmv") returned 5 [0135.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.divx") returned 0 [0135.356] lstrlenA (lpString="*.divx") returned 6 [0135.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.mkv") returned 0 [0135.356] lstrlenA (lpString="*.mkv") returned 5 [0135.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.mp3") returned 0 [0135.356] lstrlenA (lpString="*.mp3") returned 5 [0135.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.wav") returned 0 [0135.356] lstrlenA (lpString="*.wav") returned 5 [0135.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.flac") returned 0 [0135.356] lstrlenA (lpString="*.flac") returned 6 [0135.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.ape") returned 0 [0135.356] lstrlenA (lpString="*.ape") returned 5 [0135.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.wma") returned 0 [0135.356] lstrlenA (lpString="*.wma") returned 5 [0135.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.ac3") returned 0 [0135.356] lstrlenA (lpString="*.ac3") returned 5 [0135.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll", pszSpec="*.doc") returned 0 [0135.356] lstrlenA (lpString="*.doc") returned 5 [0135.356] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24d5879c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x24d5879c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x24d7e9ce, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.356] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.i0cd65b90#\\8366055f59151fea3affc415c4809049\\how to decrypt files.txt")) returned 0x20 [0135.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.357] lstrlenA (lpString="*.zip") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.357] lstrlenA (lpString="*.rar") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.357] lstrlenA (lpString="*.7z") returned 4 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.357] lstrlenA (lpString="*.tar") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.357] lstrlenA (lpString="*.gzip") returned 6 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.357] lstrlenA (lpString="*.jpg") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.357] lstrlenA (lpString="*.jpeg") returned 6 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.357] lstrlenA (lpString="*.psd") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.357] lstrlenA (lpString="*.cdr") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.357] lstrlenA (lpString="*.dwg") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.max") returned 0 [0135.357] lstrlenA (lpString="*.max") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.357] lstrlenA (lpString="*.bmp") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.357] lstrlenA (lpString="*.gif") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.png") returned 0 [0135.357] lstrlenA (lpString="*.png") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.357] lstrlenA (lpString="*.doc") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.357] lstrlenA (lpString="*.docx") returned 6 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.357] lstrlenA (lpString="*.xls") returned 5 [0135.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.357] lstrlenA (lpString="*.xlsx") returned 6 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.358] lstrlenA (lpString="*.ppt") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.358] lstrlenA (lpString="*.pptx") returned 6 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.358] lstrlenA (lpString="*.txt") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.358] lstrlenA (lpString="*.pdf") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.358] lstrlenA (lpString="*.djvu") returned 6 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.358] lstrlenA (lpString="*.htm") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.html") returned 0 [0135.358] lstrlenA (lpString="*.html") returned 6 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.358] lstrlenA (lpString="*.mdb") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.358] lstrlenA (lpString="*.cer") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.358] lstrlenA (lpString="*.p12") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.358] lstrlenA (lpString="*.pfx") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.358] lstrlenA (lpString="*.kwm") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.358] lstrlenA (lpString="*.pwm") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.358] lstrlenA (lpString="*.1cd") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.md") returned 0 [0135.358] lstrlenA (lpString="*.md") returned 4 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.358] lstrlenA (lpString="*.mdf") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.358] lstrlenA (lpString="*.dbf") returned 5 [0135.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.358] lstrlenA (lpString="*.odt") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.359] lstrlenA (lpString="*.vob") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.359] lstrlenA (lpString="*.ifo") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.359] lstrlenA (lpString="*.lnk") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.359] lstrlenA (lpString="*.torrent") returned 9 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.359] lstrlenA (lpString="*.mov") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.359] lstrlenA (lpString="*.m2v") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.359] lstrlenA (lpString="*.3gp") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.359] lstrlenA (lpString="*.mpeg") returned 6 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.359] lstrlenA (lpString="*.mpg") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.359] lstrlenA (lpString="*.flv") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.359] lstrlenA (lpString="*.avi") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.359] lstrlenA (lpString="*.mp4") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.359] lstrlenA (lpString="*.wmv") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.359] lstrlenA (lpString="*.divx") returned 6 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.359] lstrlenA (lpString="*.mkv") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.359] lstrlenA (lpString="*.mp3") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.359] lstrlenA (lpString="*.wav") returned 5 [0135.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.360] lstrlenA (lpString="*.flac") returned 6 [0135.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.360] lstrlenA (lpString="*.ape") returned 5 [0135.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.360] lstrlenA (lpString="*.wma") returned 5 [0135.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.360] lstrlenA (lpString="*.ac3") returned 5 [0135.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I0cd65b90#\\8366055f59151fea3affc415c4809049\\Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.360] lstrlenA (lpString="*.doc") returned 5 [0135.360] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24d5879c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x24d5879c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x24d7e9ce, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Isam.Esent.Interop.Wsa.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.360] FindClose (in: hFindFile=0x759d90 | out: hFindFile=0x759d90) returned 1 [0135.360] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24d32592, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x24d7e9ce, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x24d7e9ce, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8366055f59151fea3affc415c4809049", cAlternateFileName="836605~1")) returned 0 [0135.360] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0135.361] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb980a951, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b08c7ee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b08c7ee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e696e, dwReserved1=0x612e6c6c, cFileName="Microsoft.I7676db1a#", cAlternateFileName="MICROS~1.I76")) returned 1 [0135.361] lstrcmpA (lpString1=".", lpString2="Microsoft.I7676db1a#") returned -1 [0135.361] lstrcmpA (lpString1="..", lpString2="Microsoft.I7676db1a#") returned -1 [0135.361] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.I7676db1a#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#" [0135.361] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#") returned 67 [0135.361] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb980a951, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b08c7ee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b08c7ee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e50 [0135.361] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.361] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb980a951, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b08c7ee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b08c7ee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.361] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.361] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.361] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x234c418b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x234c418b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x234c418b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e08c96c49213868815c68ce4b7e5bad3", cAlternateFileName="E08C96~1")) returned 1 [0135.361] lstrcmpA (lpString1=".", lpString2="e08c96c49213868815c68ce4b7e5bad3") returned -1 [0135.361] lstrcmpA (lpString1="..", lpString2="e08c96c49213868815c68ce4b7e5bad3") returned -1 [0135.361] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\*.*") returned="*.*" [0135.361] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\", lpString2="e08c96c49213868815c68ce4b7e5bad3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3" [0135.361] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3") returned 100 [0135.361] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x234c418b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x234c418b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x234c418b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0135.375] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.375] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x234c418b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x234c418b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x234c418b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.375] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.375] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.375] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2349df5f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2349df5f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x234c418b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.InternationalSettings.Commands.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.376] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.InternationalSettings.Commands.ni.dll") returned -1 [0135.376] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.InternationalSettings.Commands.ni.dll") returned -1 [0135.376] lstrcmpiA (lpString1="", lpString2="Microsoft.InternationalSettings.Commands.ni.dll") returned -1 [0135.376] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\*.*") returned="*.*" [0135.376] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\" [0135.376] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\") returned="" [0135.376] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\HOW TO DECRYPT FILES.txt" [0135.376] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.i7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\how to decrypt files.txt")) returned 0xffffffff [0135.376] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.i7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.377] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.377] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.378] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.378] CloseHandle (hObject=0x214) returned 1 [0135.379] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\", lpString2="Microsoft.InternationalSettings.Commands.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll" [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.zip") returned 0 [0135.379] lstrlenA (lpString="*.zip") returned 5 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.rar") returned 0 [0135.379] lstrlenA (lpString="*.rar") returned 5 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.7z") returned 0 [0135.379] lstrlenA (lpString="*.7z") returned 4 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.tar") returned 0 [0135.379] lstrlenA (lpString="*.tar") returned 5 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.gzip") returned 0 [0135.379] lstrlenA (lpString="*.gzip") returned 6 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.jpg") returned 0 [0135.379] lstrlenA (lpString="*.jpg") returned 5 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.jpeg") returned 0 [0135.379] lstrlenA (lpString="*.jpeg") returned 6 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.psd") returned 0 [0135.379] lstrlenA (lpString="*.psd") returned 5 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.cdr") returned 0 [0135.379] lstrlenA (lpString="*.cdr") returned 5 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.dwg") returned 0 [0135.379] lstrlenA (lpString="*.dwg") returned 5 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.max") returned 0 [0135.379] lstrlenA (lpString="*.max") returned 5 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.bmp") returned 0 [0135.379] lstrlenA (lpString="*.bmp") returned 5 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.gif") returned 0 [0135.379] lstrlenA (lpString="*.gif") returned 5 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.png") returned 0 [0135.379] lstrlenA (lpString="*.png") returned 5 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.doc") returned 0 [0135.379] lstrlenA (lpString="*.doc") returned 5 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.docx") returned 0 [0135.379] lstrlenA (lpString="*.docx") returned 6 [0135.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.xls") returned 0 [0135.379] lstrlenA (lpString="*.xls") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.xlsx") returned 0 [0135.380] lstrlenA (lpString="*.xlsx") returned 6 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.ppt") returned 0 [0135.380] lstrlenA (lpString="*.ppt") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.pptx") returned 0 [0135.380] lstrlenA (lpString="*.pptx") returned 6 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.txt") returned 0 [0135.380] lstrlenA (lpString="*.txt") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.pdf") returned 0 [0135.380] lstrlenA (lpString="*.pdf") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.djvu") returned 0 [0135.380] lstrlenA (lpString="*.djvu") returned 6 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.htm") returned 0 [0135.380] lstrlenA (lpString="*.htm") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.html") returned 0 [0135.380] lstrlenA (lpString="*.html") returned 6 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.mdb") returned 0 [0135.380] lstrlenA (lpString="*.mdb") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.cer") returned 0 [0135.380] lstrlenA (lpString="*.cer") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.p12") returned 0 [0135.380] lstrlenA (lpString="*.p12") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.pfx") returned 0 [0135.380] lstrlenA (lpString="*.pfx") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.kwm") returned 0 [0135.380] lstrlenA (lpString="*.kwm") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.pwm") returned 0 [0135.380] lstrlenA (lpString="*.pwm") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.1cd") returned 0 [0135.380] lstrlenA (lpString="*.1cd") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.md") returned 0 [0135.380] lstrlenA (lpString="*.md") returned 4 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.mdf") returned 0 [0135.380] lstrlenA (lpString="*.mdf") returned 5 [0135.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.dbf") returned 0 [0135.380] lstrlenA (lpString="*.dbf") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.odt") returned 0 [0135.381] lstrlenA (lpString="*.odt") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.vob") returned 0 [0135.381] lstrlenA (lpString="*.vob") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.ifo") returned 0 [0135.381] lstrlenA (lpString="*.ifo") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.lnk") returned 0 [0135.381] lstrlenA (lpString="*.lnk") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.torrent") returned 0 [0135.381] lstrlenA (lpString="*.torrent") returned 9 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.mov") returned 0 [0135.381] lstrlenA (lpString="*.mov") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.m2v") returned 0 [0135.381] lstrlenA (lpString="*.m2v") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.3gp") returned 0 [0135.381] lstrlenA (lpString="*.3gp") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.mpeg") returned 0 [0135.381] lstrlenA (lpString="*.mpeg") returned 6 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.mpg") returned 0 [0135.381] lstrlenA (lpString="*.mpg") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.flv") returned 0 [0135.381] lstrlenA (lpString="*.flv") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.avi") returned 0 [0135.381] lstrlenA (lpString="*.avi") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.mp4") returned 0 [0135.381] lstrlenA (lpString="*.mp4") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.wmv") returned 0 [0135.381] lstrlenA (lpString="*.wmv") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.divx") returned 0 [0135.381] lstrlenA (lpString="*.divx") returned 6 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.mkv") returned 0 [0135.381] lstrlenA (lpString="*.mkv") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.mp3") returned 0 [0135.381] lstrlenA (lpString="*.mp3") returned 5 [0135.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.wav") returned 0 [0135.382] lstrlenA (lpString="*.wav") returned 5 [0135.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.flac") returned 0 [0135.382] lstrlenA (lpString="*.flac") returned 6 [0135.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.ape") returned 0 [0135.382] lstrlenA (lpString="*.ape") returned 5 [0135.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.wma") returned 0 [0135.382] lstrlenA (lpString="*.wma") returned 5 [0135.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.ac3") returned 0 [0135.382] lstrlenA (lpString="*.ac3") returned 5 [0135.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll", pszSpec="*.doc") returned 0 [0135.382] lstrlenA (lpString="*.doc") returned 5 [0135.382] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234c418b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x234c418b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x234c418b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.InternationalSettings.Commands.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.382] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.382] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.InternationalSettings.Commands.ni.dll.aux") returned -1 [0135.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.InternationalSettings.Commands.ni.dll.aux") returned -1 [0135.382] lstrcmpiA (lpString1="", lpString2="Microsoft.InternationalSettings.Commands.ni.dll.aux") returned -1 [0135.382] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll") returned="Microsoft.InternationalSettings.Commands.ni.dll" [0135.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\" [0135.382] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\") returned="" [0135.382] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\HOW TO DECRYPT FILES.txt" [0135.382] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.i7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\how to decrypt files.txt")) returned 0x20 [0135.382] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\", lpString2="Microsoft.InternationalSettings.Commands.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux" [0135.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.382] lstrlenA (lpString="*.zip") returned 5 [0135.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.382] lstrlenA (lpString="*.rar") returned 5 [0135.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.382] lstrlenA (lpString="*.7z") returned 4 [0135.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.382] lstrlenA (lpString="*.tar") returned 5 [0135.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.382] lstrlenA (lpString="*.gzip") returned 6 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.383] lstrlenA (lpString="*.jpg") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.383] lstrlenA (lpString="*.jpeg") returned 6 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.383] lstrlenA (lpString="*.psd") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.383] lstrlenA (lpString="*.cdr") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.383] lstrlenA (lpString="*.dwg") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.max") returned 0 [0135.383] lstrlenA (lpString="*.max") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.383] lstrlenA (lpString="*.bmp") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.383] lstrlenA (lpString="*.gif") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.png") returned 0 [0135.383] lstrlenA (lpString="*.png") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.383] lstrlenA (lpString="*.doc") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.383] lstrlenA (lpString="*.docx") returned 6 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.383] lstrlenA (lpString="*.xls") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.383] lstrlenA (lpString="*.xlsx") returned 6 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.383] lstrlenA (lpString="*.ppt") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.383] lstrlenA (lpString="*.pptx") returned 6 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.383] lstrlenA (lpString="*.txt") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.383] lstrlenA (lpString="*.pdf") returned 5 [0135.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.383] lstrlenA (lpString="*.djvu") returned 6 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.384] lstrlenA (lpString="*.htm") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.html") returned 0 [0135.384] lstrlenA (lpString="*.html") returned 6 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.384] lstrlenA (lpString="*.mdb") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.384] lstrlenA (lpString="*.cer") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.384] lstrlenA (lpString="*.p12") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.384] lstrlenA (lpString="*.pfx") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.384] lstrlenA (lpString="*.kwm") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.384] lstrlenA (lpString="*.pwm") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.384] lstrlenA (lpString="*.1cd") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.md") returned 0 [0135.384] lstrlenA (lpString="*.md") returned 4 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.384] lstrlenA (lpString="*.mdf") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.384] lstrlenA (lpString="*.dbf") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.384] lstrlenA (lpString="*.odt") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.384] lstrlenA (lpString="*.vob") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.384] lstrlenA (lpString="*.ifo") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.384] lstrlenA (lpString="*.lnk") returned 5 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.384] lstrlenA (lpString="*.torrent") returned 9 [0135.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.385] lstrlenA (lpString="*.mov") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.385] lstrlenA (lpString="*.m2v") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.385] lstrlenA (lpString="*.3gp") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.385] lstrlenA (lpString="*.mpeg") returned 6 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.385] lstrlenA (lpString="*.mpg") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.385] lstrlenA (lpString="*.flv") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.385] lstrlenA (lpString="*.avi") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.385] lstrlenA (lpString="*.mp4") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.385] lstrlenA (lpString="*.wmv") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.385] lstrlenA (lpString="*.divx") returned 6 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.385] lstrlenA (lpString="*.mkv") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.385] lstrlenA (lpString="*.mp3") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.385] lstrlenA (lpString="*.wav") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.385] lstrlenA (lpString="*.flac") returned 6 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.385] lstrlenA (lpString="*.ape") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.385] lstrlenA (lpString="*.wma") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.385] lstrlenA (lpString="*.ac3") returned 5 [0135.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.I7676db1a#\\e08c96c49213868815c68ce4b7e5bad3\\Microsoft.InternationalSettings.Commands.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.385] lstrlenA (lpString="*.doc") returned 5 [0135.385] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234c418b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x234c418b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x234c418b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.InternationalSettings.Commands.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.386] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0135.386] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x234c418b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x234c418b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x234c418b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e08c96c49213868815c68ce4b7e5bad3", cAlternateFileName="E08C96~1")) returned 0 [0135.386] FindClose (in: hFindFile=0x759e50 | out: hFindFile=0x759e50) returned 1 [0135.386] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9856dfa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b0d8c46, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b0d8c46, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x787561, dwReserved1=0x612e6c6c, cFileName="Microsoft.Ic1a2041b#", cAlternateFileName="MICROS~1.IC1")) returned 1 [0135.386] lstrcmpA (lpString1=".", lpString2="Microsoft.Ic1a2041b#") returned -1 [0135.386] lstrcmpA (lpString1="..", lpString2="Microsoft.Ic1a2041b#") returned -1 [0135.386] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.386] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Ic1a2041b#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#" [0135.386] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#") returned 67 [0135.386] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9856dfa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b0d8c46, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b0d8c46, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d90 [0135.387] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.387] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9856dfa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b0d8c46, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b0d8c46, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.387] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.387] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.387] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x240d515e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x240fb382, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x240fb382, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c325a959453e8f430557d0cc5fbe49c6", cAlternateFileName="C325A9~1")) returned 1 [0135.387] lstrcmpA (lpString1=".", lpString2="c325a959453e8f430557d0cc5fbe49c6") returned -1 [0135.387] lstrcmpA (lpString1="..", lpString2="c325a959453e8f430557d0cc5fbe49c6") returned -1 [0135.387] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\*.*") returned="*.*" [0135.387] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\", lpString2="c325a959453e8f430557d0cc5fbe49c6" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6" [0135.387] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6") returned 100 [0135.387] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x240d515e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x240fb382, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x240fb382, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0135.389] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.389] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x240d515e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x240fb382, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x240fb382, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.389] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.389] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.389] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x240aef10, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x240aef10, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x240fb382, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x185200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Isam.Esent.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.389] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.389] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Isam.Esent.Interop.ni.dll") returned -1 [0135.389] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Isam.Esent.Interop.ni.dll") returned -1 [0135.389] lstrcmpiA (lpString1="", lpString2="Microsoft.Isam.Esent.Interop.ni.dll") returned -1 [0135.389] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\*.*") returned="*.*" [0135.389] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\" [0135.389] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\") returned="" [0135.389] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\HOW TO DECRYPT FILES.txt" [0135.389] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\how to decrypt files.txt")) returned 0xffffffff [0135.389] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.390] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.390] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.391] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.391] CloseHandle (hObject=0x214) returned 1 [0135.391] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\", lpString2="Microsoft.Isam.Esent.Interop.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll" [0135.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.zip") returned 0 [0135.391] lstrlenA (lpString="*.zip") returned 5 [0135.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.rar") returned 0 [0135.391] lstrlenA (lpString="*.rar") returned 5 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.7z") returned 0 [0135.392] lstrlenA (lpString="*.7z") returned 4 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.tar") returned 0 [0135.392] lstrlenA (lpString="*.tar") returned 5 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.gzip") returned 0 [0135.392] lstrlenA (lpString="*.gzip") returned 6 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.jpg") returned 0 [0135.392] lstrlenA (lpString="*.jpg") returned 5 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.jpeg") returned 0 [0135.392] lstrlenA (lpString="*.jpeg") returned 6 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.psd") returned 0 [0135.392] lstrlenA (lpString="*.psd") returned 5 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.cdr") returned 0 [0135.392] lstrlenA (lpString="*.cdr") returned 5 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.dwg") returned 0 [0135.392] lstrlenA (lpString="*.dwg") returned 5 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.max") returned 0 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.bmp") returned 0 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.gif") returned 0 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.png") returned 0 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.doc") returned 0 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.docx") returned 0 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.xls") returned 0 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.xlsx") returned 0 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.ppt") returned 0 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.pptx") returned 0 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.txt") returned 0 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.pdf") returned 0 [0135.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.djvu") returned 0 [0135.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.htm") returned 0 [0135.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.html") returned 0 [0135.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.mdb") returned 0 [0135.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.cer") returned 0 [0135.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.p12") returned 0 [0135.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.pfx") returned 0 [0135.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.kwm") returned 0 [0135.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.pwm") returned 0 [0135.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.1cd") returned 0 [0135.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.md") returned 0 [0135.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.mdf") returned 0 [0135.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.dbf") returned 0 [0135.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.odt") returned 0 [0135.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.vob") returned 0 [0135.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.ifo") returned 0 [0135.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.lnk") returned 0 [0135.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.torrent") returned 0 [0135.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.mov") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.m2v") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.3gp") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.mpeg") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.mpg") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.flv") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.avi") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.mp4") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.wmv") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.divx") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.mkv") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.mp3") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.wav") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.flac") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.ape") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.wma") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.ac3") returned 0 [0135.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll", pszSpec="*.doc") returned 0 [0135.395] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x240d515e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x240d515e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x240fb382, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Isam.Esent.Interop.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.395] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.395] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Isam.Esent.Interop.ni.dll.aux") returned -1 [0135.395] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Isam.Esent.Interop.ni.dll.aux") returned -1 [0135.395] lstrcmpiA (lpString1="", lpString2="Microsoft.Isam.Esent.Interop.ni.dll.aux") returned -1 [0135.395] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll") returned="Microsoft.Isam.Esent.Interop.ni.dll" [0135.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\" [0135.395] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\") returned="" [0135.395] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\HOW TO DECRYPT FILES.txt" [0135.395] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\how to decrypt files.txt")) returned 0x20 [0135.396] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\", lpString2="Microsoft.Isam.Esent.Interop.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux" [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.max") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.png") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.html") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.md") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ic1a2041b#\\c325a959453e8f430557d0cc5fbe49c6\\Microsoft.Isam.Esent.Interop.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.398] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x240d515e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x240d515e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x240fb382, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Isam.Esent.Interop.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.398] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0135.398] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x240d515e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x240fb382, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x240fb382, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c325a959453e8f430557d0cc5fbe49c6", cAlternateFileName="C325A9~1")) returned 0 [0135.398] FindClose (in: hFindFile=0x759d90 | out: hFindFile=0x759d90) returned 1 [0135.399] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe622d71, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xe622d71, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xe622d71, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x787561, dwReserved1=0x612e6c6c, cFileName="Microsoft.JScript", cAlternateFileName="MICROS~1.JSC")) returned 1 [0135.399] lstrcmpA (lpString1=".", lpString2="Microsoft.JScript") returned -1 [0135.399] lstrcmpA (lpString1="..", lpString2="Microsoft.JScript") returned -1 [0135.399] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.399] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.JScript" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript" [0135.399] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe622d71, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xe622d71, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xe622d71, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0135.401] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.401] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe622d71, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xe622d71, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xe622d71, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.401] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.401] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.401] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe622d71, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xe648fd0, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xe648fd0, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="32ad4884a7c5dddcc19409d74d040ca2", cAlternateFileName="32AD48~1")) returned 1 [0135.401] lstrcmpA (lpString1=".", lpString2="32ad4884a7c5dddcc19409d74d040ca2") returned -1 [0135.401] lstrcmpA (lpString1="..", lpString2="32ad4884a7c5dddcc19409d74d040ca2") returned -1 [0135.401] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\*.*") returned="*.*" [0135.401] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\", lpString2="32ad4884a7c5dddcc19409d74d040ca2" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2" [0135.401] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe622d71, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xe648fd0, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xe648fd0, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0135.401] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.401] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe622d71, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xe648fd0, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xe648fd0, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.402] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.402] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.402] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5fcaee, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xe5fcaee, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xe648fd0, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x2aea00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.JScript.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.402] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.JScript.ni.dll") returned -1 [0135.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.JScript.ni.dll") returned -1 [0135.402] lstrcmpiA (lpString1="", lpString2="Microsoft.JScript.ni.dll") returned -1 [0135.402] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\*.*") returned="*.*" [0135.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\" [0135.402] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\") returned="" [0135.402] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\HOW TO DECRYPT FILES.txt" [0135.402] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.jscript\\32ad4884a7c5dddcc19409d74d040ca2\\how to decrypt files.txt")) returned 0xffffffff [0135.402] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.jscript\\32ad4884a7c5dddcc19409d74d040ca2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.405] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.405] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.406] CloseHandle (hObject=0x214) returned 1 [0135.406] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\", lpString2="Microsoft.JScript.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll" [0135.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.zip") returned 0 [0135.406] lstrlenA (lpString="*.zip") returned 5 [0135.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.rar") returned 0 [0135.406] lstrlenA (lpString="*.rar") returned 5 [0135.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.7z") returned 0 [0135.406] lstrlenA (lpString="*.7z") returned 4 [0135.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.tar") returned 0 [0135.406] lstrlenA (lpString="*.tar") returned 5 [0135.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.gzip") returned 0 [0135.406] lstrlenA (lpString="*.gzip") returned 6 [0135.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.jpg") returned 0 [0135.406] lstrlenA (lpString="*.jpg") returned 5 [0135.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.jpeg") returned 0 [0135.406] lstrlenA (lpString="*.jpeg") returned 6 [0135.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.psd") returned 0 [0135.406] lstrlenA (lpString="*.psd") returned 5 [0135.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.cdr") returned 0 [0135.406] lstrlenA (lpString="*.cdr") returned 5 [0135.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.dwg") returned 0 [0135.406] lstrlenA (lpString="*.dwg") returned 5 [0135.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.max") returned 0 [0135.406] lstrlenA (lpString="*.max") returned 5 [0135.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.bmp") returned 0 [0135.407] lstrlenA (lpString="*.bmp") returned 5 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.gif") returned 0 [0135.407] lstrlenA (lpString="*.gif") returned 5 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.png") returned 0 [0135.407] lstrlenA (lpString="*.png") returned 5 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.doc") returned 0 [0135.407] lstrlenA (lpString="*.doc") returned 5 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.docx") returned 0 [0135.407] lstrlenA (lpString="*.docx") returned 6 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.xls") returned 0 [0135.407] lstrlenA (lpString="*.xls") returned 5 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.xlsx") returned 0 [0135.407] lstrlenA (lpString="*.xlsx") returned 6 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.ppt") returned 0 [0135.407] lstrlenA (lpString="*.ppt") returned 5 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.pptx") returned 0 [0135.407] lstrlenA (lpString="*.pptx") returned 6 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.txt") returned 0 [0135.407] lstrlenA (lpString="*.txt") returned 5 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.pdf") returned 0 [0135.407] lstrlenA (lpString="*.pdf") returned 5 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.djvu") returned 0 [0135.407] lstrlenA (lpString="*.djvu") returned 6 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.htm") returned 0 [0135.407] lstrlenA (lpString="*.htm") returned 5 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.html") returned 0 [0135.407] lstrlenA (lpString="*.html") returned 6 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.mdb") returned 0 [0135.407] lstrlenA (lpString="*.mdb") returned 5 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.cer") returned 0 [0135.407] lstrlenA (lpString="*.cer") returned 5 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.p12") returned 0 [0135.407] lstrlenA (lpString="*.p12") returned 5 [0135.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.pfx") returned 0 [0135.407] lstrlenA (lpString="*.pfx") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.kwm") returned 0 [0135.408] lstrlenA (lpString="*.kwm") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.pwm") returned 0 [0135.408] lstrlenA (lpString="*.pwm") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.1cd") returned 0 [0135.408] lstrlenA (lpString="*.1cd") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.md") returned 0 [0135.408] lstrlenA (lpString="*.md") returned 4 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.mdf") returned 0 [0135.408] lstrlenA (lpString="*.mdf") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.dbf") returned 0 [0135.408] lstrlenA (lpString="*.dbf") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.odt") returned 0 [0135.408] lstrlenA (lpString="*.odt") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.vob") returned 0 [0135.408] lstrlenA (lpString="*.vob") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.ifo") returned 0 [0135.408] lstrlenA (lpString="*.ifo") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.lnk") returned 0 [0135.408] lstrlenA (lpString="*.lnk") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.torrent") returned 0 [0135.408] lstrlenA (lpString="*.torrent") returned 9 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.mov") returned 0 [0135.408] lstrlenA (lpString="*.mov") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.m2v") returned 0 [0135.408] lstrlenA (lpString="*.m2v") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.3gp") returned 0 [0135.408] lstrlenA (lpString="*.3gp") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.mpeg") returned 0 [0135.408] lstrlenA (lpString="*.mpeg") returned 6 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.mpg") returned 0 [0135.408] lstrlenA (lpString="*.mpg") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.flv") returned 0 [0135.408] lstrlenA (lpString="*.flv") returned 5 [0135.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.avi") returned 0 [0135.418] lstrlenA (lpString="*.avi") returned 5 [0135.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.mp4") returned 0 [0135.418] lstrlenA (lpString="*.mp4") returned 5 [0135.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.wmv") returned 0 [0135.419] lstrlenA (lpString="*.wmv") returned 5 [0135.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.divx") returned 0 [0135.419] lstrlenA (lpString="*.divx") returned 6 [0135.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.mkv") returned 0 [0135.419] lstrlenA (lpString="*.mkv") returned 5 [0135.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.mp3") returned 0 [0135.419] lstrlenA (lpString="*.mp3") returned 5 [0135.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.wav") returned 0 [0135.419] lstrlenA (lpString="*.wav") returned 5 [0135.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.flac") returned 0 [0135.419] lstrlenA (lpString="*.flac") returned 6 [0135.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.ape") returned 0 [0135.419] lstrlenA (lpString="*.ape") returned 5 [0135.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.wma") returned 0 [0135.419] lstrlenA (lpString="*.wma") returned 5 [0135.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.ac3") returned 0 [0135.419] lstrlenA (lpString="*.ac3") returned 5 [0135.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll", pszSpec="*.doc") returned 0 [0135.419] lstrlenA (lpString="*.doc") returned 5 [0135.419] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe622d71, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xe622d71, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xe648fd0, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.JScript.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.419] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.419] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.JScript.ni.dll.aux") returned -1 [0135.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.JScript.ni.dll.aux") returned -1 [0135.419] lstrcmpiA (lpString1="", lpString2="Microsoft.JScript.ni.dll.aux") returned -1 [0135.419] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll") returned="Microsoft.JScript.ni.dll" [0135.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\" [0135.419] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\") returned="" [0135.419] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\HOW TO DECRYPT FILES.txt" [0135.419] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.jscript\\32ad4884a7c5dddcc19409d74d040ca2\\how to decrypt files.txt")) returned 0x20 [0135.419] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\", lpString2="Microsoft.JScript.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux" [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.420] lstrlenA (lpString="*.zip") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.420] lstrlenA (lpString="*.rar") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.420] lstrlenA (lpString="*.7z") returned 4 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.420] lstrlenA (lpString="*.tar") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.420] lstrlenA (lpString="*.gzip") returned 6 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.420] lstrlenA (lpString="*.jpg") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.420] lstrlenA (lpString="*.jpeg") returned 6 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.420] lstrlenA (lpString="*.psd") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.420] lstrlenA (lpString="*.cdr") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.420] lstrlenA (lpString="*.dwg") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.max") returned 0 [0135.420] lstrlenA (lpString="*.max") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.420] lstrlenA (lpString="*.bmp") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.420] lstrlenA (lpString="*.gif") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.png") returned 0 [0135.420] lstrlenA (lpString="*.png") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.420] lstrlenA (lpString="*.doc") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.420] lstrlenA (lpString="*.docx") returned 6 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.420] lstrlenA (lpString="*.xls") returned 5 [0135.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.421] lstrlenA (lpString="*.xlsx") returned 6 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.421] lstrlenA (lpString="*.ppt") returned 5 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.421] lstrlenA (lpString="*.pptx") returned 6 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.421] lstrlenA (lpString="*.txt") returned 5 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.421] lstrlenA (lpString="*.pdf") returned 5 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.421] lstrlenA (lpString="*.djvu") returned 6 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.421] lstrlenA (lpString="*.htm") returned 5 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.html") returned 0 [0135.421] lstrlenA (lpString="*.html") returned 6 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.421] lstrlenA (lpString="*.mdb") returned 5 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.421] lstrlenA (lpString="*.cer") returned 5 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.421] lstrlenA (lpString="*.p12") returned 5 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.421] lstrlenA (lpString="*.pfx") returned 5 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.421] lstrlenA (lpString="*.kwm") returned 5 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.421] lstrlenA (lpString="*.pwm") returned 5 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.421] lstrlenA (lpString="*.1cd") returned 5 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.md") returned 0 [0135.421] lstrlenA (lpString="*.md") returned 4 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.421] lstrlenA (lpString="*.mdf") returned 5 [0135.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.422] lstrlenA (lpString="*.dbf") returned 5 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.422] lstrlenA (lpString="*.odt") returned 5 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.422] lstrlenA (lpString="*.vob") returned 5 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.422] lstrlenA (lpString="*.ifo") returned 5 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.422] lstrlenA (lpString="*.lnk") returned 5 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.422] lstrlenA (lpString="*.torrent") returned 9 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.422] lstrlenA (lpString="*.mov") returned 5 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.422] lstrlenA (lpString="*.m2v") returned 5 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.422] lstrlenA (lpString="*.3gp") returned 5 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.422] lstrlenA (lpString="*.mpeg") returned 6 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.422] lstrlenA (lpString="*.mpg") returned 5 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.422] lstrlenA (lpString="*.flv") returned 5 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.422] lstrlenA (lpString="*.avi") returned 5 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.422] lstrlenA (lpString="*.mp4") returned 5 [0135.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.422] lstrlenA (lpString="*.wmv") returned 5 [0135.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.423] lstrlenA (lpString="*.divx") returned 6 [0135.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.423] lstrlenA (lpString="*.mkv") returned 5 [0135.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.423] lstrlenA (lpString="*.mp3") returned 5 [0135.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.423] lstrlenA (lpString="*.wav") returned 5 [0135.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.423] lstrlenA (lpString="*.flac") returned 6 [0135.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.423] lstrlenA (lpString="*.ape") returned 5 [0135.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.423] lstrlenA (lpString="*.wma") returned 5 [0135.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.423] lstrlenA (lpString="*.ac3") returned 5 [0135.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\32ad4884a7c5dddcc19409d74d040ca2\\Microsoft.JScript.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.423] lstrlenA (lpString="*.doc") returned 5 [0135.423] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe622d71, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xe622d71, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xe648fd0, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.JScript.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.423] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0135.424] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe622d71, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xe648fd0, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xe648fd0, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="32ad4884a7c5dddcc19409d74d040ca2", cAlternateFileName="32AD48~1")) returned 0 [0135.424] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0135.425] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb96b3416, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b1714ee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b1714ee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x787561, dwReserved1=0x612e6c6c, cFileName="Microsoft.Kd58820a5#", cAlternateFileName="MICROS~1.KD5")) returned 1 [0135.425] lstrcmpA (lpString1=".", lpString2="Microsoft.Kd58820a5#") returned -1 [0135.425] lstrcmpA (lpString1="..", lpString2="Microsoft.Kd58820a5#") returned -1 [0135.425] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.425] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Kd58820a5#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#" [0135.425] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#") returned 67 [0135.425] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb96b3416, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b1714ee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b1714ee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0135.426] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.426] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb96b3416, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b1714ee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b1714ee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.426] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.426] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.426] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24fbaaee, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x24fbaaee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x24fbaaee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0aebd0923ed3ffce9f4f3cc22f4ff832", cAlternateFileName="0AEBD0~1")) returned 1 [0135.426] lstrcmpA (lpString1=".", lpString2="0aebd0923ed3ffce9f4f3cc22f4ff832") returned -1 [0135.426] lstrcmpA (lpString1="..", lpString2="0aebd0923ed3ffce9f4f3cc22f4ff832") returned -1 [0135.426] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\*.*") returned="*.*" [0135.426] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\", lpString2="0aebd0923ed3ffce9f4f3cc22f4ff832" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832" [0135.426] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832") returned 100 [0135.426] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24fbaaee, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x24fbaaee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x24fbaaee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0135.428] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.428] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24fbaaee, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x24fbaaee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x24fbaaee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.428] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.428] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.428] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24f9482c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x24f9482c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x24fbaaee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x21200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.KeyDistributionService.Cmdlets.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.428] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.KeyDistributionService.Cmdlets.ni.dll") returned -1 [0135.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.KeyDistributionService.Cmdlets.ni.dll") returned -1 [0135.428] lstrcmpiA (lpString1="", lpString2="Microsoft.KeyDistributionService.Cmdlets.ni.dll") returned -1 [0135.428] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\*.*") returned="*.*" [0135.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\" [0135.428] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\") returned="" [0135.428] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\HOW TO DECRYPT FILES.txt" [0135.428] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\how to decrypt files.txt")) returned 0xffffffff [0135.429] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.430] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.430] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.430] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.431] CloseHandle (hObject=0x214) returned 1 [0135.431] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\", lpString2="Microsoft.KeyDistributionService.Cmdlets.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll" [0135.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.zip") returned 0 [0135.431] lstrlenA (lpString="*.zip") returned 5 [0135.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.rar") returned 0 [0135.431] lstrlenA (lpString="*.rar") returned 5 [0135.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.7z") returned 0 [0135.431] lstrlenA (lpString="*.7z") returned 4 [0135.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.tar") returned 0 [0135.431] lstrlenA (lpString="*.tar") returned 5 [0135.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.gzip") returned 0 [0135.431] lstrlenA (lpString="*.gzip") returned 6 [0135.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.jpg") returned 0 [0135.431] lstrlenA (lpString="*.jpg") returned 5 [0135.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.jpeg") returned 0 [0135.431] lstrlenA (lpString="*.jpeg") returned 6 [0135.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.psd") returned 0 [0135.431] lstrlenA (lpString="*.psd") returned 5 [0135.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.cdr") returned 0 [0135.431] lstrlenA (lpString="*.cdr") returned 5 [0135.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.dwg") returned 0 [0135.432] lstrlenA (lpString="*.dwg") returned 5 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.max") returned 0 [0135.432] lstrlenA (lpString="*.max") returned 5 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.bmp") returned 0 [0135.432] lstrlenA (lpString="*.bmp") returned 5 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.gif") returned 0 [0135.432] lstrlenA (lpString="*.gif") returned 5 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.png") returned 0 [0135.432] lstrlenA (lpString="*.png") returned 5 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.doc") returned 0 [0135.432] lstrlenA (lpString="*.doc") returned 5 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.docx") returned 0 [0135.432] lstrlenA (lpString="*.docx") returned 6 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.xls") returned 0 [0135.432] lstrlenA (lpString="*.xls") returned 5 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.xlsx") returned 0 [0135.432] lstrlenA (lpString="*.xlsx") returned 6 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.ppt") returned 0 [0135.432] lstrlenA (lpString="*.ppt") returned 5 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.pptx") returned 0 [0135.432] lstrlenA (lpString="*.pptx") returned 6 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.txt") returned 0 [0135.432] lstrlenA (lpString="*.txt") returned 5 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.pdf") returned 0 [0135.432] lstrlenA (lpString="*.pdf") returned 5 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.djvu") returned 0 [0135.432] lstrlenA (lpString="*.djvu") returned 6 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.htm") returned 0 [0135.432] lstrlenA (lpString="*.htm") returned 5 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.html") returned 0 [0135.432] lstrlenA (lpString="*.html") returned 6 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.mdb") returned 0 [0135.432] lstrlenA (lpString="*.mdb") returned 5 [0135.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.cer") returned 0 [0135.432] lstrlenA (lpString="*.cer") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.p12") returned 0 [0135.433] lstrlenA (lpString="*.p12") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.pfx") returned 0 [0135.433] lstrlenA (lpString="*.pfx") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.kwm") returned 0 [0135.433] lstrlenA (lpString="*.kwm") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.pwm") returned 0 [0135.433] lstrlenA (lpString="*.pwm") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.1cd") returned 0 [0135.433] lstrlenA (lpString="*.1cd") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.md") returned 0 [0135.433] lstrlenA (lpString="*.md") returned 4 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.mdf") returned 0 [0135.433] lstrlenA (lpString="*.mdf") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.dbf") returned 0 [0135.433] lstrlenA (lpString="*.dbf") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.odt") returned 0 [0135.433] lstrlenA (lpString="*.odt") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.vob") returned 0 [0135.433] lstrlenA (lpString="*.vob") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.ifo") returned 0 [0135.433] lstrlenA (lpString="*.ifo") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.lnk") returned 0 [0135.433] lstrlenA (lpString="*.lnk") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.torrent") returned 0 [0135.433] lstrlenA (lpString="*.torrent") returned 9 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.mov") returned 0 [0135.433] lstrlenA (lpString="*.mov") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.m2v") returned 0 [0135.433] lstrlenA (lpString="*.m2v") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.3gp") returned 0 [0135.433] lstrlenA (lpString="*.3gp") returned 5 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.mpeg") returned 0 [0135.433] lstrlenA (lpString="*.mpeg") returned 6 [0135.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.mpg") returned 0 [0135.433] lstrlenA (lpString="*.mpg") returned 5 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.flv") returned 0 [0135.434] lstrlenA (lpString="*.flv") returned 5 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.avi") returned 0 [0135.434] lstrlenA (lpString="*.avi") returned 5 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.mp4") returned 0 [0135.434] lstrlenA (lpString="*.mp4") returned 5 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.wmv") returned 0 [0135.434] lstrlenA (lpString="*.wmv") returned 5 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.divx") returned 0 [0135.434] lstrlenA (lpString="*.divx") returned 6 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.mkv") returned 0 [0135.434] lstrlenA (lpString="*.mkv") returned 5 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.mp3") returned 0 [0135.434] lstrlenA (lpString="*.mp3") returned 5 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.wav") returned 0 [0135.434] lstrlenA (lpString="*.wav") returned 5 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.flac") returned 0 [0135.434] lstrlenA (lpString="*.flac") returned 6 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.ape") returned 0 [0135.434] lstrlenA (lpString="*.ape") returned 5 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.wma") returned 0 [0135.434] lstrlenA (lpString="*.wma") returned 5 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.ac3") returned 0 [0135.434] lstrlenA (lpString="*.ac3") returned 5 [0135.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll", pszSpec="*.doc") returned 0 [0135.434] lstrlenA (lpString="*.doc") returned 5 [0135.434] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fbaaee, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x24fbaaee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x24fbaaee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.434] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.434] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux") returned -1 [0135.434] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux") returned -1 [0135.434] lstrcmpiA (lpString1="", lpString2="Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux") returned -1 [0135.434] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll") returned="Microsoft.KeyDistributionService.Cmdlets.ni.dll" [0135.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\" [0135.435] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\") returned="" [0135.435] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\HOW TO DECRYPT FILES.txt" [0135.435] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\how to decrypt files.txt")) returned 0x20 [0135.435] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\", lpString2="Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux" [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.435] lstrlenA (lpString="*.zip") returned 5 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.435] lstrlenA (lpString="*.rar") returned 5 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.435] lstrlenA (lpString="*.7z") returned 4 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.435] lstrlenA (lpString="*.tar") returned 5 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.435] lstrlenA (lpString="*.gzip") returned 6 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.435] lstrlenA (lpString="*.jpg") returned 5 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.435] lstrlenA (lpString="*.jpeg") returned 6 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.435] lstrlenA (lpString="*.psd") returned 5 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.435] lstrlenA (lpString="*.cdr") returned 5 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.435] lstrlenA (lpString="*.dwg") returned 5 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.max") returned 0 [0135.435] lstrlenA (lpString="*.max") returned 5 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.435] lstrlenA (lpString="*.bmp") returned 5 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.435] lstrlenA (lpString="*.gif") returned 5 [0135.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.png") returned 0 [0135.435] lstrlenA (lpString="*.png") returned 5 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.436] lstrlenA (lpString="*.doc") returned 5 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.436] lstrlenA (lpString="*.docx") returned 6 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.436] lstrlenA (lpString="*.xls") returned 5 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.436] lstrlenA (lpString="*.xlsx") returned 6 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.436] lstrlenA (lpString="*.ppt") returned 5 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.436] lstrlenA (lpString="*.pptx") returned 6 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.436] lstrlenA (lpString="*.txt") returned 5 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.436] lstrlenA (lpString="*.pdf") returned 5 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.436] lstrlenA (lpString="*.djvu") returned 6 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.436] lstrlenA (lpString="*.htm") returned 5 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.html") returned 0 [0135.436] lstrlenA (lpString="*.html") returned 6 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.436] lstrlenA (lpString="*.mdb") returned 5 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.436] lstrlenA (lpString="*.cer") returned 5 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.436] lstrlenA (lpString="*.p12") returned 5 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.436] lstrlenA (lpString="*.pfx") returned 5 [0135.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.436] lstrlenA (lpString="*.kwm") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.437] lstrlenA (lpString="*.pwm") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.437] lstrlenA (lpString="*.1cd") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.md") returned 0 [0135.437] lstrlenA (lpString="*.md") returned 4 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.437] lstrlenA (lpString="*.mdf") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.437] lstrlenA (lpString="*.dbf") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.437] lstrlenA (lpString="*.odt") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.437] lstrlenA (lpString="*.vob") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.437] lstrlenA (lpString="*.ifo") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.437] lstrlenA (lpString="*.lnk") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.437] lstrlenA (lpString="*.torrent") returned 9 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.437] lstrlenA (lpString="*.mov") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.437] lstrlenA (lpString="*.m2v") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.437] lstrlenA (lpString="*.3gp") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.437] lstrlenA (lpString="*.mpeg") returned 6 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.437] lstrlenA (lpString="*.mpg") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.437] lstrlenA (lpString="*.flv") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.437] lstrlenA (lpString="*.avi") returned 5 [0135.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.437] lstrlenA (lpString="*.mp4") returned 5 [0135.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.438] lstrlenA (lpString="*.wmv") returned 5 [0135.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.438] lstrlenA (lpString="*.divx") returned 6 [0135.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.438] lstrlenA (lpString="*.mkv") returned 5 [0135.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.438] lstrlenA (lpString="*.mp3") returned 5 [0135.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.438] lstrlenA (lpString="*.wav") returned 5 [0135.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.438] lstrlenA (lpString="*.flac") returned 6 [0135.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.438] lstrlenA (lpString="*.ape") returned 5 [0135.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.438] lstrlenA (lpString="*.wma") returned 5 [0135.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.438] lstrlenA (lpString="*.ac3") returned 5 [0135.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\0aebd0923ed3ffce9f4f3cc22f4ff832\\Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.438] lstrlenA (lpString="*.doc") returned 5 [0135.438] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fbaaee, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x24fbaaee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x24fbaaee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.KeyDistributionService.Cmdlets.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.438] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0135.439] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24fbaaee, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x24fbaaee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x24fbaaee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0aebd0923ed3ffce9f4f3cc22f4ff832", cAlternateFileName="0AEBD0~1")) returned 0 [0135.439] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0135.439] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8ef398d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b2a264c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b2a264c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x787561, dwReserved1=0x612e6c6c, cFileName="Microsoft.M870d558a#", cAlternateFileName="MICROS~1.M87")) returned 1 [0135.439] lstrcmpA (lpString1=".", lpString2="Microsoft.M870d558a#") returned -1 [0135.439] lstrcmpA (lpString1="..", lpString2="Microsoft.M870d558a#") returned -1 [0135.439] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.439] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.M870d558a#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#" [0135.439] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#") returned 67 [0135.439] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8ef398d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b2a264c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b2a264c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0135.440] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.440] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8ef398d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b2a264c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b2a264c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.440] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.440] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.441] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe4b51a7, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe4b51a7, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe4b51a7, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="69f92846e83458877d5007eabaf91392", cAlternateFileName="69F928~1")) returned 1 [0135.441] lstrcmpA (lpString1=".", lpString2="69f92846e83458877d5007eabaf91392") returned -1 [0135.441] lstrcmpA (lpString1="..", lpString2="69f92846e83458877d5007eabaf91392") returned -1 [0135.441] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\*.*") returned="*.*" [0135.441] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\", lpString2="69f92846e83458877d5007eabaf91392" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392" [0135.441] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392") returned 100 [0135.441] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe4b51a7, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe4b51a7, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe4b51a7, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0135.443] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.443] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe4b51a7, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe4b51a7, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe4b51a7, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.443] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.443] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.443] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe48ef53, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe48ef53, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe4b51a7, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0xa2200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Management.Infrastructure.Native.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.443] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.464] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Management.Infrastructure.Native.ni.dll") returned -1 [0135.464] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Management.Infrastructure.Native.ni.dll") returned -1 [0135.464] lstrcmpiA (lpString1="", lpString2="Microsoft.Management.Infrastructure.Native.ni.dll") returned -1 [0135.464] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\*.*") returned="*.*" [0135.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\" [0135.464] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\") returned="" [0135.465] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\HOW TO DECRYPT FILES.txt" [0135.465] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.m870d558a#\\69f92846e83458877d5007eabaf91392\\how to decrypt files.txt")) returned 0xffffffff [0135.465] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.m870d558a#\\69f92846e83458877d5007eabaf91392\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.467] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.467] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.468] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.468] CloseHandle (hObject=0x214) returned 1 [0135.468] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\", lpString2="Microsoft.Management.Infrastructure.Native.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll" [0135.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.zip") returned 0 [0135.468] lstrlenA (lpString="*.zip") returned 5 [0135.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.rar") returned 0 [0135.468] lstrlenA (lpString="*.rar") returned 5 [0135.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.7z") returned 0 [0135.468] lstrlenA (lpString="*.7z") returned 4 [0135.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.tar") returned 0 [0135.468] lstrlenA (lpString="*.tar") returned 5 [0135.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.gzip") returned 0 [0135.468] lstrlenA (lpString="*.gzip") returned 6 [0135.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.jpg") returned 0 [0135.468] lstrlenA (lpString="*.jpg") returned 5 [0135.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.jpeg") returned 0 [0135.468] lstrlenA (lpString="*.jpeg") returned 6 [0135.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.psd") returned 0 [0135.468] lstrlenA (lpString="*.psd") returned 5 [0135.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.cdr") returned 0 [0135.468] lstrlenA (lpString="*.cdr") returned 5 [0135.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.dwg") returned 0 [0135.469] lstrlenA (lpString="*.dwg") returned 5 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.max") returned 0 [0135.469] lstrlenA (lpString="*.max") returned 5 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.bmp") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.gif") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.png") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.doc") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.docx") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.xls") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.xlsx") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.ppt") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.pptx") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.txt") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.pdf") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.djvu") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.htm") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.html") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.mdb") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.cer") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.p12") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.pfx") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.kwm") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.pwm") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.1cd") returned 0 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.md") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.mdf") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.dbf") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.odt") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.vob") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.ifo") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.lnk") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.torrent") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.mov") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.m2v") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.3gp") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.mpeg") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.mpg") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.flv") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.avi") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.mp4") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.wmv") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.divx") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.mkv") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.mp3") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.wav") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.flac") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.ape") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.wma") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.ac3") returned 0 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll", pszSpec="*.doc") returned 0 [0135.471] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b51a7, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe4b51a7, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe4b51a7, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Management.Infrastructure.Native.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.471] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.471] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Management.Infrastructure.Native.ni.dll.aux") returned -1 [0135.471] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Management.Infrastructure.Native.ni.dll.aux") returned -1 [0135.471] lstrcmpiA (lpString1="", lpString2="Microsoft.Management.Infrastructure.Native.ni.dll.aux") returned -1 [0135.471] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll") returned="Microsoft.Management.Infrastructure.Native.ni.dll" [0135.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\" [0135.471] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\") returned="" [0135.471] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\HOW TO DECRYPT FILES.txt" [0135.471] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.m870d558a#\\69f92846e83458877d5007eabaf91392\\how to decrypt files.txt")) returned 0x20 [0135.471] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\", lpString2="Microsoft.Management.Infrastructure.Native.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux" [0135.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.max") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.png") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.html") returned 0 [0135.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.md") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\69f92846e83458877d5007eabaf91392\\Microsoft.Management.Infrastructure.Native.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.474] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b51a7, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe4b51a7, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe4b51a7, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Management.Infrastructure.Native.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.474] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0135.474] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe4b51a7, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe4b51a7, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe4b51a7, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="69f92846e83458877d5007eabaf91392", cAlternateFileName="69F928~1")) returned 0 [0135.475] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0135.475] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9e72e9a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b1bd92a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b1bd92a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75612e6c, dwReserved1=0x612e0078, cFileName="Microsoft.Mf49f6405#", cAlternateFileName="MICROS~1.MF4")) returned 1 [0135.475] lstrcmpA (lpString1=".", lpString2="Microsoft.Mf49f6405#") returned -1 [0135.475] lstrcmpA (lpString1="..", lpString2="Microsoft.Mf49f6405#") returned -1 [0135.475] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.475] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Mf49f6405#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#" [0135.475] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9e72e9a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b1bd92a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b1bd92a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0135.475] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.475] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9e72e9a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b1bd92a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b1bd92a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.475] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.475] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.475] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1ba1fc, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe1ba1fc, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe1ba1fc, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ab35ed89eef5f69e5cb99109ba93d77", cAlternateFileName="2AB35E~1")) returned 1 [0135.475] lstrcmpA (lpString1=".", lpString2="2ab35ed89eef5f69e5cb99109ba93d77") returned -1 [0135.475] lstrcmpA (lpString1="..", lpString2="2ab35ed89eef5f69e5cb99109ba93d77") returned -1 [0135.476] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\*.*") returned="*.*" [0135.476] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\", lpString2="2ab35ed89eef5f69e5cb99109ba93d77" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77" [0135.476] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1ba1fc, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe1ba1fc, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe1ba1fc, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0135.478] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.478] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1ba1fc, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe1ba1fc, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe1ba1fc, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.478] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.478] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.478] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe1ba1fc, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe1ba1fc, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe1e0456, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x99000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Management.Infrastructure.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.478] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.478] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Management.Infrastructure.ni.dll") returned -1 [0135.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Management.Infrastructure.ni.dll") returned -1 [0135.478] lstrcmpiA (lpString1="", lpString2="Microsoft.Management.Infrastructure.ni.dll") returned -1 [0135.478] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\*.*") returned="*.*" [0135.478] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\" [0135.478] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\") returned="" [0135.478] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\HOW TO DECRYPT FILES.txt" [0135.478] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\how to decrypt files.txt")) returned 0xffffffff [0135.478] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.479] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.480] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.480] CloseHandle (hObject=0x214) returned 1 [0135.480] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\", lpString2="Microsoft.Management.Infrastructure.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll" [0135.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.zip") returned 0 [0135.480] lstrlenA (lpString="*.zip") returned 5 [0135.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.rar") returned 0 [0135.480] lstrlenA (lpString="*.rar") returned 5 [0135.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.7z") returned 0 [0135.480] lstrlenA (lpString="*.7z") returned 4 [0135.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.tar") returned 0 [0135.480] lstrlenA (lpString="*.tar") returned 5 [0135.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.gzip") returned 0 [0135.481] lstrlenA (lpString="*.gzip") returned 6 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.jpg") returned 0 [0135.481] lstrlenA (lpString="*.jpg") returned 5 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.jpeg") returned 0 [0135.481] lstrlenA (lpString="*.jpeg") returned 6 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.psd") returned 0 [0135.481] lstrlenA (lpString="*.psd") returned 5 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.cdr") returned 0 [0135.481] lstrlenA (lpString="*.cdr") returned 5 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.dwg") returned 0 [0135.481] lstrlenA (lpString="*.dwg") returned 5 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.max") returned 0 [0135.481] lstrlenA (lpString="*.max") returned 5 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.bmp") returned 0 [0135.481] lstrlenA (lpString="*.bmp") returned 5 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.gif") returned 0 [0135.481] lstrlenA (lpString="*.gif") returned 5 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.png") returned 0 [0135.481] lstrlenA (lpString="*.png") returned 5 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.doc") returned 0 [0135.481] lstrlenA (lpString="*.doc") returned 5 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.docx") returned 0 [0135.481] lstrlenA (lpString="*.docx") returned 6 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.xls") returned 0 [0135.481] lstrlenA (lpString="*.xls") returned 5 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.xlsx") returned 0 [0135.481] lstrlenA (lpString="*.xlsx") returned 6 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.ppt") returned 0 [0135.481] lstrlenA (lpString="*.ppt") returned 5 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.pptx") returned 0 [0135.481] lstrlenA (lpString="*.pptx") returned 6 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.txt") returned 0 [0135.481] lstrlenA (lpString="*.txt") returned 5 [0135.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.pdf") returned 0 [0135.481] lstrlenA (lpString="*.pdf") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.djvu") returned 0 [0135.482] lstrlenA (lpString="*.djvu") returned 6 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.htm") returned 0 [0135.482] lstrlenA (lpString="*.htm") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.html") returned 0 [0135.482] lstrlenA (lpString="*.html") returned 6 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.mdb") returned 0 [0135.482] lstrlenA (lpString="*.mdb") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.cer") returned 0 [0135.482] lstrlenA (lpString="*.cer") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.p12") returned 0 [0135.482] lstrlenA (lpString="*.p12") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.pfx") returned 0 [0135.482] lstrlenA (lpString="*.pfx") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.kwm") returned 0 [0135.482] lstrlenA (lpString="*.kwm") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.pwm") returned 0 [0135.482] lstrlenA (lpString="*.pwm") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.1cd") returned 0 [0135.482] lstrlenA (lpString="*.1cd") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.md") returned 0 [0135.482] lstrlenA (lpString="*.md") returned 4 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.mdf") returned 0 [0135.482] lstrlenA (lpString="*.mdf") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.dbf") returned 0 [0135.482] lstrlenA (lpString="*.dbf") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.odt") returned 0 [0135.482] lstrlenA (lpString="*.odt") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.vob") returned 0 [0135.482] lstrlenA (lpString="*.vob") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.ifo") returned 0 [0135.482] lstrlenA (lpString="*.ifo") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.lnk") returned 0 [0135.482] lstrlenA (lpString="*.lnk") returned 5 [0135.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.torrent") returned 0 [0135.483] lstrlenA (lpString="*.torrent") returned 9 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.mov") returned 0 [0135.483] lstrlenA (lpString="*.mov") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.m2v") returned 0 [0135.483] lstrlenA (lpString="*.m2v") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.3gp") returned 0 [0135.483] lstrlenA (lpString="*.3gp") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.mpeg") returned 0 [0135.483] lstrlenA (lpString="*.mpeg") returned 6 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.mpg") returned 0 [0135.483] lstrlenA (lpString="*.mpg") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.flv") returned 0 [0135.483] lstrlenA (lpString="*.flv") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.avi") returned 0 [0135.483] lstrlenA (lpString="*.avi") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.mp4") returned 0 [0135.483] lstrlenA (lpString="*.mp4") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.wmv") returned 0 [0135.483] lstrlenA (lpString="*.wmv") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.divx") returned 0 [0135.483] lstrlenA (lpString="*.divx") returned 6 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.mkv") returned 0 [0135.483] lstrlenA (lpString="*.mkv") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.mp3") returned 0 [0135.483] lstrlenA (lpString="*.mp3") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.wav") returned 0 [0135.483] lstrlenA (lpString="*.wav") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.flac") returned 0 [0135.483] lstrlenA (lpString="*.flac") returned 6 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.ape") returned 0 [0135.483] lstrlenA (lpString="*.ape") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.wma") returned 0 [0135.483] lstrlenA (lpString="*.wma") returned 5 [0135.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.ac3") returned 0 [0135.483] lstrlenA (lpString="*.ac3") returned 5 [0135.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll", pszSpec="*.doc") returned 0 [0135.484] lstrlenA (lpString="*.doc") returned 5 [0135.484] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe1ba1fc, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe1ba1fc, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe1ba1fc, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Management.Infrastructure.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.484] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.484] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Management.Infrastructure.ni.dll.aux") returned -1 [0135.484] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Management.Infrastructure.ni.dll.aux") returned -1 [0135.484] lstrcmpiA (lpString1="", lpString2="Microsoft.Management.Infrastructure.ni.dll.aux") returned -1 [0135.484] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll") returned="Microsoft.Management.Infrastructure.ni.dll" [0135.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\" [0135.484] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\") returned="" [0135.484] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\HOW TO DECRYPT FILES.txt" [0135.484] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\how to decrypt files.txt")) returned 0x20 [0135.484] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\", lpString2="Microsoft.Management.Infrastructure.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux" [0135.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.484] lstrlenA (lpString="*.zip") returned 5 [0135.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.484] lstrlenA (lpString="*.rar") returned 5 [0135.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.484] lstrlenA (lpString="*.7z") returned 4 [0135.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.484] lstrlenA (lpString="*.tar") returned 5 [0135.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.484] lstrlenA (lpString="*.gzip") returned 6 [0135.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.484] lstrlenA (lpString="*.jpg") returned 5 [0135.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.484] lstrlenA (lpString="*.jpeg") returned 6 [0135.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.484] lstrlenA (lpString="*.psd") returned 5 [0135.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.484] lstrlenA (lpString="*.cdr") returned 5 [0135.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.485] lstrlenA (lpString="*.dwg") returned 5 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.max") returned 0 [0135.485] lstrlenA (lpString="*.max") returned 5 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.485] lstrlenA (lpString="*.bmp") returned 5 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.485] lstrlenA (lpString="*.gif") returned 5 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.png") returned 0 [0135.485] lstrlenA (lpString="*.png") returned 5 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.485] lstrlenA (lpString="*.doc") returned 5 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.485] lstrlenA (lpString="*.docx") returned 6 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.485] lstrlenA (lpString="*.xls") returned 5 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.485] lstrlenA (lpString="*.xlsx") returned 6 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.485] lstrlenA (lpString="*.ppt") returned 5 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.485] lstrlenA (lpString="*.pptx") returned 6 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.485] lstrlenA (lpString="*.txt") returned 5 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.485] lstrlenA (lpString="*.pdf") returned 5 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.485] lstrlenA (lpString="*.djvu") returned 6 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.485] lstrlenA (lpString="*.htm") returned 5 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.html") returned 0 [0135.485] lstrlenA (lpString="*.html") returned 6 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.485] lstrlenA (lpString="*.mdb") returned 5 [0135.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.485] lstrlenA (lpString="*.cer") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.486] lstrlenA (lpString="*.p12") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.486] lstrlenA (lpString="*.pfx") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.486] lstrlenA (lpString="*.kwm") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.486] lstrlenA (lpString="*.pwm") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.486] lstrlenA (lpString="*.1cd") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.md") returned 0 [0135.486] lstrlenA (lpString="*.md") returned 4 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.486] lstrlenA (lpString="*.mdf") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.486] lstrlenA (lpString="*.dbf") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.486] lstrlenA (lpString="*.odt") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.486] lstrlenA (lpString="*.vob") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.486] lstrlenA (lpString="*.ifo") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.486] lstrlenA (lpString="*.lnk") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.486] lstrlenA (lpString="*.torrent") returned 9 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.486] lstrlenA (lpString="*.mov") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.486] lstrlenA (lpString="*.m2v") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.486] lstrlenA (lpString="*.3gp") returned 5 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.486] lstrlenA (lpString="*.mpeg") returned 6 [0135.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.487] lstrlenA (lpString="*.mpg") returned 5 [0135.487] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.487] lstrlenA (lpString="*.flv") returned 5 [0135.487] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.487] lstrlenA (lpString="*.avi") returned 5 [0135.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.489] lstrlenA (lpString="*.mp4") returned 5 [0135.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.489] lstrlenA (lpString="*.wmv") returned 5 [0135.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.489] lstrlenA (lpString="*.divx") returned 6 [0135.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.489] lstrlenA (lpString="*.mkv") returned 5 [0135.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.489] lstrlenA (lpString="*.mp3") returned 5 [0135.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.489] lstrlenA (lpString="*.wav") returned 5 [0135.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.489] lstrlenA (lpString="*.flac") returned 6 [0135.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.489] lstrlenA (lpString="*.ape") returned 5 [0135.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.489] lstrlenA (lpString="*.wma") returned 5 [0135.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.489] lstrlenA (lpString="*.ac3") returned 5 [0135.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\2ab35ed89eef5f69e5cb99109ba93d77\\Microsoft.Management.Infrastructure.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.489] lstrlenA (lpString="*.doc") returned 5 [0135.489] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe1ba1fc, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe1ba1fc, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe1ba1fc, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Management.Infrastructure.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.490] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0135.490] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1ba1fc, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfe1ba1fc, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfe1ba1fc, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ab35ed89eef5f69e5cb99109ba93d77", cAlternateFileName="2AB35E~1")) returned 0 [0135.490] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0135.490] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb92f9926, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b22ffd6, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b22ffd6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75612e6c, dwReserved1=0x612e0078, cFileName="Microsoft.Mf5ac9168#", cAlternateFileName="MICROS~1.MF5")) returned 1 [0135.490] lstrcmpA (lpString1=".", lpString2="Microsoft.Mf5ac9168#") returned -1 [0135.490] lstrcmpA (lpString1="..", lpString2="Microsoft.Mf5ac9168#") returned -1 [0135.491] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.491] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Mf5ac9168#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#" [0135.491] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#") returned 67 [0135.491] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb92f9926, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b22ffd6, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b22ffd6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0135.491] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.491] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb92f9926, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b22ffd6, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b22ffd6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.491] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.491] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.491] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25779b65, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x25779b65, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x25779b65, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c27d5dc09f3803c49e0e9d9b7e0817cd", cAlternateFileName="C27D5D~1")) returned 1 [0135.492] lstrcmpA (lpString1=".", lpString2="c27d5dc09f3803c49e0e9d9b7e0817cd") returned -1 [0135.492] lstrcmpA (lpString1="..", lpString2="c27d5dc09f3803c49e0e9d9b7e0817cd") returned -1 [0135.492] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\*.*") returned="*.*" [0135.492] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\", lpString2="c27d5dc09f3803c49e0e9d9b7e0817cd" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd" [0135.492] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd") returned 100 [0135.492] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25779b65, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x25779b65, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x25779b65, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0135.494] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.494] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25779b65, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x25779b65, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x25779b65, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.494] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.494] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.494] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2572d70e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2572d70e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x25779b65, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x86000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.494] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.494] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Management.Infrastructure.CimCmdlets.ni.dll") returned -1 [0135.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Management.Infrastructure.CimCmdlets.ni.dll") returned -1 [0135.494] lstrcmpiA (lpString1="", lpString2="Microsoft.Management.Infrastructure.CimCmdlets.ni.dll") returned -1 [0135.494] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\*.*") returned="*.*" [0135.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\" [0135.494] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\") returned="" [0135.494] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\HOW TO DECRYPT FILES.txt" [0135.494] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\how to decrypt files.txt")) returned 0xffffffff [0135.494] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.495] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.496] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.496] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.497] CloseHandle (hObject=0x214) returned 1 [0135.497] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\", lpString2="Microsoft.Management.Infrastructure.CimCmdlets.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll" [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.zip") returned 0 [0135.497] lstrlenA (lpString="*.zip") returned 5 [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.rar") returned 0 [0135.497] lstrlenA (lpString="*.rar") returned 5 [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.7z") returned 0 [0135.497] lstrlenA (lpString="*.7z") returned 4 [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.tar") returned 0 [0135.497] lstrlenA (lpString="*.tar") returned 5 [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.gzip") returned 0 [0135.497] lstrlenA (lpString="*.gzip") returned 6 [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.jpg") returned 0 [0135.497] lstrlenA (lpString="*.jpg") returned 5 [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.jpeg") returned 0 [0135.497] lstrlenA (lpString="*.jpeg") returned 6 [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.psd") returned 0 [0135.497] lstrlenA (lpString="*.psd") returned 5 [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.cdr") returned 0 [0135.497] lstrlenA (lpString="*.cdr") returned 5 [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.dwg") returned 0 [0135.497] lstrlenA (lpString="*.dwg") returned 5 [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.max") returned 0 [0135.497] lstrlenA (lpString="*.max") returned 5 [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.bmp") returned 0 [0135.497] lstrlenA (lpString="*.bmp") returned 5 [0135.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.gif") returned 0 [0135.497] lstrlenA (lpString="*.gif") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.png") returned 0 [0135.498] lstrlenA (lpString="*.png") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.doc") returned 0 [0135.498] lstrlenA (lpString="*.doc") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.docx") returned 0 [0135.498] lstrlenA (lpString="*.docx") returned 6 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.xls") returned 0 [0135.498] lstrlenA (lpString="*.xls") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.xlsx") returned 0 [0135.498] lstrlenA (lpString="*.xlsx") returned 6 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.ppt") returned 0 [0135.498] lstrlenA (lpString="*.ppt") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.pptx") returned 0 [0135.498] lstrlenA (lpString="*.pptx") returned 6 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.txt") returned 0 [0135.498] lstrlenA (lpString="*.txt") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.pdf") returned 0 [0135.498] lstrlenA (lpString="*.pdf") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.djvu") returned 0 [0135.498] lstrlenA (lpString="*.djvu") returned 6 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.htm") returned 0 [0135.498] lstrlenA (lpString="*.htm") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.html") returned 0 [0135.498] lstrlenA (lpString="*.html") returned 6 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.mdb") returned 0 [0135.498] lstrlenA (lpString="*.mdb") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.cer") returned 0 [0135.498] lstrlenA (lpString="*.cer") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.p12") returned 0 [0135.498] lstrlenA (lpString="*.p12") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.pfx") returned 0 [0135.498] lstrlenA (lpString="*.pfx") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.kwm") returned 0 [0135.498] lstrlenA (lpString="*.kwm") returned 5 [0135.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.pwm") returned 0 [0135.499] lstrlenA (lpString="*.pwm") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.1cd") returned 0 [0135.499] lstrlenA (lpString="*.1cd") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.md") returned 0 [0135.499] lstrlenA (lpString="*.md") returned 4 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.mdf") returned 0 [0135.499] lstrlenA (lpString="*.mdf") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.dbf") returned 0 [0135.499] lstrlenA (lpString="*.dbf") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.odt") returned 0 [0135.499] lstrlenA (lpString="*.odt") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.vob") returned 0 [0135.499] lstrlenA (lpString="*.vob") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.ifo") returned 0 [0135.499] lstrlenA (lpString="*.ifo") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.lnk") returned 0 [0135.499] lstrlenA (lpString="*.lnk") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.torrent") returned 0 [0135.499] lstrlenA (lpString="*.torrent") returned 9 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.mov") returned 0 [0135.499] lstrlenA (lpString="*.mov") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.m2v") returned 0 [0135.499] lstrlenA (lpString="*.m2v") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.3gp") returned 0 [0135.499] lstrlenA (lpString="*.3gp") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.mpeg") returned 0 [0135.499] lstrlenA (lpString="*.mpeg") returned 6 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.mpg") returned 0 [0135.499] lstrlenA (lpString="*.mpg") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.flv") returned 0 [0135.499] lstrlenA (lpString="*.flv") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.avi") returned 0 [0135.499] lstrlenA (lpString="*.avi") returned 5 [0135.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.mp4") returned 0 [0135.499] lstrlenA (lpString="*.mp4") returned 5 [0135.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.wmv") returned 0 [0135.500] lstrlenA (lpString="*.wmv") returned 5 [0135.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.divx") returned 0 [0135.500] lstrlenA (lpString="*.divx") returned 6 [0135.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.mkv") returned 0 [0135.500] lstrlenA (lpString="*.mkv") returned 5 [0135.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.mp3") returned 0 [0135.500] lstrlenA (lpString="*.mp3") returned 5 [0135.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.wav") returned 0 [0135.500] lstrlenA (lpString="*.wav") returned 5 [0135.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.flac") returned 0 [0135.500] lstrlenA (lpString="*.flac") returned 6 [0135.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.ape") returned 0 [0135.500] lstrlenA (lpString="*.ape") returned 5 [0135.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.wma") returned 0 [0135.500] lstrlenA (lpString="*.wma") returned 5 [0135.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.ac3") returned 0 [0135.500] lstrlenA (lpString="*.ac3") returned 5 [0135.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll", pszSpec="*.doc") returned 0 [0135.500] lstrlenA (lpString="*.doc") returned 5 [0135.500] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25779b65, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x25779b65, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x25779b65, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.500] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.500] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux") returned -1 [0135.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux") returned -1 [0135.500] lstrcmpiA (lpString1="", lpString2="Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux") returned -1 [0135.500] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll") returned="Microsoft.Management.Infrastructure.CimCmdlets.ni.dll" [0135.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\" [0135.500] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\") returned="" [0135.500] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\HOW TO DECRYPT FILES.txt" [0135.500] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\how to decrypt files.txt")) returned 0x20 [0135.500] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\", lpString2="Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux" [0135.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.501] lstrlenA (lpString="*.zip") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.501] lstrlenA (lpString="*.rar") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.501] lstrlenA (lpString="*.7z") returned 4 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.501] lstrlenA (lpString="*.tar") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.501] lstrlenA (lpString="*.gzip") returned 6 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.501] lstrlenA (lpString="*.jpg") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.501] lstrlenA (lpString="*.jpeg") returned 6 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.501] lstrlenA (lpString="*.psd") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.501] lstrlenA (lpString="*.cdr") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.501] lstrlenA (lpString="*.dwg") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.max") returned 0 [0135.501] lstrlenA (lpString="*.max") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.501] lstrlenA (lpString="*.bmp") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.501] lstrlenA (lpString="*.gif") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.png") returned 0 [0135.501] lstrlenA (lpString="*.png") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.501] lstrlenA (lpString="*.doc") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.501] lstrlenA (lpString="*.docx") returned 6 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.501] lstrlenA (lpString="*.xls") returned 5 [0135.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.501] lstrlenA (lpString="*.xlsx") returned 6 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.502] lstrlenA (lpString="*.ppt") returned 5 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.502] lstrlenA (lpString="*.pptx") returned 6 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.502] lstrlenA (lpString="*.txt") returned 5 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.502] lstrlenA (lpString="*.pdf") returned 5 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.502] lstrlenA (lpString="*.djvu") returned 6 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.502] lstrlenA (lpString="*.htm") returned 5 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.html") returned 0 [0135.502] lstrlenA (lpString="*.html") returned 6 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.502] lstrlenA (lpString="*.mdb") returned 5 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.502] lstrlenA (lpString="*.cer") returned 5 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.502] lstrlenA (lpString="*.p12") returned 5 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.502] lstrlenA (lpString="*.pfx") returned 5 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.502] lstrlenA (lpString="*.kwm") returned 5 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.502] lstrlenA (lpString="*.pwm") returned 5 [0135.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.528] lstrlenA (lpString="*.1cd") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.md") returned 0 [0135.528] lstrlenA (lpString="*.md") returned 4 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.528] lstrlenA (lpString="*.mdf") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.528] lstrlenA (lpString="*.dbf") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.528] lstrlenA (lpString="*.odt") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.528] lstrlenA (lpString="*.vob") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.528] lstrlenA (lpString="*.ifo") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.528] lstrlenA (lpString="*.lnk") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.528] lstrlenA (lpString="*.torrent") returned 9 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.528] lstrlenA (lpString="*.mov") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.528] lstrlenA (lpString="*.m2v") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.528] lstrlenA (lpString="*.3gp") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.528] lstrlenA (lpString="*.mpeg") returned 6 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.528] lstrlenA (lpString="*.mpg") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.528] lstrlenA (lpString="*.flv") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.528] lstrlenA (lpString="*.avi") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.528] lstrlenA (lpString="*.mp4") returned 5 [0135.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.528] lstrlenA (lpString="*.wmv") returned 5 [0135.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.529] lstrlenA (lpString="*.divx") returned 6 [0135.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.529] lstrlenA (lpString="*.mkv") returned 5 [0135.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.529] lstrlenA (lpString="*.mp3") returned 5 [0135.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.529] lstrlenA (lpString="*.wav") returned 5 [0135.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.529] lstrlenA (lpString="*.flac") returned 6 [0135.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.529] lstrlenA (lpString="*.ape") returned 5 [0135.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.529] lstrlenA (lpString="*.wma") returned 5 [0135.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.529] lstrlenA (lpString="*.ac3") returned 5 [0135.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf5ac9168#\\c27d5dc09f3803c49e0e9d9b7e0817cd\\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.529] lstrlenA (lpString="*.doc") returned 5 [0135.529] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25779b65, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x25779b65, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x25779b65, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.529] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0135.530] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25779b65, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x25779b65, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x25779b65, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c27d5dc09f3803c49e0e9d9b7e0817cd", cAlternateFileName="C27D5D~1")) returned 0 [0135.530] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0135.530] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8bf8a6a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b33aee7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b33aee7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e69, dwReserved1=0x75612e6c, cFileName="Microsoft.Mff1be75b#", cAlternateFileName="MICROS~1.MFF")) returned 1 [0135.530] lstrcmpA (lpString1=".", lpString2="Microsoft.Mff1be75b#") returned -1 [0135.530] lstrcmpA (lpString1="..", lpString2="Microsoft.Mff1be75b#") returned -1 [0135.530] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.530] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Mff1be75b#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#" [0135.530] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#") returned 67 [0135.530] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8bf8a6a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b33aee7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b33aee7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0135.531] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.531] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8bf8a6a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b33aee7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b33aee7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.531] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.531] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.531] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2633e6aa, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x263648c8, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x263648c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="845982d3af174e19a125dec06fcf2ef4", cAlternateFileName="845982~1")) returned 1 [0135.531] lstrcmpA (lpString1=".", lpString2="845982d3af174e19a125dec06fcf2ef4") returned -1 [0135.531] lstrcmpA (lpString1="..", lpString2="845982d3af174e19a125dec06fcf2ef4") returned -1 [0135.531] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\*.*") returned="*.*" [0135.531] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\", lpString2="845982d3af174e19a125dec06fcf2ef4" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4" [0135.531] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4") returned 100 [0135.531] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2633e6aa, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x263648c8, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x263648c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0135.533] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.533] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2633e6aa, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x263648c8, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x263648c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.533] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.533] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.533] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262f224f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x262f224f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x263648c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xb0000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.ManagementConsole.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.533] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.533] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.ManagementConsole.ni.dll") returned -1 [0135.533] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.ManagementConsole.ni.dll") returned -1 [0135.533] lstrcmpiA (lpString1="", lpString2="Microsoft.ManagementConsole.ni.dll") returned -1 [0135.533] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\*.*") returned="*.*" [0135.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\" [0135.533] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\") returned="" [0135.533] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\HOW TO DECRYPT FILES.txt" [0135.533] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\how to decrypt files.txt")) returned 0xffffffff [0135.536] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.537] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.537] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.538] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.538] CloseHandle (hObject=0x214) returned 1 [0135.538] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\", lpString2="Microsoft.ManagementConsole.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll" [0135.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.zip") returned 0 [0135.538] lstrlenA (lpString="*.zip") returned 5 [0135.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.rar") returned 0 [0135.538] lstrlenA (lpString="*.rar") returned 5 [0135.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.7z") returned 0 [0135.538] lstrlenA (lpString="*.7z") returned 4 [0135.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.tar") returned 0 [0135.538] lstrlenA (lpString="*.tar") returned 5 [0135.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.gzip") returned 0 [0135.538] lstrlenA (lpString="*.gzip") returned 6 [0135.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.jpg") returned 0 [0135.538] lstrlenA (lpString="*.jpg") returned 5 [0135.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.jpeg") returned 0 [0135.538] lstrlenA (lpString="*.jpeg") returned 6 [0135.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.psd") returned 0 [0135.538] lstrlenA (lpString="*.psd") returned 5 [0135.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.cdr") returned 0 [0135.538] lstrlenA (lpString="*.cdr") returned 5 [0135.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.dwg") returned 0 [0135.538] lstrlenA (lpString="*.dwg") returned 5 [0135.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.max") returned 0 [0135.538] lstrlenA (lpString="*.max") returned 5 [0135.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.bmp") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.gif") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.png") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.doc") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.docx") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.xls") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.xlsx") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.ppt") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.pptx") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.txt") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.pdf") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.djvu") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.htm") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.html") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mdb") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.cer") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.p12") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.pfx") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.kwm") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.pwm") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.1cd") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.md") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mdf") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.dbf") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.odt") returned 0 [0135.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.vob") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.ifo") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.lnk") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.torrent") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mov") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.m2v") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.3gp") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mpeg") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mpg") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.flv") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.avi") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mp4") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.wmv") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.divx") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mkv") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mp3") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.wav") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.flac") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.ape") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.wma") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.ac3") returned 0 [0135.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.doc") returned 0 [0135.540] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263648c8, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x263648c8, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x263648c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x6f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ManagementConsole.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.540] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.540] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.ManagementConsole.ni.dll.aux") returned -1 [0135.540] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.ManagementConsole.ni.dll.aux") returned -1 [0135.540] lstrcmpiA (lpString1="", lpString2="Microsoft.ManagementConsole.ni.dll.aux") returned -1 [0135.541] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll") returned="Microsoft.ManagementConsole.ni.dll" [0135.541] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\" [0135.541] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\") returned="" [0135.541] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\HOW TO DECRYPT FILES.txt" [0135.541] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\how to decrypt files.txt")) returned 0x20 [0135.541] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\", lpString2="Microsoft.ManagementConsole.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux" [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.max") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.png") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.html") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.md") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mff1be75b#\\845982d3af174e19a125dec06fcf2ef4\\Microsoft.ManagementConsole.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.543] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263648c8, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x263648c8, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x263648c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x6f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ManagementConsole.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.543] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0135.543] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2633e6aa, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x263648c8, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x263648c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="845982d3af174e19a125dec06fcf2ef4", cAlternateFileName="845982~1")) returned 0 [0135.544] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0135.544] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b0428a0, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2b0428a0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2b0428a0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e69, dwReserved1=0x75612e6c, cFileName="Microsoft.O2eb0cc9a#", cAlternateFileName="MICROS~1.O2E")) returned 1 [0135.544] lstrcmpA (lpString1=".", lpString2="Microsoft.O2eb0cc9a#") returned -1 [0135.544] lstrcmpA (lpString1="..", lpString2="Microsoft.O2eb0cc9a#") returned -1 [0135.544] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.544] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.O2eb0cc9a#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#" [0135.544] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b0428a0, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2b0428a0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2b0428a0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0135.545] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.545] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b0428a0, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2b0428a0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2b0428a0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.545] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.545] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.545] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b0428a0, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2b0428a0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2b0428a0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bf2d77e4f2dad34d7e2977aa7f092d96", cAlternateFileName="BF2D77~1")) returned 1 [0135.545] lstrcmpA (lpString1=".", lpString2="bf2d77e4f2dad34d7e2977aa7f092d96") returned -1 [0135.545] lstrcmpA (lpString1="..", lpString2="bf2d77e4f2dad34d7e2977aa7f092d96") returned -1 [0135.545] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\*.*") returned="*.*" [0135.545] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\", lpString2="bf2d77e4f2dad34d7e2977aa7f092d96" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96" [0135.545] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b0428a0, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2b0428a0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2b0428a0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0135.548] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.548] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b0428a0, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2b0428a0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2b0428a0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.548] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.548] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.548] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0428a0, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2b0428a0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2b0428a0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Office.Tools.v4.0.Framework.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.548] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.548] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll") returned -1 [0135.548] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll") returned -1 [0135.548] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll") returned -1 [0135.548] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\*.*") returned="*.*" [0135.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\" [0135.548] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\") returned="" [0135.548] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\HOW TO DECRYPT FILES.txt" [0135.549] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\how to decrypt files.txt")) returned 0xffffffff [0135.549] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.552] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.553] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.553] CloseHandle (hObject=0x214) returned 1 [0135.553] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll" [0135.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.zip") returned 0 [0135.553] lstrlenA (lpString="*.zip") returned 5 [0135.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.rar") returned 0 [0135.553] lstrlenA (lpString="*.rar") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.7z") returned 0 [0135.554] lstrlenA (lpString="*.7z") returned 4 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.tar") returned 0 [0135.554] lstrlenA (lpString="*.tar") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.gzip") returned 0 [0135.554] lstrlenA (lpString="*.gzip") returned 6 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.jpg") returned 0 [0135.554] lstrlenA (lpString="*.jpg") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.jpeg") returned 0 [0135.554] lstrlenA (lpString="*.jpeg") returned 6 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.psd") returned 0 [0135.554] lstrlenA (lpString="*.psd") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.cdr") returned 0 [0135.554] lstrlenA (lpString="*.cdr") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.dwg") returned 0 [0135.554] lstrlenA (lpString="*.dwg") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.max") returned 0 [0135.554] lstrlenA (lpString="*.max") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.bmp") returned 0 [0135.554] lstrlenA (lpString="*.bmp") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.gif") returned 0 [0135.554] lstrlenA (lpString="*.gif") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.png") returned 0 [0135.554] lstrlenA (lpString="*.png") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.doc") returned 0 [0135.554] lstrlenA (lpString="*.doc") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.docx") returned 0 [0135.554] lstrlenA (lpString="*.docx") returned 6 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.xls") returned 0 [0135.554] lstrlenA (lpString="*.xls") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.xlsx") returned 0 [0135.554] lstrlenA (lpString="*.xlsx") returned 6 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.ppt") returned 0 [0135.554] lstrlenA (lpString="*.ppt") returned 5 [0135.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.pptx") returned 0 [0135.554] lstrlenA (lpString="*.pptx") returned 6 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.txt") returned 0 [0135.555] lstrlenA (lpString="*.txt") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.pdf") returned 0 [0135.555] lstrlenA (lpString="*.pdf") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.djvu") returned 0 [0135.555] lstrlenA (lpString="*.djvu") returned 6 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.htm") returned 0 [0135.555] lstrlenA (lpString="*.htm") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.html") returned 0 [0135.555] lstrlenA (lpString="*.html") returned 6 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.mdb") returned 0 [0135.555] lstrlenA (lpString="*.mdb") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.cer") returned 0 [0135.555] lstrlenA (lpString="*.cer") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.p12") returned 0 [0135.555] lstrlenA (lpString="*.p12") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.pfx") returned 0 [0135.555] lstrlenA (lpString="*.pfx") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.kwm") returned 0 [0135.555] lstrlenA (lpString="*.kwm") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.pwm") returned 0 [0135.555] lstrlenA (lpString="*.pwm") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.1cd") returned 0 [0135.555] lstrlenA (lpString="*.1cd") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.md") returned 0 [0135.555] lstrlenA (lpString="*.md") returned 4 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.mdf") returned 0 [0135.555] lstrlenA (lpString="*.mdf") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.dbf") returned 0 [0135.555] lstrlenA (lpString="*.dbf") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.odt") returned 0 [0135.555] lstrlenA (lpString="*.odt") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.vob") returned 0 [0135.555] lstrlenA (lpString="*.vob") returned 5 [0135.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.ifo") returned 0 [0135.556] lstrlenA (lpString="*.ifo") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.lnk") returned 0 [0135.556] lstrlenA (lpString="*.lnk") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.torrent") returned 0 [0135.556] lstrlenA (lpString="*.torrent") returned 9 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.mov") returned 0 [0135.556] lstrlenA (lpString="*.mov") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.m2v") returned 0 [0135.556] lstrlenA (lpString="*.m2v") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.3gp") returned 0 [0135.556] lstrlenA (lpString="*.3gp") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.mpeg") returned 0 [0135.556] lstrlenA (lpString="*.mpeg") returned 6 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.mpg") returned 0 [0135.556] lstrlenA (lpString="*.mpg") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.flv") returned 0 [0135.556] lstrlenA (lpString="*.flv") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.avi") returned 0 [0135.556] lstrlenA (lpString="*.avi") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.mp4") returned 0 [0135.556] lstrlenA (lpString="*.mp4") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.wmv") returned 0 [0135.556] lstrlenA (lpString="*.wmv") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.divx") returned 0 [0135.556] lstrlenA (lpString="*.divx") returned 6 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.mkv") returned 0 [0135.556] lstrlenA (lpString="*.mkv") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.mp3") returned 0 [0135.556] lstrlenA (lpString="*.mp3") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.wav") returned 0 [0135.556] lstrlenA (lpString="*.wav") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.flac") returned 0 [0135.556] lstrlenA (lpString="*.flac") returned 6 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.ape") returned 0 [0135.556] lstrlenA (lpString="*.ape") returned 5 [0135.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.wma") returned 0 [0135.557] lstrlenA (lpString="*.wma") returned 5 [0135.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.ac3") returned 0 [0135.557] lstrlenA (lpString="*.ac3") returned 5 [0135.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll", pszSpec="*.doc") returned 0 [0135.557] lstrlenA (lpString="*.doc") returned 5 [0135.557] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0428a0, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2b0428a0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2b0428a0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.557] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.557] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux") returned -1 [0135.557] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux") returned -1 [0135.557] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux") returned -1 [0135.557] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll") returned="Microsoft.Office.Tools.v4.0.Framework.ni.dll" [0135.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\" [0135.557] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\") returned="" [0135.557] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\HOW TO DECRYPT FILES.txt" [0135.557] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\how to decrypt files.txt")) returned 0x20 [0135.557] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux" [0135.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.557] lstrlenA (lpString="*.zip") returned 5 [0135.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.557] lstrlenA (lpString="*.rar") returned 5 [0135.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.557] lstrlenA (lpString="*.7z") returned 4 [0135.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.557] lstrlenA (lpString="*.tar") returned 5 [0135.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.557] lstrlenA (lpString="*.gzip") returned 6 [0135.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.557] lstrlenA (lpString="*.jpg") returned 5 [0135.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.557] lstrlenA (lpString="*.jpeg") returned 6 [0135.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.558] lstrlenA (lpString="*.psd") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.558] lstrlenA (lpString="*.cdr") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.558] lstrlenA (lpString="*.dwg") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.max") returned 0 [0135.558] lstrlenA (lpString="*.max") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.558] lstrlenA (lpString="*.bmp") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.558] lstrlenA (lpString="*.gif") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.png") returned 0 [0135.558] lstrlenA (lpString="*.png") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.558] lstrlenA (lpString="*.doc") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.558] lstrlenA (lpString="*.docx") returned 6 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.558] lstrlenA (lpString="*.xls") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.558] lstrlenA (lpString="*.xlsx") returned 6 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.558] lstrlenA (lpString="*.ppt") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.558] lstrlenA (lpString="*.pptx") returned 6 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.558] lstrlenA (lpString="*.txt") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.558] lstrlenA (lpString="*.pdf") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.558] lstrlenA (lpString="*.djvu") returned 6 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.558] lstrlenA (lpString="*.htm") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.html") returned 0 [0135.558] lstrlenA (lpString="*.html") returned 6 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.559] lstrlenA (lpString="*.mdb") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.559] lstrlenA (lpString="*.cer") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.559] lstrlenA (lpString="*.p12") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.559] lstrlenA (lpString="*.pfx") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.559] lstrlenA (lpString="*.kwm") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.559] lstrlenA (lpString="*.pwm") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.559] lstrlenA (lpString="*.1cd") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.md") returned 0 [0135.559] lstrlenA (lpString="*.md") returned 4 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.559] lstrlenA (lpString="*.mdf") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.559] lstrlenA (lpString="*.dbf") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.559] lstrlenA (lpString="*.odt") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.559] lstrlenA (lpString="*.vob") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.559] lstrlenA (lpString="*.ifo") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.559] lstrlenA (lpString="*.lnk") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.559] lstrlenA (lpString="*.torrent") returned 9 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.559] lstrlenA (lpString="*.mov") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.559] lstrlenA (lpString="*.m2v") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.559] lstrlenA (lpString="*.3gp") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.560] lstrlenA (lpString="*.mpeg") returned 6 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.560] lstrlenA (lpString="*.mpg") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.560] lstrlenA (lpString="*.flv") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.560] lstrlenA (lpString="*.avi") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.560] lstrlenA (lpString="*.mp4") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.560] lstrlenA (lpString="*.wmv") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.560] lstrlenA (lpString="*.divx") returned 6 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.560] lstrlenA (lpString="*.mkv") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.560] lstrlenA (lpString="*.mp3") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.560] lstrlenA (lpString="*.wav") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.560] lstrlenA (lpString="*.flac") returned 6 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.560] lstrlenA (lpString="*.ape") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.560] lstrlenA (lpString="*.wma") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.560] lstrlenA (lpString="*.ac3") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\bf2d77e4f2dad34d7e2977aa7f092d96\\Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.560] lstrlenA (lpString="*.doc") returned 5 [0135.560] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0428a0, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2b0428a0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2b0428a0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.560] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0135.561] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b0428a0, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2b0428a0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2b0428a0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bf2d77e4f2dad34d7e2977aa7f092d96", cAlternateFileName="BF2D77~1")) returned 0 [0135.561] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0135.561] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2912033c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2912033c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2912033c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="Microsoft.O4161a3a3#", cAlternateFileName="MICROS~1.O41")) returned 1 [0135.635] lstrcmpA (lpString1=".", lpString2="Microsoft.O4161a3a3#") returned -1 [0135.635] lstrcmpA (lpString1="..", lpString2="Microsoft.O4161a3a3#") returned -1 [0135.635] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.635] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.O4161a3a3#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#" [0135.635] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#") returned 67 [0135.635] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2912033c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2912033c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2912033c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0135.636] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.636] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2912033c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2912033c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2912033c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.636] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.636] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.636] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2912033c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2912033c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2912033c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ccf0bd682a66ff4ad6800ae925007d0", cAlternateFileName="6CCF0B~1")) returned 1 [0135.636] lstrcmpA (lpString1=".", lpString2="6ccf0bd682a66ff4ad6800ae925007d0") returned -1 [0135.636] lstrcmpA (lpString1="..", lpString2="6ccf0bd682a66ff4ad6800ae925007d0") returned -1 [0135.636] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\*.*") returned="*.*" [0135.636] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\", lpString2="6ccf0bd682a66ff4ad6800ae925007d0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0" [0135.636] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0") returned 100 [0135.636] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2912033c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2912033c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2912033c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0135.638] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.638] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2912033c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2912033c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2912033c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.638] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.638] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.638] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29087ac7, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x29087ac7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x291465c4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xf2c00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Office.Tools.Excel.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.638] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.638] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Excel.ni.dll") returned -1 [0135.638] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Excel.ni.dll") returned -1 [0135.638] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Excel.ni.dll") returned -1 [0135.638] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\*.*") returned="*.*" [0135.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\" [0135.638] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\") returned="" [0135.638] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\HOW TO DECRYPT FILES.txt" [0135.639] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\how to decrypt files.txt")) returned 0xffffffff [0135.639] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.640] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.640] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.641] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.641] CloseHandle (hObject=0x214) returned 1 [0135.641] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\", lpString2="Microsoft.Office.Tools.Excel.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll" [0135.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.zip") returned 0 [0135.641] lstrlenA (lpString="*.zip") returned 5 [0135.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.rar") returned 0 [0135.641] lstrlenA (lpString="*.rar") returned 5 [0135.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.7z") returned 0 [0135.641] lstrlenA (lpString="*.7z") returned 4 [0135.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.tar") returned 0 [0135.641] lstrlenA (lpString="*.tar") returned 5 [0135.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.gzip") returned 0 [0135.641] lstrlenA (lpString="*.gzip") returned 6 [0135.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.jpg") returned 0 [0135.641] lstrlenA (lpString="*.jpg") returned 5 [0135.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.jpeg") returned 0 [0135.641] lstrlenA (lpString="*.jpeg") returned 6 [0135.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.psd") returned 0 [0135.641] lstrlenA (lpString="*.psd") returned 5 [0135.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.cdr") returned 0 [0135.641] lstrlenA (lpString="*.cdr") returned 5 [0135.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.dwg") returned 0 [0135.642] lstrlenA (lpString="*.dwg") returned 5 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.max") returned 0 [0135.642] lstrlenA (lpString="*.max") returned 5 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.bmp") returned 0 [0135.642] lstrlenA (lpString="*.bmp") returned 5 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.gif") returned 0 [0135.642] lstrlenA (lpString="*.gif") returned 5 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.png") returned 0 [0135.642] lstrlenA (lpString="*.png") returned 5 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.doc") returned 0 [0135.642] lstrlenA (lpString="*.doc") returned 5 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.docx") returned 0 [0135.642] lstrlenA (lpString="*.docx") returned 6 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.xls") returned 0 [0135.642] lstrlenA (lpString="*.xls") returned 5 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.xlsx") returned 0 [0135.642] lstrlenA (lpString="*.xlsx") returned 6 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.ppt") returned 0 [0135.642] lstrlenA (lpString="*.ppt") returned 5 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.pptx") returned 0 [0135.642] lstrlenA (lpString="*.pptx") returned 6 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.txt") returned 0 [0135.642] lstrlenA (lpString="*.txt") returned 5 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.pdf") returned 0 [0135.642] lstrlenA (lpString="*.pdf") returned 5 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.djvu") returned 0 [0135.642] lstrlenA (lpString="*.djvu") returned 6 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.htm") returned 0 [0135.642] lstrlenA (lpString="*.htm") returned 5 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.html") returned 0 [0135.642] lstrlenA (lpString="*.html") returned 6 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.mdb") returned 0 [0135.642] lstrlenA (lpString="*.mdb") returned 5 [0135.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.cer") returned 0 [0135.643] lstrlenA (lpString="*.cer") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.p12") returned 0 [0135.643] lstrlenA (lpString="*.p12") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.pfx") returned 0 [0135.643] lstrlenA (lpString="*.pfx") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.kwm") returned 0 [0135.643] lstrlenA (lpString="*.kwm") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.pwm") returned 0 [0135.643] lstrlenA (lpString="*.pwm") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.1cd") returned 0 [0135.643] lstrlenA (lpString="*.1cd") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.md") returned 0 [0135.643] lstrlenA (lpString="*.md") returned 4 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.mdf") returned 0 [0135.643] lstrlenA (lpString="*.mdf") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.dbf") returned 0 [0135.643] lstrlenA (lpString="*.dbf") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.odt") returned 0 [0135.643] lstrlenA (lpString="*.odt") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.vob") returned 0 [0135.643] lstrlenA (lpString="*.vob") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.ifo") returned 0 [0135.643] lstrlenA (lpString="*.ifo") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.lnk") returned 0 [0135.643] lstrlenA (lpString="*.lnk") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.torrent") returned 0 [0135.643] lstrlenA (lpString="*.torrent") returned 9 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.mov") returned 0 [0135.643] lstrlenA (lpString="*.mov") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.m2v") returned 0 [0135.643] lstrlenA (lpString="*.m2v") returned 5 [0135.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.3gp") returned 0 [0135.643] lstrlenA (lpString="*.3gp") returned 5 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.mpeg") returned 0 [0135.644] lstrlenA (lpString="*.mpeg") returned 6 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.mpg") returned 0 [0135.644] lstrlenA (lpString="*.mpg") returned 5 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.flv") returned 0 [0135.644] lstrlenA (lpString="*.flv") returned 5 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.avi") returned 0 [0135.644] lstrlenA (lpString="*.avi") returned 5 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.mp4") returned 0 [0135.644] lstrlenA (lpString="*.mp4") returned 5 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.wmv") returned 0 [0135.644] lstrlenA (lpString="*.wmv") returned 5 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.divx") returned 0 [0135.644] lstrlenA (lpString="*.divx") returned 6 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.mkv") returned 0 [0135.644] lstrlenA (lpString="*.mkv") returned 5 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.mp3") returned 0 [0135.644] lstrlenA (lpString="*.mp3") returned 5 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.wav") returned 0 [0135.644] lstrlenA (lpString="*.wav") returned 5 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.flac") returned 0 [0135.644] lstrlenA (lpString="*.flac") returned 6 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.ape") returned 0 [0135.644] lstrlenA (lpString="*.ape") returned 5 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.wma") returned 0 [0135.644] lstrlenA (lpString="*.wma") returned 5 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.ac3") returned 0 [0135.644] lstrlenA (lpString="*.ac3") returned 5 [0135.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll", pszSpec="*.doc") returned 0 [0135.644] lstrlenA (lpString="*.doc") returned 5 [0135.644] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2912033c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2912033c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2912033c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Excel.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.644] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.644] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Excel.ni.dll.aux") returned -1 [0135.644] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Excel.ni.dll.aux") returned -1 [0135.645] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Excel.ni.dll.aux") returned -1 [0135.645] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll") returned="Microsoft.Office.Tools.Excel.ni.dll" [0135.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\" [0135.645] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\") returned="" [0135.645] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\HOW TO DECRYPT FILES.txt" [0135.645] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\how to decrypt files.txt")) returned 0x20 [0135.645] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\", lpString2="Microsoft.Office.Tools.Excel.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux" [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.645] lstrlenA (lpString="*.zip") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.645] lstrlenA (lpString="*.rar") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.645] lstrlenA (lpString="*.7z") returned 4 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.645] lstrlenA (lpString="*.tar") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.645] lstrlenA (lpString="*.gzip") returned 6 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.645] lstrlenA (lpString="*.jpg") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.645] lstrlenA (lpString="*.jpeg") returned 6 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.645] lstrlenA (lpString="*.psd") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.645] lstrlenA (lpString="*.cdr") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.645] lstrlenA (lpString="*.dwg") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.max") returned 0 [0135.645] lstrlenA (lpString="*.max") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.645] lstrlenA (lpString="*.bmp") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.646] lstrlenA (lpString="*.gif") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.png") returned 0 [0135.646] lstrlenA (lpString="*.png") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.646] lstrlenA (lpString="*.doc") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.646] lstrlenA (lpString="*.docx") returned 6 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.646] lstrlenA (lpString="*.xls") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.646] lstrlenA (lpString="*.xlsx") returned 6 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.646] lstrlenA (lpString="*.ppt") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.646] lstrlenA (lpString="*.pptx") returned 6 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.646] lstrlenA (lpString="*.txt") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.646] lstrlenA (lpString="*.pdf") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.646] lstrlenA (lpString="*.djvu") returned 6 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.646] lstrlenA (lpString="*.htm") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.html") returned 0 [0135.646] lstrlenA (lpString="*.html") returned 6 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.646] lstrlenA (lpString="*.mdb") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.646] lstrlenA (lpString="*.cer") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.646] lstrlenA (lpString="*.p12") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.646] lstrlenA (lpString="*.pfx") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.647] lstrlenA (lpString="*.kwm") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.647] lstrlenA (lpString="*.pwm") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.647] lstrlenA (lpString="*.1cd") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.md") returned 0 [0135.647] lstrlenA (lpString="*.md") returned 4 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.647] lstrlenA (lpString="*.mdf") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.647] lstrlenA (lpString="*.dbf") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.647] lstrlenA (lpString="*.odt") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.647] lstrlenA (lpString="*.vob") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.647] lstrlenA (lpString="*.ifo") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.647] lstrlenA (lpString="*.lnk") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.647] lstrlenA (lpString="*.torrent") returned 9 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.647] lstrlenA (lpString="*.mov") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.647] lstrlenA (lpString="*.m2v") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.647] lstrlenA (lpString="*.3gp") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.647] lstrlenA (lpString="*.mpeg") returned 6 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.647] lstrlenA (lpString="*.mpg") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.647] lstrlenA (lpString="*.flv") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.648] lstrlenA (lpString="*.avi") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.648] lstrlenA (lpString="*.mp4") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.648] lstrlenA (lpString="*.wmv") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.648] lstrlenA (lpString="*.divx") returned 6 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.648] lstrlenA (lpString="*.mkv") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.648] lstrlenA (lpString="*.mp3") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.648] lstrlenA (lpString="*.wav") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.648] lstrlenA (lpString="*.flac") returned 6 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.648] lstrlenA (lpString="*.ape") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.648] lstrlenA (lpString="*.wma") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.648] lstrlenA (lpString="*.ac3") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\6ccf0bd682a66ff4ad6800ae925007d0\\Microsoft.Office.Tools.Excel.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.648] lstrlenA (lpString="*.doc") returned 5 [0135.648] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2912033c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2912033c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2912033c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Excel.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.648] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0135.649] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2912033c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2912033c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2912033c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ccf0bd682a66ff4ad6800ae925007d0", cAlternateFileName="6CCF0B~1")) returned 0 [0135.649] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0135.649] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2842a6d3, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x28450866, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x28450866, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="Microsoft.O4a946565#", cAlternateFileName="MICROS~1.O4A")) returned 1 [0135.649] lstrcmpA (lpString1=".", lpString2="Microsoft.O4a946565#") returned -1 [0135.649] lstrcmpA (lpString1="..", lpString2="Microsoft.O4a946565#") returned -1 [0135.649] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.649] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.O4a946565#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#" [0135.649] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#") returned 67 [0135.649] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2842a6d3, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x28450866, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x28450866, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0135.650] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.650] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2842a6d3, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x28450866, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x28450866, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.650] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.650] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.650] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28450866, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x28476a91, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x28476a91, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8e65a8619e17b02512e8e4027e946eb", cAlternateFileName="E8E65A~1")) returned 1 [0135.650] lstrcmpA (lpString1=".", lpString2="e8e65a8619e17b02512e8e4027e946eb") returned -1 [0135.650] lstrcmpA (lpString1="..", lpString2="e8e65a8619e17b02512e8e4027e946eb") returned -1 [0135.650] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\*.*") returned="*.*" [0135.650] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\", lpString2="e8e65a8619e17b02512e8e4027e946eb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb" [0135.650] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb") returned 100 [0135.650] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28450866, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x28476a91, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x28476a91, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0135.652] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.652] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28450866, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x28476a91, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x28476a91, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.652] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.652] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.652] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x283de1d5, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x283de1d5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x28476a91, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x101800, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Office.Tools.Common.Implementation.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.652] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.652] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll") returned -1 [0135.652] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll") returned -1 [0135.652] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll") returned -1 [0135.652] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\*.*") returned="*.*" [0135.652] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\" [0135.652] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\") returned="" [0135.652] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\HOW TO DECRYPT FILES.txt" [0135.652] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\how to decrypt files.txt")) returned 0xffffffff [0135.652] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.653] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.653] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.654] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.654] CloseHandle (hObject=0x214) returned 1 [0135.655] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll" [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.zip") returned 0 [0135.655] lstrlenA (lpString="*.zip") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.rar") returned 0 [0135.655] lstrlenA (lpString="*.rar") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.7z") returned 0 [0135.655] lstrlenA (lpString="*.7z") returned 4 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.tar") returned 0 [0135.655] lstrlenA (lpString="*.tar") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.gzip") returned 0 [0135.655] lstrlenA (lpString="*.gzip") returned 6 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.jpg") returned 0 [0135.655] lstrlenA (lpString="*.jpg") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.jpeg") returned 0 [0135.655] lstrlenA (lpString="*.jpeg") returned 6 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.psd") returned 0 [0135.655] lstrlenA (lpString="*.psd") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.cdr") returned 0 [0135.655] lstrlenA (lpString="*.cdr") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.dwg") returned 0 [0135.655] lstrlenA (lpString="*.dwg") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.max") returned 0 [0135.655] lstrlenA (lpString="*.max") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.bmp") returned 0 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.gif") returned 0 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.png") returned 0 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.doc") returned 0 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.docx") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.xls") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.xlsx") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.ppt") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.pptx") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.txt") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.pdf") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.djvu") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.htm") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.html") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.mdb") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.cer") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.p12") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.pfx") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.kwm") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.pwm") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.1cd") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.md") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.mdf") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.dbf") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.odt") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.vob") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.ifo") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.lnk") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.torrent") returned 0 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.mov") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.m2v") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.3gp") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.mpeg") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.mpg") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.flv") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.avi") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.mp4") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.wmv") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.divx") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.mkv") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.mp3") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.wav") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.flac") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.ape") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.wma") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.ac3") returned 0 [0135.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll", pszSpec="*.doc") returned 0 [0135.657] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28476a91, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x28476a91, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x28476a91, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.657] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll.aux") returned -1 [0135.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll.aux") returned -1 [0135.657] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll.aux") returned -1 [0135.657] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll") returned="Microsoft.Office.Tools.Common.Implementation.ni.dll" [0135.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\" [0135.657] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\") returned="" [0135.657] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\HOW TO DECRYPT FILES.txt" [0135.657] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\how to decrypt files.txt")) returned 0x20 [0135.658] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux" [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.max") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.png") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.html") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.md") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\e8e65a8619e17b02512e8e4027e946eb\\Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.661] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28476a91, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x28476a91, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x28476a91, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Common.Implementation.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.661] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0135.661] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28450866, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x28476a91, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x28476a91, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8e65a8619e17b02512e8e4027e946eb", cAlternateFileName="E8E65A~1")) returned 0 [0135.661] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0135.662] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ac3ce17, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2ac3ce17, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2ac3ce17, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6c6c64, dwReserved1=0x787561, cFileName="Microsoft.O4b20f4dd#", cAlternateFileName="MICROS~1.O4B")) returned 1 [0135.662] lstrcmpA (lpString1=".", lpString2="Microsoft.O4b20f4dd#") returned -1 [0135.662] lstrcmpA (lpString1="..", lpString2="Microsoft.O4b20f4dd#") returned -1 [0135.662] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.662] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.O4b20f4dd#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#" [0135.662] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ac3ce17, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2ac3ce17, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2ac3ce17, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0135.662] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.663] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ac3ce17, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2ac3ce17, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2ac3ce17, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.663] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.663] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.663] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ac3ce17, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2ac3ce17, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2ac3ce17, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4dbaa926e8194c7bc1c658b97c8dad4b", cAlternateFileName="4DBAA9~1")) returned 1 [0135.663] lstrcmpA (lpString1=".", lpString2="4dbaa926e8194c7bc1c658b97c8dad4b") returned -1 [0135.663] lstrcmpA (lpString1="..", lpString2="4dbaa926e8194c7bc1c658b97c8dad4b") returned -1 [0135.663] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\*.*") returned="*.*" [0135.663] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\", lpString2="4dbaa926e8194c7bc1c658b97c8dad4b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b" [0135.663] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ac3ce17, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2ac3ce17, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2ac3ce17, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0135.664] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.664] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ac3ce17, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2ac3ce17, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2ac3ce17, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.665] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.665] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.665] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ac3ce17, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2ac3ce17, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2ac3ce17, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x32400, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Office.Tools.Outlook.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.665] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.665] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Outlook.ni.dll") returned -1 [0135.665] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Outlook.ni.dll") returned -1 [0135.665] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Outlook.ni.dll") returned -1 [0135.665] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\*.*") returned="*.*" [0135.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\" [0135.665] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\") returned="" [0135.665] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\HOW TO DECRYPT FILES.txt" [0135.665] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\how to decrypt files.txt")) returned 0xffffffff [0135.665] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.666] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.667] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.667] CloseHandle (hObject=0x214) returned 1 [0135.667] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\", lpString2="Microsoft.Office.Tools.Outlook.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll" [0135.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.zip") returned 0 [0135.667] lstrlenA (lpString="*.zip") returned 5 [0135.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.rar") returned 0 [0135.667] lstrlenA (lpString="*.rar") returned 5 [0135.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.7z") returned 0 [0135.667] lstrlenA (lpString="*.7z") returned 4 [0135.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.tar") returned 0 [0135.667] lstrlenA (lpString="*.tar") returned 5 [0135.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.gzip") returned 0 [0135.667] lstrlenA (lpString="*.gzip") returned 6 [0135.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.jpg") returned 0 [0135.667] lstrlenA (lpString="*.jpg") returned 5 [0135.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.jpeg") returned 0 [0135.667] lstrlenA (lpString="*.jpeg") returned 6 [0135.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.psd") returned 0 [0135.667] lstrlenA (lpString="*.psd") returned 5 [0135.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.cdr") returned 0 [0135.667] lstrlenA (lpString="*.cdr") returned 5 [0135.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.dwg") returned 0 [0135.667] lstrlenA (lpString="*.dwg") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.max") returned 0 [0135.668] lstrlenA (lpString="*.max") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.bmp") returned 0 [0135.668] lstrlenA (lpString="*.bmp") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.gif") returned 0 [0135.668] lstrlenA (lpString="*.gif") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.png") returned 0 [0135.668] lstrlenA (lpString="*.png") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.doc") returned 0 [0135.668] lstrlenA (lpString="*.doc") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.docx") returned 0 [0135.668] lstrlenA (lpString="*.docx") returned 6 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.xls") returned 0 [0135.668] lstrlenA (lpString="*.xls") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.xlsx") returned 0 [0135.668] lstrlenA (lpString="*.xlsx") returned 6 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.ppt") returned 0 [0135.668] lstrlenA (lpString="*.ppt") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.pptx") returned 0 [0135.668] lstrlenA (lpString="*.pptx") returned 6 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.txt") returned 0 [0135.668] lstrlenA (lpString="*.txt") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.pdf") returned 0 [0135.668] lstrlenA (lpString="*.pdf") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.djvu") returned 0 [0135.668] lstrlenA (lpString="*.djvu") returned 6 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.htm") returned 0 [0135.668] lstrlenA (lpString="*.htm") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.html") returned 0 [0135.668] lstrlenA (lpString="*.html") returned 6 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.mdb") returned 0 [0135.668] lstrlenA (lpString="*.mdb") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.cer") returned 0 [0135.668] lstrlenA (lpString="*.cer") returned 5 [0135.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.p12") returned 0 [0135.668] lstrlenA (lpString="*.p12") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.pfx") returned 0 [0135.669] lstrlenA (lpString="*.pfx") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.kwm") returned 0 [0135.669] lstrlenA (lpString="*.kwm") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.pwm") returned 0 [0135.669] lstrlenA (lpString="*.pwm") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.1cd") returned 0 [0135.669] lstrlenA (lpString="*.1cd") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.md") returned 0 [0135.669] lstrlenA (lpString="*.md") returned 4 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.mdf") returned 0 [0135.669] lstrlenA (lpString="*.mdf") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.dbf") returned 0 [0135.669] lstrlenA (lpString="*.dbf") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.odt") returned 0 [0135.669] lstrlenA (lpString="*.odt") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.vob") returned 0 [0135.669] lstrlenA (lpString="*.vob") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.ifo") returned 0 [0135.669] lstrlenA (lpString="*.ifo") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.lnk") returned 0 [0135.669] lstrlenA (lpString="*.lnk") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.torrent") returned 0 [0135.669] lstrlenA (lpString="*.torrent") returned 9 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.mov") returned 0 [0135.669] lstrlenA (lpString="*.mov") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.m2v") returned 0 [0135.669] lstrlenA (lpString="*.m2v") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.3gp") returned 0 [0135.669] lstrlenA (lpString="*.3gp") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.mpeg") returned 0 [0135.669] lstrlenA (lpString="*.mpeg") returned 6 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.mpg") returned 0 [0135.669] lstrlenA (lpString="*.mpg") returned 5 [0135.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.flv") returned 0 [0135.669] lstrlenA (lpString="*.flv") returned 5 [0135.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.avi") returned 0 [0135.670] lstrlenA (lpString="*.avi") returned 5 [0135.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.mp4") returned 0 [0135.670] lstrlenA (lpString="*.mp4") returned 5 [0135.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.wmv") returned 0 [0135.670] lstrlenA (lpString="*.wmv") returned 5 [0135.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.divx") returned 0 [0135.670] lstrlenA (lpString="*.divx") returned 6 [0135.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.mkv") returned 0 [0135.670] lstrlenA (lpString="*.mkv") returned 5 [0135.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.mp3") returned 0 [0135.670] lstrlenA (lpString="*.mp3") returned 5 [0135.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.wav") returned 0 [0135.670] lstrlenA (lpString="*.wav") returned 5 [0135.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.flac") returned 0 [0135.670] lstrlenA (lpString="*.flac") returned 6 [0135.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.ape") returned 0 [0135.670] lstrlenA (lpString="*.ape") returned 5 [0135.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.wma") returned 0 [0135.670] lstrlenA (lpString="*.wma") returned 5 [0135.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.ac3") returned 0 [0135.670] lstrlenA (lpString="*.ac3") returned 5 [0135.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll", pszSpec="*.doc") returned 0 [0135.670] lstrlenA (lpString="*.doc") returned 5 [0135.670] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ac3ce17, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2ac3ce17, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2ac3ce17, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Outlook.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.670] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.670] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Outlook.ni.dll.aux") returned -1 [0135.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Outlook.ni.dll.aux") returned -1 [0135.670] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Outlook.ni.dll.aux") returned -1 [0135.670] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll") returned="Microsoft.Office.Tools.Outlook.ni.dll" [0135.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\" [0135.670] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\") returned="" [0135.670] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\HOW TO DECRYPT FILES.txt" [0135.670] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\how to decrypt files.txt")) returned 0x20 [0135.671] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\", lpString2="Microsoft.Office.Tools.Outlook.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux" [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.671] lstrlenA (lpString="*.zip") returned 5 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.671] lstrlenA (lpString="*.rar") returned 5 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.671] lstrlenA (lpString="*.7z") returned 4 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.671] lstrlenA (lpString="*.tar") returned 5 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.671] lstrlenA (lpString="*.gzip") returned 6 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.671] lstrlenA (lpString="*.jpg") returned 5 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.671] lstrlenA (lpString="*.jpeg") returned 6 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.671] lstrlenA (lpString="*.psd") returned 5 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.671] lstrlenA (lpString="*.cdr") returned 5 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.671] lstrlenA (lpString="*.dwg") returned 5 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.max") returned 0 [0135.671] lstrlenA (lpString="*.max") returned 5 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.671] lstrlenA (lpString="*.bmp") returned 5 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.671] lstrlenA (lpString="*.gif") returned 5 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.png") returned 0 [0135.671] lstrlenA (lpString="*.png") returned 5 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.671] lstrlenA (lpString="*.doc") returned 5 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.671] lstrlenA (lpString="*.docx") returned 6 [0135.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.672] lstrlenA (lpString="*.xls") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.672] lstrlenA (lpString="*.xlsx") returned 6 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.672] lstrlenA (lpString="*.ppt") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.672] lstrlenA (lpString="*.pptx") returned 6 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.672] lstrlenA (lpString="*.txt") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.672] lstrlenA (lpString="*.pdf") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.672] lstrlenA (lpString="*.djvu") returned 6 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.672] lstrlenA (lpString="*.htm") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.html") returned 0 [0135.672] lstrlenA (lpString="*.html") returned 6 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.672] lstrlenA (lpString="*.mdb") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.672] lstrlenA (lpString="*.cer") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.672] lstrlenA (lpString="*.p12") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.672] lstrlenA (lpString="*.pfx") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.672] lstrlenA (lpString="*.kwm") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.672] lstrlenA (lpString="*.pwm") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.672] lstrlenA (lpString="*.1cd") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.md") returned 0 [0135.672] lstrlenA (lpString="*.md") returned 4 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.672] lstrlenA (lpString="*.mdf") returned 5 [0135.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.673] lstrlenA (lpString="*.dbf") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.673] lstrlenA (lpString="*.odt") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.673] lstrlenA (lpString="*.vob") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.673] lstrlenA (lpString="*.ifo") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.673] lstrlenA (lpString="*.lnk") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.673] lstrlenA (lpString="*.torrent") returned 9 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.673] lstrlenA (lpString="*.mov") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.673] lstrlenA (lpString="*.m2v") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.673] lstrlenA (lpString="*.3gp") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.673] lstrlenA (lpString="*.mpeg") returned 6 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.673] lstrlenA (lpString="*.mpg") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.673] lstrlenA (lpString="*.flv") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.673] lstrlenA (lpString="*.avi") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.673] lstrlenA (lpString="*.mp4") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.673] lstrlenA (lpString="*.wmv") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.673] lstrlenA (lpString="*.divx") returned 6 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.673] lstrlenA (lpString="*.mkv") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.673] lstrlenA (lpString="*.mp3") returned 5 [0135.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.674] lstrlenA (lpString="*.wav") returned 5 [0135.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.674] lstrlenA (lpString="*.flac") returned 6 [0135.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.674] lstrlenA (lpString="*.ape") returned 5 [0135.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.674] lstrlenA (lpString="*.wma") returned 5 [0135.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.674] lstrlenA (lpString="*.ac3") returned 5 [0135.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\4dbaa926e8194c7bc1c658b97c8dad4b\\Microsoft.Office.Tools.Outlook.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.674] lstrlenA (lpString="*.doc") returned 5 [0135.674] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ac3ce17, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2ac3ce17, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2ac3ce17, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Outlook.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.674] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0135.709] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ac3ce17, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2ac3ce17, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2ac3ce17, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4dbaa926e8194c7bc1c658b97c8dad4b", cAlternateFileName="4DBAA9~1")) returned 0 [0135.709] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0135.719] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aec52dd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2aec52dd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2aec52dd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6c6c64, dwReserved1=0x787561, cFileName="Microsoft.O5263ae01#", cAlternateFileName="MICROS~1.O52")) returned 1 [0135.719] lstrcmpA (lpString1=".", lpString2="Microsoft.O5263ae01#") returned -1 [0135.719] lstrcmpA (lpString1="..", lpString2="Microsoft.O5263ae01#") returned -1 [0135.719] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.719] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.O5263ae01#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#" [0135.720] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#") returned 67 [0135.720] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aec52dd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2aec52dd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2aec52dd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0135.720] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.720] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aec52dd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2aec52dd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2aec52dd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.720] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.720] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.720] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aec52dd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2aeeb4d9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2aeeb4d9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e46ccee68d2ef6be376ff518dc45e3e1", cAlternateFileName="E46CCE~1")) returned 1 [0135.720] lstrcmpA (lpString1=".", lpString2="e46ccee68d2ef6be376ff518dc45e3e1") returned -1 [0135.720] lstrcmpA (lpString1="..", lpString2="e46ccee68d2ef6be376ff518dc45e3e1") returned -1 [0135.720] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\*.*") returned="*.*" [0135.720] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\", lpString2="e46ccee68d2ef6be376ff518dc45e3e1" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1" [0135.720] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1") returned 100 [0135.720] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aec52dd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2aeeb4d9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2aeeb4d9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0135.723] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.723] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aec52dd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2aeeb4d9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2aeeb4d9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.723] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.724] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.724] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aec52dd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2aec52dd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2aeeb4d9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5e600, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Office.Tools.Outlook.Implementation.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.724] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Outlook.Implementation.ni.dll") returned -1 [0135.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Outlook.Implementation.ni.dll") returned -1 [0135.724] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Outlook.Implementation.ni.dll") returned -1 [0135.724] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\*.*") returned="*.*" [0135.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\" [0135.724] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\") returned="" [0135.724] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\HOW TO DECRYPT FILES.txt" [0135.724] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\how to decrypt files.txt")) returned 0xffffffff [0135.724] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.726] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.726] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.727] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.727] CloseHandle (hObject=0x214) returned 1 [0135.727] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\", lpString2="Microsoft.Office.Tools.Outlook.Implementation.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll" [0135.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.zip") returned 0 [0135.727] lstrlenA (lpString="*.zip") returned 5 [0135.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.rar") returned 0 [0135.727] lstrlenA (lpString="*.rar") returned 5 [0135.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.7z") returned 0 [0135.727] lstrlenA (lpString="*.7z") returned 4 [0135.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.tar") returned 0 [0135.727] lstrlenA (lpString="*.tar") returned 5 [0135.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.gzip") returned 0 [0135.728] lstrlenA (lpString="*.gzip") returned 6 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.jpg") returned 0 [0135.728] lstrlenA (lpString="*.jpg") returned 5 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.jpeg") returned 0 [0135.728] lstrlenA (lpString="*.jpeg") returned 6 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.psd") returned 0 [0135.728] lstrlenA (lpString="*.psd") returned 5 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.cdr") returned 0 [0135.728] lstrlenA (lpString="*.cdr") returned 5 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.dwg") returned 0 [0135.728] lstrlenA (lpString="*.dwg") returned 5 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.max") returned 0 [0135.728] lstrlenA (lpString="*.max") returned 5 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.bmp") returned 0 [0135.728] lstrlenA (lpString="*.bmp") returned 5 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.gif") returned 0 [0135.728] lstrlenA (lpString="*.gif") returned 5 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.png") returned 0 [0135.728] lstrlenA (lpString="*.png") returned 5 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.doc") returned 0 [0135.728] lstrlenA (lpString="*.doc") returned 5 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.docx") returned 0 [0135.728] lstrlenA (lpString="*.docx") returned 6 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.xls") returned 0 [0135.728] lstrlenA (lpString="*.xls") returned 5 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.xlsx") returned 0 [0135.728] lstrlenA (lpString="*.xlsx") returned 6 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.ppt") returned 0 [0135.728] lstrlenA (lpString="*.ppt") returned 5 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.pptx") returned 0 [0135.728] lstrlenA (lpString="*.pptx") returned 6 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.txt") returned 0 [0135.728] lstrlenA (lpString="*.txt") returned 5 [0135.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.pdf") returned 0 [0135.728] lstrlenA (lpString="*.pdf") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.djvu") returned 0 [0135.729] lstrlenA (lpString="*.djvu") returned 6 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.htm") returned 0 [0135.729] lstrlenA (lpString="*.htm") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.html") returned 0 [0135.729] lstrlenA (lpString="*.html") returned 6 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.mdb") returned 0 [0135.729] lstrlenA (lpString="*.mdb") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.cer") returned 0 [0135.729] lstrlenA (lpString="*.cer") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.p12") returned 0 [0135.729] lstrlenA (lpString="*.p12") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.pfx") returned 0 [0135.729] lstrlenA (lpString="*.pfx") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.kwm") returned 0 [0135.729] lstrlenA (lpString="*.kwm") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.pwm") returned 0 [0135.729] lstrlenA (lpString="*.pwm") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.1cd") returned 0 [0135.729] lstrlenA (lpString="*.1cd") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.md") returned 0 [0135.729] lstrlenA (lpString="*.md") returned 4 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.mdf") returned 0 [0135.729] lstrlenA (lpString="*.mdf") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.dbf") returned 0 [0135.729] lstrlenA (lpString="*.dbf") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.odt") returned 0 [0135.729] lstrlenA (lpString="*.odt") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.vob") returned 0 [0135.729] lstrlenA (lpString="*.vob") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.ifo") returned 0 [0135.729] lstrlenA (lpString="*.ifo") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.lnk") returned 0 [0135.729] lstrlenA (lpString="*.lnk") returned 5 [0135.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.torrent") returned 0 [0135.730] lstrlenA (lpString="*.torrent") returned 9 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.mov") returned 0 [0135.730] lstrlenA (lpString="*.mov") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.m2v") returned 0 [0135.730] lstrlenA (lpString="*.m2v") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.3gp") returned 0 [0135.730] lstrlenA (lpString="*.3gp") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.mpeg") returned 0 [0135.730] lstrlenA (lpString="*.mpeg") returned 6 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.mpg") returned 0 [0135.730] lstrlenA (lpString="*.mpg") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.flv") returned 0 [0135.730] lstrlenA (lpString="*.flv") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.avi") returned 0 [0135.730] lstrlenA (lpString="*.avi") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.mp4") returned 0 [0135.730] lstrlenA (lpString="*.mp4") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.wmv") returned 0 [0135.730] lstrlenA (lpString="*.wmv") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.divx") returned 0 [0135.730] lstrlenA (lpString="*.divx") returned 6 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.mkv") returned 0 [0135.730] lstrlenA (lpString="*.mkv") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.mp3") returned 0 [0135.730] lstrlenA (lpString="*.mp3") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.wav") returned 0 [0135.730] lstrlenA (lpString="*.wav") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.flac") returned 0 [0135.730] lstrlenA (lpString="*.flac") returned 6 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.ape") returned 0 [0135.730] lstrlenA (lpString="*.ape") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.wma") returned 0 [0135.730] lstrlenA (lpString="*.wma") returned 5 [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.ac3") returned 0 [0135.731] lstrlenA (lpString="*.ac3") returned 5 [0135.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll", pszSpec="*.doc") returned 0 [0135.731] lstrlenA (lpString="*.doc") returned 5 [0135.731] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aec52dd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2aec52dd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2aeeb4d9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x880, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.731] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.731] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux") returned -1 [0135.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux") returned -1 [0135.731] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux") returned -1 [0135.731] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll") returned="Microsoft.Office.Tools.Outlook.Implementation.ni.dll" [0135.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\" [0135.731] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\") returned="" [0135.731] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\HOW TO DECRYPT FILES.txt" [0135.731] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\how to decrypt files.txt")) returned 0x20 [0135.731] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\", lpString2="Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux" [0135.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.731] lstrlenA (lpString="*.zip") returned 5 [0135.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.731] lstrlenA (lpString="*.rar") returned 5 [0135.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.731] lstrlenA (lpString="*.7z") returned 4 [0135.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.731] lstrlenA (lpString="*.tar") returned 5 [0135.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.731] lstrlenA (lpString="*.gzip") returned 6 [0135.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.731] lstrlenA (lpString="*.jpg") returned 5 [0135.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.731] lstrlenA (lpString="*.jpeg") returned 6 [0135.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.731] lstrlenA (lpString="*.psd") returned 5 [0135.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.732] lstrlenA (lpString="*.cdr") returned 5 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.732] lstrlenA (lpString="*.dwg") returned 5 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.max") returned 0 [0135.732] lstrlenA (lpString="*.max") returned 5 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.732] lstrlenA (lpString="*.bmp") returned 5 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.732] lstrlenA (lpString="*.gif") returned 5 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.png") returned 0 [0135.732] lstrlenA (lpString="*.png") returned 5 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.732] lstrlenA (lpString="*.doc") returned 5 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.732] lstrlenA (lpString="*.docx") returned 6 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.732] lstrlenA (lpString="*.xls") returned 5 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.732] lstrlenA (lpString="*.xlsx") returned 6 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.732] lstrlenA (lpString="*.ppt") returned 5 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.732] lstrlenA (lpString="*.pptx") returned 6 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.732] lstrlenA (lpString="*.txt") returned 5 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.732] lstrlenA (lpString="*.pdf") returned 5 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.732] lstrlenA (lpString="*.djvu") returned 6 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.732] lstrlenA (lpString="*.htm") returned 5 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.html") returned 0 [0135.732] lstrlenA (lpString="*.html") returned 6 [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.733] lstrlenA (lpString="*.mdb") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.733] lstrlenA (lpString="*.cer") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.733] lstrlenA (lpString="*.p12") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.733] lstrlenA (lpString="*.pfx") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.733] lstrlenA (lpString="*.kwm") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.733] lstrlenA (lpString="*.pwm") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.733] lstrlenA (lpString="*.1cd") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.md") returned 0 [0135.733] lstrlenA (lpString="*.md") returned 4 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.733] lstrlenA (lpString="*.mdf") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.733] lstrlenA (lpString="*.dbf") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.733] lstrlenA (lpString="*.odt") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.733] lstrlenA (lpString="*.vob") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.733] lstrlenA (lpString="*.ifo") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.733] lstrlenA (lpString="*.lnk") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.733] lstrlenA (lpString="*.torrent") returned 9 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.733] lstrlenA (lpString="*.mov") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.733] lstrlenA (lpString="*.m2v") returned 5 [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.734] lstrlenA (lpString="*.3gp") returned 5 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.734] lstrlenA (lpString="*.mpeg") returned 6 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.734] lstrlenA (lpString="*.mpg") returned 5 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.734] lstrlenA (lpString="*.flv") returned 5 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.734] lstrlenA (lpString="*.avi") returned 5 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.734] lstrlenA (lpString="*.mp4") returned 5 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.734] lstrlenA (lpString="*.wmv") returned 5 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.734] lstrlenA (lpString="*.divx") returned 6 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.734] lstrlenA (lpString="*.mkv") returned 5 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.734] lstrlenA (lpString="*.mp3") returned 5 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.734] lstrlenA (lpString="*.wav") returned 5 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.734] lstrlenA (lpString="*.flac") returned 6 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.734] lstrlenA (lpString="*.ape") returned 5 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.734] lstrlenA (lpString="*.wma") returned 5 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.734] lstrlenA (lpString="*.ac3") returned 5 [0135.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\e46ccee68d2ef6be376ff518dc45e3e1\\Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.734] lstrlenA (lpString="*.doc") returned 5 [0135.734] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aec52dd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2aec52dd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2aeeb4d9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x880, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Outlook.Implementation.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.734] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0135.735] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aec52dd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2aeeb4d9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2aeeb4d9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e46ccee68d2ef6be376ff518dc45e3e1", cAlternateFileName="E46CCE~1")) returned 0 [0135.735] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0135.735] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x264e1f0a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x264e1f0a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x264e1f0a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x7875612e, cFileName="Microsoft.O5949707a#", cAlternateFileName="MICROS~1.O59")) returned 1 [0135.735] lstrcmpA (lpString1=".", lpString2="Microsoft.O5949707a#") returned -1 [0135.735] lstrcmpA (lpString1="..", lpString2="Microsoft.O5949707a#") returned -1 [0135.735] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.735] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.O5949707a#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#" [0135.735] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#") returned 67 [0135.735] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x264e1f0a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x264e1f0a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x264e1f0a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0135.736] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.736] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x264e1f0a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x264e1f0a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x264e1f0a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.736] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.736] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.736] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x264e1f0a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x264e1f0a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x264e1f0a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3cc247675759d31ef707bf48db5b5849", cAlternateFileName="3CC247~1")) returned 1 [0135.736] lstrcmpA (lpString1=".", lpString2="3cc247675759d31ef707bf48db5b5849") returned -1 [0135.736] lstrcmpA (lpString1="..", lpString2="3cc247675759d31ef707bf48db5b5849") returned -1 [0135.736] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\*.*") returned="*.*" [0135.736] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\", lpString2="3cc247675759d31ef707bf48db5b5849" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849" [0135.736] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849") returned 100 [0135.736] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x264e1f0a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x264e1f0a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x264e1f0a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d90 [0135.738] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.738] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x264e1f0a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x264e1f0a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x264e1f0a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.738] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.738] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.738] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x264e1f0a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x264e1f0a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x264e1f0a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Office.Tools.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.738] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.ni.dll") returned -1 [0135.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.ni.dll") returned -1 [0135.738] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.ni.dll") returned -1 [0135.738] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\*.*") returned="*.*" [0135.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\" [0135.739] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\") returned="" [0135.739] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\HOW TO DECRYPT FILES.txt" [0135.739] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o5949707a#\\3cc247675759d31ef707bf48db5b5849\\how to decrypt files.txt")) returned 0xffffffff [0135.739] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o5949707a#\\3cc247675759d31ef707bf48db5b5849\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.739] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.739] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.740] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.742] CloseHandle (hObject=0x214) returned 1 [0135.742] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\", lpString2="Microsoft.Office.Tools.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll" [0135.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.zip") returned 0 [0135.742] lstrlenA (lpString="*.zip") returned 5 [0135.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.rar") returned 0 [0135.742] lstrlenA (lpString="*.rar") returned 5 [0135.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.7z") returned 0 [0135.742] lstrlenA (lpString="*.7z") returned 4 [0135.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.tar") returned 0 [0135.742] lstrlenA (lpString="*.tar") returned 5 [0135.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.gzip") returned 0 [0135.742] lstrlenA (lpString="*.gzip") returned 6 [0135.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.jpg") returned 0 [0135.742] lstrlenA (lpString="*.jpg") returned 5 [0135.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.jpeg") returned 0 [0135.742] lstrlenA (lpString="*.jpeg") returned 6 [0135.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.psd") returned 0 [0135.742] lstrlenA (lpString="*.psd") returned 5 [0135.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.cdr") returned 0 [0135.742] lstrlenA (lpString="*.cdr") returned 5 [0135.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.dwg") returned 0 [0135.742] lstrlenA (lpString="*.dwg") returned 5 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.max") returned 0 [0135.743] lstrlenA (lpString="*.max") returned 5 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.bmp") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.gif") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.png") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.doc") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.docx") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.xls") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.xlsx") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.ppt") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.pptx") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.txt") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.pdf") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.djvu") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.htm") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.html") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.mdb") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.cer") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.p12") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.pfx") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.kwm") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.pwm") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.1cd") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.md") returned 0 [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.mdf") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.dbf") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.odt") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.vob") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.ifo") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.lnk") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.torrent") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.mov") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.m2v") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.3gp") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.mpeg") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.mpg") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.flv") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.avi") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.mp4") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.wmv") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.divx") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.mkv") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.mp3") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.wav") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.flac") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.ape") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.wma") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.ac3") returned 0 [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll", pszSpec="*.doc") returned 0 [0135.744] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x264e1f0a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x264e1f0a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x264e1f0a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.745] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.ni.dll.aux") returned -1 [0135.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.ni.dll.aux") returned -1 [0135.745] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.ni.dll.aux") returned -1 [0135.745] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll") returned="Microsoft.Office.Tools.ni.dll" [0135.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\" [0135.745] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\") returned="" [0135.745] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\HOW TO DECRYPT FILES.txt" [0135.745] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o5949707a#\\3cc247675759d31ef707bf48db5b5849\\how to decrypt files.txt")) returned 0x20 [0135.745] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\", lpString2="Microsoft.Office.Tools.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux" [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.max") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.png") returned 0 [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.html") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.md") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\3cc247675759d31ef707bf48db5b5849\\Microsoft.Office.Tools.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.747] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x264e1f0a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x264e1f0a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x264e1f0a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.747] FindClose (in: hFindFile=0x759d90 | out: hFindFile=0x759d90) returned 1 [0135.748] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x264e1f0a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x264e1f0a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x264e1f0a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3cc247675759d31ef707bf48db5b5849", cAlternateFileName="3CC247~1")) returned 0 [0135.748] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0135.748] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26c54b07, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x26c54b07, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x26c54b07, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x7875612e, cFileName="Microsoft.O854200f9#", cAlternateFileName="MICROS~1.O85")) returned 1 [0135.748] lstrcmpA (lpString1=".", lpString2="Microsoft.O854200f9#") returned -1 [0135.748] lstrcmpA (lpString1="..", lpString2="Microsoft.O854200f9#") returned -1 [0135.748] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.748] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.O854200f9#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#" [0135.748] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26c54b07, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x26c54b07, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x26c54b07, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0135.748] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.748] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26c54b07, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x26c54b07, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x26c54b07, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.748] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.748] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.748] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26c54b07, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x26ca0fd9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x26ca0fd9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="faaaf64d133fdb4b7eebe9a26db58d69", cAlternateFileName="FAAAF6~1")) returned 1 [0135.748] lstrcmpA (lpString1=".", lpString2="faaaf64d133fdb4b7eebe9a26db58d69") returned -1 [0135.748] lstrcmpA (lpString1="..", lpString2="faaaf64d133fdb4b7eebe9a26db58d69") returned -1 [0135.749] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\*.*") returned="*.*" [0135.749] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\", lpString2="faaaf64d133fdb4b7eebe9a26db58d69" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69" [0135.749] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26c54b07, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x26ca0fd9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x26ca0fd9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759b50 [0135.772] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.772] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26c54b07, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x26ca0fd9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x26ca0fd9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.772] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.772] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.772] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c2e8ca, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x26c2e8ca, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x26ca0fd9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x77000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Office.Tools.Common.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.772] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Common.ni.dll") returned -1 [0135.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Common.ni.dll") returned -1 [0135.772] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Common.ni.dll") returned -1 [0135.772] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\*.*") returned="*.*" [0135.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\" [0135.772] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\") returned="" [0135.772] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\HOW TO DECRYPT FILES.txt" [0135.772] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\how to decrypt files.txt")) returned 0xffffffff [0135.772] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.774] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.775] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.775] CloseHandle (hObject=0x214) returned 1 [0135.775] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\", lpString2="Microsoft.Office.Tools.Common.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll" [0135.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.zip") returned 0 [0135.775] lstrlenA (lpString="*.zip") returned 5 [0135.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.rar") returned 0 [0135.775] lstrlenA (lpString="*.rar") returned 5 [0135.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.7z") returned 0 [0135.775] lstrlenA (lpString="*.7z") returned 4 [0135.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.tar") returned 0 [0135.776] lstrlenA (lpString="*.tar") returned 5 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.gzip") returned 0 [0135.776] lstrlenA (lpString="*.gzip") returned 6 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.jpg") returned 0 [0135.776] lstrlenA (lpString="*.jpg") returned 5 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.jpeg") returned 0 [0135.776] lstrlenA (lpString="*.jpeg") returned 6 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.psd") returned 0 [0135.776] lstrlenA (lpString="*.psd") returned 5 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.cdr") returned 0 [0135.776] lstrlenA (lpString="*.cdr") returned 5 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.dwg") returned 0 [0135.776] lstrlenA (lpString="*.dwg") returned 5 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.max") returned 0 [0135.776] lstrlenA (lpString="*.max") returned 5 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.bmp") returned 0 [0135.776] lstrlenA (lpString="*.bmp") returned 5 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.gif") returned 0 [0135.776] lstrlenA (lpString="*.gif") returned 5 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.png") returned 0 [0135.776] lstrlenA (lpString="*.png") returned 5 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.doc") returned 0 [0135.776] lstrlenA (lpString="*.doc") returned 5 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.docx") returned 0 [0135.776] lstrlenA (lpString="*.docx") returned 6 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.xls") returned 0 [0135.776] lstrlenA (lpString="*.xls") returned 5 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.xlsx") returned 0 [0135.776] lstrlenA (lpString="*.xlsx") returned 6 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.ppt") returned 0 [0135.776] lstrlenA (lpString="*.ppt") returned 5 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.pptx") returned 0 [0135.776] lstrlenA (lpString="*.pptx") returned 6 [0135.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.txt") returned 0 [0135.776] lstrlenA (lpString="*.txt") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.pdf") returned 0 [0135.777] lstrlenA (lpString="*.pdf") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.djvu") returned 0 [0135.777] lstrlenA (lpString="*.djvu") returned 6 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.htm") returned 0 [0135.777] lstrlenA (lpString="*.htm") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.html") returned 0 [0135.777] lstrlenA (lpString="*.html") returned 6 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.mdb") returned 0 [0135.777] lstrlenA (lpString="*.mdb") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.cer") returned 0 [0135.777] lstrlenA (lpString="*.cer") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.p12") returned 0 [0135.777] lstrlenA (lpString="*.p12") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.pfx") returned 0 [0135.777] lstrlenA (lpString="*.pfx") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.kwm") returned 0 [0135.777] lstrlenA (lpString="*.kwm") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.pwm") returned 0 [0135.777] lstrlenA (lpString="*.pwm") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.1cd") returned 0 [0135.777] lstrlenA (lpString="*.1cd") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.md") returned 0 [0135.777] lstrlenA (lpString="*.md") returned 4 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.mdf") returned 0 [0135.777] lstrlenA (lpString="*.mdf") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.dbf") returned 0 [0135.777] lstrlenA (lpString="*.dbf") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.odt") returned 0 [0135.777] lstrlenA (lpString="*.odt") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.vob") returned 0 [0135.777] lstrlenA (lpString="*.vob") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.ifo") returned 0 [0135.777] lstrlenA (lpString="*.ifo") returned 5 [0135.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.lnk") returned 0 [0135.778] lstrlenA (lpString="*.lnk") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.torrent") returned 0 [0135.778] lstrlenA (lpString="*.torrent") returned 9 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.mov") returned 0 [0135.778] lstrlenA (lpString="*.mov") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.m2v") returned 0 [0135.778] lstrlenA (lpString="*.m2v") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.3gp") returned 0 [0135.778] lstrlenA (lpString="*.3gp") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.mpeg") returned 0 [0135.778] lstrlenA (lpString="*.mpeg") returned 6 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.mpg") returned 0 [0135.778] lstrlenA (lpString="*.mpg") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.flv") returned 0 [0135.778] lstrlenA (lpString="*.flv") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.avi") returned 0 [0135.778] lstrlenA (lpString="*.avi") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.mp4") returned 0 [0135.778] lstrlenA (lpString="*.mp4") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.wmv") returned 0 [0135.778] lstrlenA (lpString="*.wmv") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.divx") returned 0 [0135.778] lstrlenA (lpString="*.divx") returned 6 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.mkv") returned 0 [0135.778] lstrlenA (lpString="*.mkv") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.mp3") returned 0 [0135.778] lstrlenA (lpString="*.mp3") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.wav") returned 0 [0135.778] lstrlenA (lpString="*.wav") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.flac") returned 0 [0135.778] lstrlenA (lpString="*.flac") returned 6 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.ape") returned 0 [0135.778] lstrlenA (lpString="*.ape") returned 5 [0135.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.wma") returned 0 [0135.778] lstrlenA (lpString="*.wma") returned 5 [0135.779] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.ac3") returned 0 [0135.779] lstrlenA (lpString="*.ac3") returned 5 [0135.779] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll", pszSpec="*.doc") returned 0 [0135.779] lstrlenA (lpString="*.doc") returned 5 [0135.779] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c54b07, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x26c54b07, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x26c7ad1e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Common.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.779] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Common.ni.dll.aux") returned -1 [0135.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Common.ni.dll.aux") returned -1 [0135.779] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Common.ni.dll.aux") returned -1 [0135.779] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll") returned="Microsoft.Office.Tools.Common.ni.dll" [0135.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\" [0135.779] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\") returned="" [0135.779] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\HOW TO DECRYPT FILES.txt" [0135.779] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.o854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\how to decrypt files.txt")) returned 0x20 [0135.779] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\", lpString2="Microsoft.Office.Tools.Common.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux" [0135.779] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.779] lstrlenA (lpString="*.zip") returned 5 [0135.779] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.779] lstrlenA (lpString="*.rar") returned 5 [0135.779] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.779] lstrlenA (lpString="*.7z") returned 4 [0135.779] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.779] lstrlenA (lpString="*.tar") returned 5 [0135.779] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.779] lstrlenA (lpString="*.gzip") returned 6 [0135.779] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.779] lstrlenA (lpString="*.jpg") returned 5 [0135.779] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.779] lstrlenA (lpString="*.jpeg") returned 6 [0135.779] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.779] lstrlenA (lpString="*.psd") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.780] lstrlenA (lpString="*.cdr") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.780] lstrlenA (lpString="*.dwg") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.max") returned 0 [0135.780] lstrlenA (lpString="*.max") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.780] lstrlenA (lpString="*.bmp") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.780] lstrlenA (lpString="*.gif") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.png") returned 0 [0135.780] lstrlenA (lpString="*.png") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.780] lstrlenA (lpString="*.doc") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.780] lstrlenA (lpString="*.docx") returned 6 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.780] lstrlenA (lpString="*.xls") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.780] lstrlenA (lpString="*.xlsx") returned 6 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.780] lstrlenA (lpString="*.ppt") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.780] lstrlenA (lpString="*.pptx") returned 6 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.780] lstrlenA (lpString="*.txt") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.780] lstrlenA (lpString="*.pdf") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.780] lstrlenA (lpString="*.djvu") returned 6 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.780] lstrlenA (lpString="*.htm") returned 5 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.html") returned 0 [0135.780] lstrlenA (lpString="*.html") returned 6 [0135.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.781] lstrlenA (lpString="*.mdb") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.781] lstrlenA (lpString="*.cer") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.781] lstrlenA (lpString="*.p12") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.781] lstrlenA (lpString="*.pfx") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.781] lstrlenA (lpString="*.kwm") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.781] lstrlenA (lpString="*.pwm") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.781] lstrlenA (lpString="*.1cd") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.md") returned 0 [0135.781] lstrlenA (lpString="*.md") returned 4 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.781] lstrlenA (lpString="*.mdf") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.781] lstrlenA (lpString="*.dbf") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.781] lstrlenA (lpString="*.odt") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.781] lstrlenA (lpString="*.vob") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.781] lstrlenA (lpString="*.ifo") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.781] lstrlenA (lpString="*.lnk") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.781] lstrlenA (lpString="*.torrent") returned 9 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.781] lstrlenA (lpString="*.mov") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.781] lstrlenA (lpString="*.m2v") returned 5 [0135.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.782] lstrlenA (lpString="*.3gp") returned 5 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.782] lstrlenA (lpString="*.mpeg") returned 6 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.782] lstrlenA (lpString="*.mpg") returned 5 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.782] lstrlenA (lpString="*.flv") returned 5 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.782] lstrlenA (lpString="*.avi") returned 5 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.782] lstrlenA (lpString="*.mp4") returned 5 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.782] lstrlenA (lpString="*.wmv") returned 5 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.782] lstrlenA (lpString="*.divx") returned 6 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.782] lstrlenA (lpString="*.mkv") returned 5 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.782] lstrlenA (lpString="*.mp3") returned 5 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.782] lstrlenA (lpString="*.wav") returned 5 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.782] lstrlenA (lpString="*.flac") returned 6 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.782] lstrlenA (lpString="*.ape") returned 5 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.782] lstrlenA (lpString="*.wma") returned 5 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.782] lstrlenA (lpString="*.ac3") returned 5 [0135.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\faaaf64d133fdb4b7eebe9a26db58d69\\Microsoft.Office.Tools.Common.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.782] lstrlenA (lpString="*.doc") returned 5 [0135.782] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c54b07, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x26c54b07, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x26c7ad1e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Common.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.782] FindClose (in: hFindFile=0x759b50 | out: hFindFile=0x759b50) returned 1 [0135.783] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26c54b07, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x26ca0fd9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x26ca0fd9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="faaaf64d133fdb4b7eebe9a26db58d69", cAlternateFileName="FAAAF6~1")) returned 0 [0135.783] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0135.783] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fe892, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2e4fe892, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2e4fe892, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x7875612e, cFileName="Microsoft.Oab3f8ec6#", cAlternateFileName="MICROS~1.OAB")) returned 1 [0135.783] lstrcmpA (lpString1=".", lpString2="Microsoft.Oab3f8ec6#") returned -1 [0135.783] lstrcmpA (lpString1="..", lpString2="Microsoft.Oab3f8ec6#") returned -1 [0135.783] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.783] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Oab3f8ec6#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#" [0135.783] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#") returned 67 [0135.783] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fe892, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2e4fe892, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2e4fe892, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d90 [0135.785] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.785] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fe892, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2e4fe892, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2e4fe892, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.785] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.785] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.785] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fe892, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2e54ad12, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2e54ad12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14aecf5c194458297815d22c33f800cf", cAlternateFileName="14AECF~1")) returned 1 [0135.785] lstrcmpA (lpString1=".", lpString2="14aecf5c194458297815d22c33f800cf") returned -1 [0135.785] lstrcmpA (lpString1="..", lpString2="14aecf5c194458297815d22c33f800cf") returned -1 [0135.785] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\*.*") returned="*.*" [0135.785] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\", lpString2="14aecf5c194458297815d22c33f800cf" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf" [0135.785] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf") returned 100 [0135.785] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fe892, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2e54ad12, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2e54ad12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759f50 [0135.787] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.787] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fe892, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2e54ad12, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2e54ad12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.787] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.787] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.787] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4b2463, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2e4b2463, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2e570fec, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x159000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Office.Tools.Word.Implementation.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.787] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Word.Implementation.ni.dll") returned -1 [0135.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Word.Implementation.ni.dll") returned -1 [0135.787] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Word.Implementation.ni.dll") returned -1 [0135.788] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\*.*") returned="*.*" [0135.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\" [0135.788] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\") returned="" [0135.788] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\HOW TO DECRYPT FILES.txt" [0135.788] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\how to decrypt files.txt")) returned 0xffffffff [0135.788] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.789] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.789] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.789] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.790] CloseHandle (hObject=0x214) returned 1 [0135.790] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\", lpString2="Microsoft.Office.Tools.Word.Implementation.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll" [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.zip") returned 0 [0135.790] lstrlenA (lpString="*.zip") returned 5 [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.rar") returned 0 [0135.790] lstrlenA (lpString="*.rar") returned 5 [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.7z") returned 0 [0135.790] lstrlenA (lpString="*.7z") returned 4 [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.tar") returned 0 [0135.790] lstrlenA (lpString="*.tar") returned 5 [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.gzip") returned 0 [0135.790] lstrlenA (lpString="*.gzip") returned 6 [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.jpg") returned 0 [0135.790] lstrlenA (lpString="*.jpg") returned 5 [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.jpeg") returned 0 [0135.790] lstrlenA (lpString="*.jpeg") returned 6 [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.psd") returned 0 [0135.790] lstrlenA (lpString="*.psd") returned 5 [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.cdr") returned 0 [0135.790] lstrlenA (lpString="*.cdr") returned 5 [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.dwg") returned 0 [0135.790] lstrlenA (lpString="*.dwg") returned 5 [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.max") returned 0 [0135.790] lstrlenA (lpString="*.max") returned 5 [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.bmp") returned 0 [0135.790] lstrlenA (lpString="*.bmp") returned 5 [0135.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.gif") returned 0 [0135.790] lstrlenA (lpString="*.gif") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.png") returned 0 [0135.791] lstrlenA (lpString="*.png") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.doc") returned 0 [0135.791] lstrlenA (lpString="*.doc") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.docx") returned 0 [0135.791] lstrlenA (lpString="*.docx") returned 6 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.xls") returned 0 [0135.791] lstrlenA (lpString="*.xls") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.xlsx") returned 0 [0135.791] lstrlenA (lpString="*.xlsx") returned 6 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.ppt") returned 0 [0135.791] lstrlenA (lpString="*.ppt") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.pptx") returned 0 [0135.791] lstrlenA (lpString="*.pptx") returned 6 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.txt") returned 0 [0135.791] lstrlenA (lpString="*.txt") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.pdf") returned 0 [0135.791] lstrlenA (lpString="*.pdf") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.djvu") returned 0 [0135.791] lstrlenA (lpString="*.djvu") returned 6 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.htm") returned 0 [0135.791] lstrlenA (lpString="*.htm") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.html") returned 0 [0135.791] lstrlenA (lpString="*.html") returned 6 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.mdb") returned 0 [0135.791] lstrlenA (lpString="*.mdb") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.cer") returned 0 [0135.791] lstrlenA (lpString="*.cer") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.p12") returned 0 [0135.791] lstrlenA (lpString="*.p12") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.pfx") returned 0 [0135.791] lstrlenA (lpString="*.pfx") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.kwm") returned 0 [0135.791] lstrlenA (lpString="*.kwm") returned 5 [0135.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.pwm") returned 0 [0135.791] lstrlenA (lpString="*.pwm") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.1cd") returned 0 [0135.792] lstrlenA (lpString="*.1cd") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.md") returned 0 [0135.792] lstrlenA (lpString="*.md") returned 4 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.mdf") returned 0 [0135.792] lstrlenA (lpString="*.mdf") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.dbf") returned 0 [0135.792] lstrlenA (lpString="*.dbf") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.odt") returned 0 [0135.792] lstrlenA (lpString="*.odt") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.vob") returned 0 [0135.792] lstrlenA (lpString="*.vob") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.ifo") returned 0 [0135.792] lstrlenA (lpString="*.ifo") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.lnk") returned 0 [0135.792] lstrlenA (lpString="*.lnk") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.torrent") returned 0 [0135.792] lstrlenA (lpString="*.torrent") returned 9 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.mov") returned 0 [0135.792] lstrlenA (lpString="*.mov") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.m2v") returned 0 [0135.792] lstrlenA (lpString="*.m2v") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.3gp") returned 0 [0135.792] lstrlenA (lpString="*.3gp") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.mpeg") returned 0 [0135.792] lstrlenA (lpString="*.mpeg") returned 6 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.mpg") returned 0 [0135.792] lstrlenA (lpString="*.mpg") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.flv") returned 0 [0135.792] lstrlenA (lpString="*.flv") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.avi") returned 0 [0135.792] lstrlenA (lpString="*.avi") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.mp4") returned 0 [0135.792] lstrlenA (lpString="*.mp4") returned 5 [0135.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.wmv") returned 0 [0135.793] lstrlenA (lpString="*.wmv") returned 5 [0135.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.divx") returned 0 [0135.793] lstrlenA (lpString="*.divx") returned 6 [0135.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.mkv") returned 0 [0135.793] lstrlenA (lpString="*.mkv") returned 5 [0135.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.mp3") returned 0 [0135.793] lstrlenA (lpString="*.mp3") returned 5 [0135.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.wav") returned 0 [0135.793] lstrlenA (lpString="*.wav") returned 5 [0135.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.flac") returned 0 [0135.793] lstrlenA (lpString="*.flac") returned 6 [0135.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.ape") returned 0 [0135.793] lstrlenA (lpString="*.ape") returned 5 [0135.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.wma") returned 0 [0135.793] lstrlenA (lpString="*.wma") returned 5 [0135.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.ac3") returned 0 [0135.793] lstrlenA (lpString="*.ac3") returned 5 [0135.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll", pszSpec="*.doc") returned 0 [0135.793] lstrlenA (lpString="*.doc") returned 5 [0135.793] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e54ad12, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2e54ad12, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2e54ad12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.793] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.793] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Word.Implementation.ni.dll.aux") returned -1 [0135.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Word.Implementation.ni.dll.aux") returned -1 [0135.793] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Word.Implementation.ni.dll.aux") returned -1 [0135.793] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll") returned="Microsoft.Office.Tools.Word.Implementation.ni.dll" [0135.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\" [0135.793] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\") returned="" [0135.793] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\HOW TO DECRYPT FILES.txt" [0135.793] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\how to decrypt files.txt")) returned 0x20 [0135.793] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\", lpString2="Microsoft.Office.Tools.Word.Implementation.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux" [0135.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.793] lstrlenA (lpString="*.zip") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.794] lstrlenA (lpString="*.rar") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.794] lstrlenA (lpString="*.7z") returned 4 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.794] lstrlenA (lpString="*.tar") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.794] lstrlenA (lpString="*.gzip") returned 6 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.794] lstrlenA (lpString="*.jpg") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.794] lstrlenA (lpString="*.jpeg") returned 6 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.794] lstrlenA (lpString="*.psd") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.794] lstrlenA (lpString="*.cdr") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.794] lstrlenA (lpString="*.dwg") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.max") returned 0 [0135.794] lstrlenA (lpString="*.max") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.794] lstrlenA (lpString="*.bmp") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.794] lstrlenA (lpString="*.gif") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.png") returned 0 [0135.794] lstrlenA (lpString="*.png") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.794] lstrlenA (lpString="*.doc") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.794] lstrlenA (lpString="*.docx") returned 6 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.794] lstrlenA (lpString="*.xls") returned 5 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.794] lstrlenA (lpString="*.xlsx") returned 6 [0135.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.794] lstrlenA (lpString="*.ppt") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.795] lstrlenA (lpString="*.pptx") returned 6 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.795] lstrlenA (lpString="*.txt") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.795] lstrlenA (lpString="*.pdf") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.795] lstrlenA (lpString="*.djvu") returned 6 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.795] lstrlenA (lpString="*.htm") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.html") returned 0 [0135.795] lstrlenA (lpString="*.html") returned 6 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.795] lstrlenA (lpString="*.mdb") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.795] lstrlenA (lpString="*.cer") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.795] lstrlenA (lpString="*.p12") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.795] lstrlenA (lpString="*.pfx") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.795] lstrlenA (lpString="*.kwm") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.795] lstrlenA (lpString="*.pwm") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.795] lstrlenA (lpString="*.1cd") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.md") returned 0 [0135.795] lstrlenA (lpString="*.md") returned 4 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.795] lstrlenA (lpString="*.mdf") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.795] lstrlenA (lpString="*.dbf") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.795] lstrlenA (lpString="*.odt") returned 5 [0135.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.795] lstrlenA (lpString="*.vob") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.796] lstrlenA (lpString="*.ifo") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.796] lstrlenA (lpString="*.lnk") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.796] lstrlenA (lpString="*.torrent") returned 9 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.796] lstrlenA (lpString="*.mov") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.796] lstrlenA (lpString="*.m2v") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.796] lstrlenA (lpString="*.3gp") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.796] lstrlenA (lpString="*.mpeg") returned 6 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.796] lstrlenA (lpString="*.mpg") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.796] lstrlenA (lpString="*.flv") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.796] lstrlenA (lpString="*.avi") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.796] lstrlenA (lpString="*.mp4") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.796] lstrlenA (lpString="*.wmv") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.796] lstrlenA (lpString="*.divx") returned 6 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.796] lstrlenA (lpString="*.mkv") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.796] lstrlenA (lpString="*.mp3") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.796] lstrlenA (lpString="*.wav") returned 5 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.796] lstrlenA (lpString="*.flac") returned 6 [0135.796] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.796] lstrlenA (lpString="*.ape") returned 5 [0135.797] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.797] lstrlenA (lpString="*.wma") returned 5 [0135.797] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.797] lstrlenA (lpString="*.ac3") returned 5 [0135.797] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\14aecf5c194458297815d22c33f800cf\\Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.797] lstrlenA (lpString="*.doc") returned 5 [0135.797] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e54ad12, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2e54ad12, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2e54ad12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Word.Implementation.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.797] FindClose (in: hFindFile=0x759f50 | out: hFindFile=0x759f50) returned 1 [0135.797] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fe892, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2e54ad12, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2e54ad12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14aecf5c194458297815d22c33f800cf", cAlternateFileName="14AECF~1")) returned 0 [0135.797] FindClose (in: hFindFile=0x759d90 | out: hFindFile=0x759d90) returned 1 [0135.797] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a72c421, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2a72c421, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2a72c421, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75612e6c, dwReserved1=0x78750078, cFileName="Microsoft.Oe2e369ff#", cAlternateFileName="MICROS~1.OE2")) returned 1 [0135.797] lstrcmpA (lpString1=".", lpString2="Microsoft.Oe2e369ff#") returned -1 [0135.798] lstrcmpA (lpString1="..", lpString2="Microsoft.Oe2e369ff#") returned -1 [0135.798] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.798] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Oe2e369ff#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#" [0135.798] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#") returned 67 [0135.798] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a72c421, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2a72c421, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2a72c421, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759b50 [0135.798] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.798] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a72c421, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2a72c421, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2a72c421, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.798] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.798] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.798] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a72c421, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2a75265e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2a75265e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fefa82b2c1cdd8f9d80bb4c2d90d2388", cAlternateFileName="FEFA82~1")) returned 1 [0135.798] lstrcmpA (lpString1=".", lpString2="fefa82b2c1cdd8f9d80bb4c2d90d2388") returned -1 [0135.798] lstrcmpA (lpString1="..", lpString2="fefa82b2c1cdd8f9d80bb4c2d90d2388") returned -1 [0135.798] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\*.*") returned="*.*" [0135.798] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\", lpString2="fefa82b2c1cdd8f9d80bb4c2d90d2388" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388" [0135.798] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388") returned 100 [0135.798] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a72c421, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2a75265e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2a75265e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0135.803] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.803] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a72c421, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2a75265e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2a75265e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.803] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.803] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.803] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6b9da1, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2a6b9da1, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2a77889e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Office.Tools.Excel.Implementation.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.803] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.803] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Excel.Implementation.ni.dll") returned -1 [0135.803] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Excel.Implementation.ni.dll") returned -1 [0135.803] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Excel.Implementation.ni.dll") returned -1 [0135.803] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\*.*") returned="*.*" [0135.803] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\" [0135.803] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\") returned="" [0135.803] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\HOW TO DECRYPT FILES.txt" [0135.803] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\how to decrypt files.txt")) returned 0xffffffff [0135.803] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.804] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.804] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.805] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.805] CloseHandle (hObject=0x214) returned 1 [0135.805] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\", lpString2="Microsoft.Office.Tools.Excel.Implementation.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll" [0135.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.zip") returned 0 [0135.806] lstrlenA (lpString="*.zip") returned 5 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.rar") returned 0 [0135.806] lstrlenA (lpString="*.rar") returned 5 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.7z") returned 0 [0135.806] lstrlenA (lpString="*.7z") returned 4 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.tar") returned 0 [0135.806] lstrlenA (lpString="*.tar") returned 5 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.gzip") returned 0 [0135.806] lstrlenA (lpString="*.gzip") returned 6 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.jpg") returned 0 [0135.806] lstrlenA (lpString="*.jpg") returned 5 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.jpeg") returned 0 [0135.806] lstrlenA (lpString="*.jpeg") returned 6 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.psd") returned 0 [0135.806] lstrlenA (lpString="*.psd") returned 5 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.cdr") returned 0 [0135.806] lstrlenA (lpString="*.cdr") returned 5 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.dwg") returned 0 [0135.806] lstrlenA (lpString="*.dwg") returned 5 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.max") returned 0 [0135.806] lstrlenA (lpString="*.max") returned 5 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.bmp") returned 0 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.gif") returned 0 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.png") returned 0 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.doc") returned 0 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.docx") returned 0 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.xls") returned 0 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.xlsx") returned 0 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.ppt") returned 0 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.pptx") returned 0 [0135.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.txt") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.pdf") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.djvu") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.htm") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.html") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.mdb") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.cer") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.p12") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.pfx") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.kwm") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.pwm") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.1cd") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.md") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.mdf") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.dbf") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.odt") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.vob") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.ifo") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.lnk") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.torrent") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.mov") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.m2v") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.3gp") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.mpeg") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.mpg") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.flv") returned 0 [0135.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.avi") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.mp4") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.wmv") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.divx") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.mkv") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.mp3") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.wav") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.flac") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.ape") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.wma") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.ac3") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll", pszSpec="*.doc") returned 0 [0135.808] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a75265e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2a75265e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2a75265e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.808] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.808] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux") returned -1 [0135.808] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux") returned -1 [0135.808] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux") returned -1 [0135.808] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll") returned="Microsoft.Office.Tools.Excel.Implementation.ni.dll" [0135.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\" [0135.808] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\") returned="" [0135.808] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\HOW TO DECRYPT FILES.txt" [0135.808] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\how to decrypt files.txt")) returned 0x20 [0135.808] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\", lpString2="Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux" [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.max") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.png") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.html") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.md") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\fefa82b2c1cdd8f9d80bb4c2d90d2388\\Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.811] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a75265e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2a75265e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2a75265e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Excel.Implementation.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.811] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0135.811] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a72c421, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2a75265e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2a75265e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fefa82b2c1cdd8f9d80bb4c2d90d2388", cAlternateFileName="FEFA82~1")) returned 0 [0135.811] FindClose (in: hFindFile=0x759b50 | out: hFindFile=0x759b50) returned 1 [0135.811] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c602567, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2c602567, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2c602567, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x612e6c6c, dwReserved1=0x78007875, cFileName="Microsoft.Oeab01fba#", cAlternateFileName="MICROS~1.OEA")) returned 1 [0135.811] lstrcmpA (lpString1=".", lpString2="Microsoft.Oeab01fba#") returned -1 [0135.811] lstrcmpA (lpString1="..", lpString2="Microsoft.Oeab01fba#") returned -1 [0135.811] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.811] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Oeab01fba#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#" [0135.811] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c602567, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2c602567, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2c602567, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759f50 [0135.812] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.812] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c602567, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2c602567, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2c602567, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.812] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.812] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.812] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c602567, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2cdc1629, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2cdc1629, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3b02b0480cec45c0a923875b942ceea3", cAlternateFileName="3B02B0~1")) returned 1 [0135.812] lstrcmpA (lpString1=".", lpString2="3b02b0480cec45c0a923875b942ceea3") returned -1 [0135.812] lstrcmpA (lpString1="..", lpString2="3b02b0480cec45c0a923875b942ceea3") returned -1 [0135.812] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\*.*") returned="*.*" [0135.812] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\", lpString2="3b02b0480cec45c0a923875b942ceea3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3" [0135.812] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c602567, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2cdc1629, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2cdc1629, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759f10 [0135.825] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.825] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c602567, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2cdc1629, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2cdc1629, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.825] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.825] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.826] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c58fee7, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2c58fee7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2cdc1629, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xe3600, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Office.Tools.Word.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.826] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.826] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Word.ni.dll") returned -1 [0135.826] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Word.ni.dll") returned -1 [0135.826] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Word.ni.dll") returned -1 [0135.826] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\*.*") returned="*.*" [0135.826] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\" [0135.826] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\") returned="" [0135.826] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\HOW TO DECRYPT FILES.txt" [0135.826] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\how to decrypt files.txt")) returned 0xffffffff [0135.826] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.827] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.828] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.828] CloseHandle (hObject=0x214) returned 1 [0135.828] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\", lpString2="Microsoft.Office.Tools.Word.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll" [0135.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.zip") returned 0 [0135.828] lstrlenA (lpString="*.zip") returned 5 [0135.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.rar") returned 0 [0135.828] lstrlenA (lpString="*.rar") returned 5 [0135.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.7z") returned 0 [0135.828] lstrlenA (lpString="*.7z") returned 4 [0135.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.tar") returned 0 [0135.828] lstrlenA (lpString="*.tar") returned 5 [0135.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.gzip") returned 0 [0135.828] lstrlenA (lpString="*.gzip") returned 6 [0135.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.jpg") returned 0 [0135.828] lstrlenA (lpString="*.jpg") returned 5 [0135.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.jpeg") returned 0 [0135.828] lstrlenA (lpString="*.jpeg") returned 6 [0135.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.psd") returned 0 [0135.828] lstrlenA (lpString="*.psd") returned 5 [0135.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.cdr") returned 0 [0135.828] lstrlenA (lpString="*.cdr") returned 5 [0135.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.dwg") returned 0 [0135.828] lstrlenA (lpString="*.dwg") returned 5 [0135.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.max") returned 0 [0135.829] lstrlenA (lpString="*.max") returned 5 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.bmp") returned 0 [0135.829] lstrlenA (lpString="*.bmp") returned 5 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.gif") returned 0 [0135.829] lstrlenA (lpString="*.gif") returned 5 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.png") returned 0 [0135.829] lstrlenA (lpString="*.png") returned 5 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.doc") returned 0 [0135.829] lstrlenA (lpString="*.doc") returned 5 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.docx") returned 0 [0135.829] lstrlenA (lpString="*.docx") returned 6 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.xls") returned 0 [0135.829] lstrlenA (lpString="*.xls") returned 5 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.xlsx") returned 0 [0135.829] lstrlenA (lpString="*.xlsx") returned 6 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.ppt") returned 0 [0135.829] lstrlenA (lpString="*.ppt") returned 5 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.pptx") returned 0 [0135.829] lstrlenA (lpString="*.pptx") returned 6 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.txt") returned 0 [0135.829] lstrlenA (lpString="*.txt") returned 5 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.pdf") returned 0 [0135.829] lstrlenA (lpString="*.pdf") returned 5 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.djvu") returned 0 [0135.829] lstrlenA (lpString="*.djvu") returned 6 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.htm") returned 0 [0135.829] lstrlenA (lpString="*.htm") returned 5 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.html") returned 0 [0135.829] lstrlenA (lpString="*.html") returned 6 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.mdb") returned 0 [0135.829] lstrlenA (lpString="*.mdb") returned 5 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.cer") returned 0 [0135.829] lstrlenA (lpString="*.cer") returned 5 [0135.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.p12") returned 0 [0135.829] lstrlenA (lpString="*.p12") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.pfx") returned 0 [0135.830] lstrlenA (lpString="*.pfx") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.kwm") returned 0 [0135.830] lstrlenA (lpString="*.kwm") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.pwm") returned 0 [0135.830] lstrlenA (lpString="*.pwm") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.1cd") returned 0 [0135.830] lstrlenA (lpString="*.1cd") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.md") returned 0 [0135.830] lstrlenA (lpString="*.md") returned 4 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.mdf") returned 0 [0135.830] lstrlenA (lpString="*.mdf") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.dbf") returned 0 [0135.830] lstrlenA (lpString="*.dbf") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.odt") returned 0 [0135.830] lstrlenA (lpString="*.odt") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.vob") returned 0 [0135.830] lstrlenA (lpString="*.vob") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.ifo") returned 0 [0135.830] lstrlenA (lpString="*.ifo") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.lnk") returned 0 [0135.830] lstrlenA (lpString="*.lnk") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.torrent") returned 0 [0135.830] lstrlenA (lpString="*.torrent") returned 9 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.mov") returned 0 [0135.830] lstrlenA (lpString="*.mov") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.m2v") returned 0 [0135.830] lstrlenA (lpString="*.m2v") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.3gp") returned 0 [0135.830] lstrlenA (lpString="*.3gp") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.mpeg") returned 0 [0135.830] lstrlenA (lpString="*.mpeg") returned 6 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.mpg") returned 0 [0135.830] lstrlenA (lpString="*.mpg") returned 5 [0135.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.flv") returned 0 [0135.830] lstrlenA (lpString="*.flv") returned 5 [0135.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.avi") returned 0 [0135.831] lstrlenA (lpString="*.avi") returned 5 [0135.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.mp4") returned 0 [0135.831] lstrlenA (lpString="*.mp4") returned 5 [0135.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.wmv") returned 0 [0135.831] lstrlenA (lpString="*.wmv") returned 5 [0135.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.divx") returned 0 [0135.831] lstrlenA (lpString="*.divx") returned 6 [0135.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.mkv") returned 0 [0135.831] lstrlenA (lpString="*.mkv") returned 5 [0135.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.mp3") returned 0 [0135.831] lstrlenA (lpString="*.mp3") returned 5 [0135.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.wav") returned 0 [0135.831] lstrlenA (lpString="*.wav") returned 5 [0135.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.flac") returned 0 [0135.831] lstrlenA (lpString="*.flac") returned 6 [0135.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.ape") returned 0 [0135.831] lstrlenA (lpString="*.ape") returned 5 [0135.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.wma") returned 0 [0135.832] lstrlenA (lpString="*.wma") returned 5 [0135.832] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.ac3") returned 0 [0135.832] lstrlenA (lpString="*.ac3") returned 5 [0135.832] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll", pszSpec="*.doc") returned 0 [0135.832] lstrlenA (lpString="*.doc") returned 5 [0135.832] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cbab7cf, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2cbab7cf, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2cdc1629, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Word.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.832] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.832] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Word.ni.dll.aux") returned -1 [0135.832] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Word.ni.dll.aux") returned -1 [0135.832] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Word.ni.dll.aux") returned -1 [0135.832] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll") returned="Microsoft.Office.Tools.Word.ni.dll" [0135.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\" [0135.832] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\") returned="" [0135.832] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\HOW TO DECRYPT FILES.txt" [0135.832] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\how to decrypt files.txt")) returned 0x20 [0135.832] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\", lpString2="Microsoft.Office.Tools.Word.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux" [0135.832] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.833] lstrlenA (lpString="*.zip") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.833] lstrlenA (lpString="*.rar") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.833] lstrlenA (lpString="*.7z") returned 4 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.833] lstrlenA (lpString="*.tar") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.833] lstrlenA (lpString="*.gzip") returned 6 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.833] lstrlenA (lpString="*.jpg") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.833] lstrlenA (lpString="*.jpeg") returned 6 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.833] lstrlenA (lpString="*.psd") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.833] lstrlenA (lpString="*.cdr") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.833] lstrlenA (lpString="*.dwg") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.max") returned 0 [0135.833] lstrlenA (lpString="*.max") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.833] lstrlenA (lpString="*.bmp") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.833] lstrlenA (lpString="*.gif") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.png") returned 0 [0135.833] lstrlenA (lpString="*.png") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.833] lstrlenA (lpString="*.doc") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.833] lstrlenA (lpString="*.docx") returned 6 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.833] lstrlenA (lpString="*.xls") returned 5 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.833] lstrlenA (lpString="*.xlsx") returned 6 [0135.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.834] lstrlenA (lpString="*.ppt") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.834] lstrlenA (lpString="*.pptx") returned 6 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.834] lstrlenA (lpString="*.txt") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.834] lstrlenA (lpString="*.pdf") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.834] lstrlenA (lpString="*.djvu") returned 6 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.834] lstrlenA (lpString="*.htm") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.html") returned 0 [0135.834] lstrlenA (lpString="*.html") returned 6 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.834] lstrlenA (lpString="*.mdb") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.834] lstrlenA (lpString="*.cer") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.834] lstrlenA (lpString="*.p12") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.834] lstrlenA (lpString="*.pfx") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.834] lstrlenA (lpString="*.kwm") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.834] lstrlenA (lpString="*.pwm") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.834] lstrlenA (lpString="*.1cd") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.md") returned 0 [0135.834] lstrlenA (lpString="*.md") returned 4 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.834] lstrlenA (lpString="*.mdf") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.834] lstrlenA (lpString="*.dbf") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.834] lstrlenA (lpString="*.odt") returned 5 [0135.834] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.835] lstrlenA (lpString="*.vob") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.835] lstrlenA (lpString="*.ifo") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.835] lstrlenA (lpString="*.lnk") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.835] lstrlenA (lpString="*.torrent") returned 9 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.835] lstrlenA (lpString="*.mov") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.835] lstrlenA (lpString="*.m2v") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.835] lstrlenA (lpString="*.3gp") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.835] lstrlenA (lpString="*.mpeg") returned 6 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.835] lstrlenA (lpString="*.mpg") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.835] lstrlenA (lpString="*.flv") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.835] lstrlenA (lpString="*.avi") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.835] lstrlenA (lpString="*.mp4") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.835] lstrlenA (lpString="*.wmv") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.835] lstrlenA (lpString="*.divx") returned 6 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.835] lstrlenA (lpString="*.mkv") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.835] lstrlenA (lpString="*.mp3") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.835] lstrlenA (lpString="*.wav") returned 5 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.835] lstrlenA (lpString="*.flac") returned 6 [0135.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.836] lstrlenA (lpString="*.ape") returned 5 [0135.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.836] lstrlenA (lpString="*.wma") returned 5 [0135.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.836] lstrlenA (lpString="*.ac3") returned 5 [0135.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\3b02b0480cec45c0a923875b942ceea3\\Microsoft.Office.Tools.Word.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.836] lstrlenA (lpString="*.doc") returned 5 [0135.836] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cbab7cf, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2cbab7cf, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2cdc1629, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Word.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.836] FindClose (in: hFindFile=0x759f10 | out: hFindFile=0x759f10) returned 1 [0135.836] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c602567, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2cdc1629, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2cdc1629, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3b02b0480cec45c0a923875b942ceea3", cAlternateFileName="3B02B0~1")) returned 0 [0135.836] FindClose (in: hFindFile=0x759f50 | out: hFindFile=0x759f50) returned 1 [0135.836] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb99d4572, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b65bcae, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b65bcae, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x612e6c6c, dwReserved1=0x78007875, cFileName="Microsoft.P047767ce#", cAlternateFileName="MICROS~1.P04")) returned 1 [0135.836] lstrcmpA (lpString1=".", lpString2="Microsoft.P047767ce#") returned -1 [0135.836] lstrcmpA (lpString1="..", lpString2="Microsoft.P047767ce#") returned -1 [0135.836] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.837] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.P047767ce#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#" [0135.837] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#") returned 67 [0135.837] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb99d4572, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b65bcae, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b65bcae, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0135.837] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.837] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb99d4572, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b65bcae, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b65bcae, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.838] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.838] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.838] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ce28f9, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x33d2ed58, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x33d2ed58, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7caa2ade6add8e7adbfdffd5bdcf1eed", cAlternateFileName="7CAA2A~1")) returned 1 [0135.838] lstrcmpA (lpString1=".", lpString2="7caa2ade6add8e7adbfdffd5bdcf1eed") returned -1 [0135.838] lstrcmpA (lpString1="..", lpString2="7caa2ade6add8e7adbfdffd5bdcf1eed") returned -1 [0135.838] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\*.*") returned="*.*" [0135.838] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\", lpString2="7caa2ade6add8e7adbfdffd5bdcf1eed" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed" [0135.838] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed") returned 100 [0135.838] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ce28f9, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x33d2ed58, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x33d2ed58, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0135.840] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.840] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ce28f9, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x33d2ed58, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x33d2ed58, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.840] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.840] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.840] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33c9649e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x33c9649e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x33d2ed58, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x179000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Core.Activities.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.840] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.840] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Core.Activities.ni.dll") returned -1 [0135.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Core.Activities.ni.dll") returned -1 [0135.840] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Core.Activities.ni.dll") returned -1 [0135.840] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\*.*") returned="*.*" [0135.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\" [0135.840] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\") returned="" [0135.840] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\HOW TO DECRYPT FILES.txt" [0135.840] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\how to decrypt files.txt")) returned 0xffffffff [0135.840] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.841] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.841] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.842] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.842] CloseHandle (hObject=0x214) returned 1 [0135.843] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\", lpString2="Microsoft.PowerShell.Core.Activities.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll" [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.zip") returned 0 [0135.843] lstrlenA (lpString="*.zip") returned 5 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.rar") returned 0 [0135.843] lstrlenA (lpString="*.rar") returned 5 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.7z") returned 0 [0135.843] lstrlenA (lpString="*.7z") returned 4 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.tar") returned 0 [0135.843] lstrlenA (lpString="*.tar") returned 5 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.gzip") returned 0 [0135.843] lstrlenA (lpString="*.gzip") returned 6 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.jpg") returned 0 [0135.843] lstrlenA (lpString="*.jpg") returned 5 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.jpeg") returned 0 [0135.843] lstrlenA (lpString="*.jpeg") returned 6 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.psd") returned 0 [0135.843] lstrlenA (lpString="*.psd") returned 5 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.cdr") returned 0 [0135.843] lstrlenA (lpString="*.cdr") returned 5 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.dwg") returned 0 [0135.843] lstrlenA (lpString="*.dwg") returned 5 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.max") returned 0 [0135.843] lstrlenA (lpString="*.max") returned 5 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.bmp") returned 0 [0135.843] lstrlenA (lpString="*.bmp") returned 5 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.gif") returned 0 [0135.843] lstrlenA (lpString="*.gif") returned 5 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.png") returned 0 [0135.843] lstrlenA (lpString="*.png") returned 5 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.doc") returned 0 [0135.843] lstrlenA (lpString="*.doc") returned 5 [0135.843] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.docx") returned 0 [0135.843] lstrlenA (lpString="*.docx") returned 6 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.xls") returned 0 [0135.844] lstrlenA (lpString="*.xls") returned 5 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.xlsx") returned 0 [0135.844] lstrlenA (lpString="*.xlsx") returned 6 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.ppt") returned 0 [0135.844] lstrlenA (lpString="*.ppt") returned 5 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.pptx") returned 0 [0135.844] lstrlenA (lpString="*.pptx") returned 6 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.txt") returned 0 [0135.844] lstrlenA (lpString="*.txt") returned 5 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.pdf") returned 0 [0135.844] lstrlenA (lpString="*.pdf") returned 5 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.djvu") returned 0 [0135.844] lstrlenA (lpString="*.djvu") returned 6 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.htm") returned 0 [0135.844] lstrlenA (lpString="*.htm") returned 5 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.html") returned 0 [0135.844] lstrlenA (lpString="*.html") returned 6 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.mdb") returned 0 [0135.844] lstrlenA (lpString="*.mdb") returned 5 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.cer") returned 0 [0135.844] lstrlenA (lpString="*.cer") returned 5 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.p12") returned 0 [0135.844] lstrlenA (lpString="*.p12") returned 5 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.pfx") returned 0 [0135.844] lstrlenA (lpString="*.pfx") returned 5 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.kwm") returned 0 [0135.844] lstrlenA (lpString="*.kwm") returned 5 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.pwm") returned 0 [0135.844] lstrlenA (lpString="*.pwm") returned 5 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.1cd") returned 0 [0135.844] lstrlenA (lpString="*.1cd") returned 5 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.md") returned 0 [0135.844] lstrlenA (lpString="*.md") returned 4 [0135.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.mdf") returned 0 [0135.844] lstrlenA (lpString="*.mdf") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.dbf") returned 0 [0135.845] lstrlenA (lpString="*.dbf") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.odt") returned 0 [0135.845] lstrlenA (lpString="*.odt") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.vob") returned 0 [0135.845] lstrlenA (lpString="*.vob") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.ifo") returned 0 [0135.845] lstrlenA (lpString="*.ifo") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.lnk") returned 0 [0135.845] lstrlenA (lpString="*.lnk") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.torrent") returned 0 [0135.845] lstrlenA (lpString="*.torrent") returned 9 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.mov") returned 0 [0135.845] lstrlenA (lpString="*.mov") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.m2v") returned 0 [0135.845] lstrlenA (lpString="*.m2v") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.3gp") returned 0 [0135.845] lstrlenA (lpString="*.3gp") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.mpeg") returned 0 [0135.845] lstrlenA (lpString="*.mpeg") returned 6 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.mpg") returned 0 [0135.845] lstrlenA (lpString="*.mpg") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.flv") returned 0 [0135.845] lstrlenA (lpString="*.flv") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.avi") returned 0 [0135.845] lstrlenA (lpString="*.avi") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.mp4") returned 0 [0135.845] lstrlenA (lpString="*.mp4") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.wmv") returned 0 [0135.845] lstrlenA (lpString="*.wmv") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.divx") returned 0 [0135.845] lstrlenA (lpString="*.divx") returned 6 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.mkv") returned 0 [0135.845] lstrlenA (lpString="*.mkv") returned 5 [0135.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.mp3") returned 0 [0135.846] lstrlenA (lpString="*.mp3") returned 5 [0135.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.wav") returned 0 [0135.846] lstrlenA (lpString="*.wav") returned 5 [0135.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.flac") returned 0 [0135.846] lstrlenA (lpString="*.flac") returned 6 [0135.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.ape") returned 0 [0135.846] lstrlenA (lpString="*.ape") returned 5 [0135.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.wma") returned 0 [0135.846] lstrlenA (lpString="*.wma") returned 5 [0135.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.ac3") returned 0 [0135.846] lstrlenA (lpString="*.ac3") returned 5 [0135.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll", pszSpec="*.doc") returned 0 [0135.846] lstrlenA (lpString="*.doc") returned 5 [0135.846] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d2ed58, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x33d2ed58, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x33d2ed58, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Core.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.846] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.846] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Core.Activities.ni.dll.aux") returned -1 [0135.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Core.Activities.ni.dll.aux") returned -1 [0135.846] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Core.Activities.ni.dll.aux") returned -1 [0135.846] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll") returned="Microsoft.PowerShell.Core.Activities.ni.dll" [0135.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\" [0135.846] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\") returned="" [0135.846] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\HOW TO DECRYPT FILES.txt" [0135.846] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\how to decrypt files.txt")) returned 0x20 [0135.846] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\", lpString2="Microsoft.PowerShell.Core.Activities.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux" [0135.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.846] lstrlenA (lpString="*.zip") returned 5 [0135.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.846] lstrlenA (lpString="*.rar") returned 5 [0135.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.846] lstrlenA (lpString="*.7z") returned 4 [0135.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.846] lstrlenA (lpString="*.tar") returned 5 [0135.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.847] lstrlenA (lpString="*.gzip") returned 6 [0135.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.847] lstrlenA (lpString="*.jpg") returned 5 [0135.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.847] lstrlenA (lpString="*.jpeg") returned 6 [0135.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.898] lstrlenA (lpString="*.psd") returned 5 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.898] lstrlenA (lpString="*.cdr") returned 5 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.898] lstrlenA (lpString="*.dwg") returned 5 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.max") returned 0 [0135.898] lstrlenA (lpString="*.max") returned 5 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.898] lstrlenA (lpString="*.bmp") returned 5 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.898] lstrlenA (lpString="*.gif") returned 5 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.png") returned 0 [0135.898] lstrlenA (lpString="*.png") returned 5 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.898] lstrlenA (lpString="*.doc") returned 5 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.898] lstrlenA (lpString="*.docx") returned 6 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.898] lstrlenA (lpString="*.xls") returned 5 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.898] lstrlenA (lpString="*.xlsx") returned 6 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.898] lstrlenA (lpString="*.ppt") returned 5 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.898] lstrlenA (lpString="*.pptx") returned 6 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.898] lstrlenA (lpString="*.txt") returned 5 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.898] lstrlenA (lpString="*.pdf") returned 5 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.898] lstrlenA (lpString="*.djvu") returned 6 [0135.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.898] lstrlenA (lpString="*.htm") returned 5 [0135.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.html") returned 0 [0135.899] lstrlenA (lpString="*.html") returned 6 [0135.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.899] lstrlenA (lpString="*.mdb") returned 5 [0135.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.899] lstrlenA (lpString="*.cer") returned 5 [0135.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.899] lstrlenA (lpString="*.p12") returned 5 [0135.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.899] lstrlenA (lpString="*.pfx") returned 5 [0135.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.899] lstrlenA (lpString="*.kwm") returned 5 [0135.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.899] lstrlenA (lpString="*.pwm") returned 5 [0135.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.899] lstrlenA (lpString="*.1cd") returned 5 [0135.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.md") returned 0 [0135.899] lstrlenA (lpString="*.md") returned 4 [0135.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.899] lstrlenA (lpString="*.mdf") returned 5 [0135.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.899] lstrlenA (lpString="*.dbf") returned 5 [0135.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.900] lstrlenA (lpString="*.odt") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.900] lstrlenA (lpString="*.vob") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.900] lstrlenA (lpString="*.ifo") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.900] lstrlenA (lpString="*.lnk") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.900] lstrlenA (lpString="*.torrent") returned 9 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.900] lstrlenA (lpString="*.mov") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.900] lstrlenA (lpString="*.m2v") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.900] lstrlenA (lpString="*.3gp") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.900] lstrlenA (lpString="*.mpeg") returned 6 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.900] lstrlenA (lpString="*.mpg") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.900] lstrlenA (lpString="*.flv") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.900] lstrlenA (lpString="*.avi") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.900] lstrlenA (lpString="*.mp4") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.900] lstrlenA (lpString="*.wmv") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.900] lstrlenA (lpString="*.divx") returned 6 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.900] lstrlenA (lpString="*.mkv") returned 5 [0135.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.900] lstrlenA (lpString="*.mp3") returned 5 [0135.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.901] lstrlenA (lpString="*.wav") returned 5 [0135.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.901] lstrlenA (lpString="*.flac") returned 6 [0135.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.901] lstrlenA (lpString="*.ape") returned 5 [0135.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.901] lstrlenA (lpString="*.wma") returned 5 [0135.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.901] lstrlenA (lpString="*.ac3") returned 5 [0135.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P047767ce#\\7caa2ade6add8e7adbfdffd5bdcf1eed\\Microsoft.PowerShell.Core.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.901] lstrlenA (lpString="*.doc") returned 5 [0135.901] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d2ed58, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x33d2ed58, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x33d2ed58, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Core.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.901] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0135.902] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ce28f9, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x33d2ed58, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x33d2ed58, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7caa2ade6add8e7adbfdffd5bdcf1eed", cAlternateFileName="7CAA2A~1")) returned 0 [0135.902] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0135.903] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb961aa9a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5baadb6d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5baadb6d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x612e6c6c, dwReserved1=0x78007875, cFileName="Microsoft.P08ac43d5#", cAlternateFileName="MICROS~1.P08")) returned 1 [0135.903] lstrcmpA (lpString1=".", lpString2="Microsoft.P08ac43d5#") returned -1 [0135.903] lstrcmpA (lpString1="..", lpString2="Microsoft.P08ac43d5#") returned -1 [0135.903] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.903] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.P08ac43d5#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#" [0135.903] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#") returned 67 [0135.903] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb961aa9a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5baadb6d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5baadb6d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759f10 [0135.903] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.903] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb961aa9a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5baadb6d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5baadb6d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.903] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.903] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.903] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41b7128a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x41b974c0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x41b974c0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6f9353a242e6eb05e96a56c058fc164d", cAlternateFileName="6F9353~1")) returned 1 [0135.903] lstrcmpA (lpString1=".", lpString2="6f9353a242e6eb05e96a56c058fc164d") returned -1 [0135.903] lstrcmpA (lpString1="..", lpString2="6f9353a242e6eb05e96a56c058fc164d") returned -1 [0135.903] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\*.*") returned="*.*" [0135.903] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\", lpString2="6f9353a242e6eb05e96a56c058fc164d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d" [0135.903] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d") returned 100 [0135.903] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41b7128a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x41b974c0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x41b974c0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0135.906] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.906] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41b7128a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x41b974c0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x41b974c0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.906] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.906] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.906] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b4b065, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x41b4b065, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x41b974c0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x188200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Utility.Activities.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.906] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.906] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Utility.Activities.ni.dll") returned -1 [0135.906] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Utility.Activities.ni.dll") returned -1 [0135.906] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Utility.Activities.ni.dll") returned -1 [0135.906] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\*.*") returned="*.*" [0135.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\" [0135.906] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\") returned="" [0135.906] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\HOW TO DECRYPT FILES.txt" [0135.906] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\how to decrypt files.txt")) returned 0xffffffff [0135.906] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.907] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.907] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.908] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.909] CloseHandle (hObject=0x214) returned 1 [0135.909] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\", lpString2="Microsoft.PowerShell.Utility.Activities.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll" [0135.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.zip") returned 0 [0135.909] lstrlenA (lpString="*.zip") returned 5 [0135.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.rar") returned 0 [0135.910] lstrlenA (lpString="*.rar") returned 5 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.7z") returned 0 [0135.910] lstrlenA (lpString="*.7z") returned 4 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.tar") returned 0 [0135.910] lstrlenA (lpString="*.tar") returned 5 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.gzip") returned 0 [0135.910] lstrlenA (lpString="*.gzip") returned 6 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.jpg") returned 0 [0135.910] lstrlenA (lpString="*.jpg") returned 5 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.jpeg") returned 0 [0135.910] lstrlenA (lpString="*.jpeg") returned 6 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.psd") returned 0 [0135.910] lstrlenA (lpString="*.psd") returned 5 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.cdr") returned 0 [0135.910] lstrlenA (lpString="*.cdr") returned 5 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.dwg") returned 0 [0135.910] lstrlenA (lpString="*.dwg") returned 5 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.max") returned 0 [0135.910] lstrlenA (lpString="*.max") returned 5 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.bmp") returned 0 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.gif") returned 0 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.png") returned 0 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.doc") returned 0 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.docx") returned 0 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.xls") returned 0 [0135.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.xlsx") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.ppt") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.pptx") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.txt") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.pdf") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.djvu") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.htm") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.html") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.mdb") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.cer") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.p12") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.pfx") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.kwm") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.pwm") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.1cd") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.md") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.mdf") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.dbf") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.odt") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.vob") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.ifo") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.lnk") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.torrent") returned 0 [0135.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.mov") returned 0 [0135.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.m2v") returned 0 [0135.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.3gp") returned 0 [0135.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.mpeg") returned 0 [0135.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.mpg") returned 0 [0135.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.flv") returned 0 [0135.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.avi") returned 0 [0135.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.mp4") returned 0 [0135.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.wmv") returned 0 [0135.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.divx") returned 0 [0135.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.mkv") returned 0 [0135.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.mp3") returned 0 [0135.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.wav") returned 0 [0135.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.flac") returned 0 [0135.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.ape") returned 0 [0135.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.wma") returned 0 [0135.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.ac3") returned 0 [0135.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll", pszSpec="*.doc") returned 0 [0135.927] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b974c0, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x41b974c0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x41b974c0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.927] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.927] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Utility.Activities.ni.dll.aux") returned -1 [0135.927] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Utility.Activities.ni.dll.aux") returned -1 [0135.927] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Utility.Activities.ni.dll.aux") returned -1 [0135.927] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll") returned="Microsoft.PowerShell.Utility.Activities.ni.dll" [0135.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\" [0135.927] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\") returned="" [0135.927] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\HOW TO DECRYPT FILES.txt" [0135.927] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\how to decrypt files.txt")) returned 0x20 [0135.928] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\", lpString2="Microsoft.PowerShell.Utility.Activities.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux" [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.max") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.png") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.html") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.md") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P08ac43d5#\\6f9353a242e6eb05e96a56c058fc164d\\Microsoft.PowerShell.Utility.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.930] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b974c0, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x41b974c0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x41b974c0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.930] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0135.931] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41b7128a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x41b974c0, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x41b974c0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6f9353a242e6eb05e96a56c058fc164d", cAlternateFileName="6F9353~1")) returned 0 [0135.931] FindClose (in: hFindFile=0x759f10 | out: hFindFile=0x759f10) returned 1 [0135.931] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba062d1e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b7ff49a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b7ff49a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61007875, dwReserved1=0x78007875, cFileName="Microsoft.P0e11b656#", cAlternateFileName="MICROS~1.P0E")) returned 1 [0135.931] lstrcmpA (lpString1=".", lpString2="Microsoft.P0e11b656#") returned -1 [0135.931] lstrcmpA (lpString1="..", lpString2="Microsoft.P0e11b656#") returned -1 [0135.931] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.931] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.P0e11b656#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#" [0135.931] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba062d1e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b7ff49a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b7ff49a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0135.932] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.932] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba062d1e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b7ff49a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b7ff49a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.932] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.932] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.932] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d0a9187, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3d0a9187, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3d0a9187, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b479853c7efb40daa313ce770df3d212", cAlternateFileName="B47985~1")) returned 1 [0135.932] lstrcmpA (lpString1=".", lpString2="b479853c7efb40daa313ce770df3d212") returned -1 [0135.932] lstrcmpA (lpString1="..", lpString2="b479853c7efb40daa313ce770df3d212") returned -1 [0135.932] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\*.*") returned="*.*" [0135.932] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\", lpString2="b479853c7efb40daa313ce770df3d212" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212" [0135.932] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d0a9187, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3d0a9187, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3d0a9187, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0135.935] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.935] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d0a9187, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3d0a9187, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3d0a9187, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.935] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.935] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.935] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d05cd0e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3d05cd0e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3d0cf39b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x3f2200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.GPowerShell.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.935] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.935] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.GPowerShell.ni.dll") returned -1 [0135.935] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.GPowerShell.ni.dll") returned -1 [0135.935] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.GPowerShell.ni.dll") returned -1 [0135.935] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\*.*") returned="*.*" [0135.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\" [0135.935] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\") returned="" [0135.935] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\HOW TO DECRYPT FILES.txt" [0135.935] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p0e11b656#\\b479853c7efb40daa313ce770df3d212\\how to decrypt files.txt")) returned 0xffffffff [0135.935] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p0e11b656#\\b479853c7efb40daa313ce770df3d212\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.937] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.938] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.938] CloseHandle (hObject=0x214) returned 1 [0135.938] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\", lpString2="Microsoft.PowerShell.GPowerShell.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll" [0135.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.zip") returned 0 [0135.938] lstrlenA (lpString="*.zip") returned 5 [0135.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.rar") returned 0 [0135.938] lstrlenA (lpString="*.rar") returned 5 [0135.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.7z") returned 0 [0135.938] lstrlenA (lpString="*.7z") returned 4 [0135.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.tar") returned 0 [0135.938] lstrlenA (lpString="*.tar") returned 5 [0135.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.gzip") returned 0 [0135.938] lstrlenA (lpString="*.gzip") returned 6 [0135.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.jpg") returned 0 [0135.938] lstrlenA (lpString="*.jpg") returned 5 [0135.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.jpeg") returned 0 [0135.938] lstrlenA (lpString="*.jpeg") returned 6 [0135.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.psd") returned 0 [0135.938] lstrlenA (lpString="*.psd") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.cdr") returned 0 [0135.939] lstrlenA (lpString="*.cdr") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.dwg") returned 0 [0135.939] lstrlenA (lpString="*.dwg") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.max") returned 0 [0135.939] lstrlenA (lpString="*.max") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.bmp") returned 0 [0135.939] lstrlenA (lpString="*.bmp") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.gif") returned 0 [0135.939] lstrlenA (lpString="*.gif") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.png") returned 0 [0135.939] lstrlenA (lpString="*.png") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.doc") returned 0 [0135.939] lstrlenA (lpString="*.doc") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.docx") returned 0 [0135.939] lstrlenA (lpString="*.docx") returned 6 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.xls") returned 0 [0135.939] lstrlenA (lpString="*.xls") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.xlsx") returned 0 [0135.939] lstrlenA (lpString="*.xlsx") returned 6 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.ppt") returned 0 [0135.939] lstrlenA (lpString="*.ppt") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.pptx") returned 0 [0135.939] lstrlenA (lpString="*.pptx") returned 6 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.txt") returned 0 [0135.939] lstrlenA (lpString="*.txt") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.pdf") returned 0 [0135.939] lstrlenA (lpString="*.pdf") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.djvu") returned 0 [0135.939] lstrlenA (lpString="*.djvu") returned 6 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.htm") returned 0 [0135.939] lstrlenA (lpString="*.htm") returned 5 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.html") returned 0 [0135.939] lstrlenA (lpString="*.html") returned 6 [0135.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mdb") returned 0 [0135.939] lstrlenA (lpString="*.mdb") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.cer") returned 0 [0135.940] lstrlenA (lpString="*.cer") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.p12") returned 0 [0135.940] lstrlenA (lpString="*.p12") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.pfx") returned 0 [0135.940] lstrlenA (lpString="*.pfx") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.kwm") returned 0 [0135.940] lstrlenA (lpString="*.kwm") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.pwm") returned 0 [0135.940] lstrlenA (lpString="*.pwm") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.1cd") returned 0 [0135.940] lstrlenA (lpString="*.1cd") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.md") returned 0 [0135.940] lstrlenA (lpString="*.md") returned 4 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mdf") returned 0 [0135.940] lstrlenA (lpString="*.mdf") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.dbf") returned 0 [0135.940] lstrlenA (lpString="*.dbf") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.odt") returned 0 [0135.940] lstrlenA (lpString="*.odt") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.vob") returned 0 [0135.940] lstrlenA (lpString="*.vob") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.ifo") returned 0 [0135.940] lstrlenA (lpString="*.ifo") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.lnk") returned 0 [0135.940] lstrlenA (lpString="*.lnk") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.torrent") returned 0 [0135.940] lstrlenA (lpString="*.torrent") returned 9 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mov") returned 0 [0135.940] lstrlenA (lpString="*.mov") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.m2v") returned 0 [0135.940] lstrlenA (lpString="*.m2v") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.3gp") returned 0 [0135.940] lstrlenA (lpString="*.3gp") returned 5 [0135.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mpeg") returned 0 [0135.940] lstrlenA (lpString="*.mpeg") returned 6 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mpg") returned 0 [0135.941] lstrlenA (lpString="*.mpg") returned 5 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.flv") returned 0 [0135.941] lstrlenA (lpString="*.flv") returned 5 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.avi") returned 0 [0135.941] lstrlenA (lpString="*.avi") returned 5 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mp4") returned 0 [0135.941] lstrlenA (lpString="*.mp4") returned 5 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.wmv") returned 0 [0135.941] lstrlenA (lpString="*.wmv") returned 5 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.divx") returned 0 [0135.941] lstrlenA (lpString="*.divx") returned 6 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mkv") returned 0 [0135.941] lstrlenA (lpString="*.mkv") returned 5 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mp3") returned 0 [0135.941] lstrlenA (lpString="*.mp3") returned 5 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.wav") returned 0 [0135.941] lstrlenA (lpString="*.wav") returned 5 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.flac") returned 0 [0135.941] lstrlenA (lpString="*.flac") returned 6 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.ape") returned 0 [0135.941] lstrlenA (lpString="*.ape") returned 5 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.wma") returned 0 [0135.941] lstrlenA (lpString="*.wma") returned 5 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.ac3") returned 0 [0135.941] lstrlenA (lpString="*.ac3") returned 5 [0135.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.doc") returned 0 [0135.941] lstrlenA (lpString="*.doc") returned 5 [0135.941] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0a9187, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3d0a9187, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3d0a9187, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.GPowerShell.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.941] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.941] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.GPowerShell.ni.dll.aux") returned -1 [0135.941] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.GPowerShell.ni.dll.aux") returned -1 [0135.941] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.GPowerShell.ni.dll.aux") returned -1 [0135.941] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll") returned="Microsoft.PowerShell.GPowerShell.ni.dll" [0135.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\" [0135.942] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\") returned="" [0135.942] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\HOW TO DECRYPT FILES.txt" [0135.942] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p0e11b656#\\b479853c7efb40daa313ce770df3d212\\how to decrypt files.txt")) returned 0x20 [0135.942] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\", lpString2="Microsoft.PowerShell.GPowerShell.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux" [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.942] lstrlenA (lpString="*.zip") returned 5 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.942] lstrlenA (lpString="*.rar") returned 5 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.942] lstrlenA (lpString="*.7z") returned 4 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.942] lstrlenA (lpString="*.tar") returned 5 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.942] lstrlenA (lpString="*.gzip") returned 6 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.942] lstrlenA (lpString="*.jpg") returned 5 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.942] lstrlenA (lpString="*.jpeg") returned 6 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.942] lstrlenA (lpString="*.psd") returned 5 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.942] lstrlenA (lpString="*.cdr") returned 5 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.942] lstrlenA (lpString="*.dwg") returned 5 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.max") returned 0 [0135.942] lstrlenA (lpString="*.max") returned 5 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.942] lstrlenA (lpString="*.bmp") returned 5 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.942] lstrlenA (lpString="*.gif") returned 5 [0135.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.png") returned 0 [0135.942] lstrlenA (lpString="*.png") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.943] lstrlenA (lpString="*.doc") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.943] lstrlenA (lpString="*.docx") returned 6 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.943] lstrlenA (lpString="*.xls") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.943] lstrlenA (lpString="*.xlsx") returned 6 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.943] lstrlenA (lpString="*.ppt") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.943] lstrlenA (lpString="*.pptx") returned 6 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.943] lstrlenA (lpString="*.txt") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.943] lstrlenA (lpString="*.pdf") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.943] lstrlenA (lpString="*.djvu") returned 6 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.943] lstrlenA (lpString="*.htm") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.html") returned 0 [0135.943] lstrlenA (lpString="*.html") returned 6 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.943] lstrlenA (lpString="*.mdb") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.943] lstrlenA (lpString="*.cer") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.943] lstrlenA (lpString="*.p12") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.943] lstrlenA (lpString="*.pfx") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.943] lstrlenA (lpString="*.kwm") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.943] lstrlenA (lpString="*.pwm") returned 5 [0135.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.943] lstrlenA (lpString="*.1cd") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.md") returned 0 [0135.944] lstrlenA (lpString="*.md") returned 4 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.944] lstrlenA (lpString="*.mdf") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.944] lstrlenA (lpString="*.dbf") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.944] lstrlenA (lpString="*.odt") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.944] lstrlenA (lpString="*.vob") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.944] lstrlenA (lpString="*.ifo") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.944] lstrlenA (lpString="*.lnk") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.944] lstrlenA (lpString="*.torrent") returned 9 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.944] lstrlenA (lpString="*.mov") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.944] lstrlenA (lpString="*.m2v") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.944] lstrlenA (lpString="*.3gp") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.944] lstrlenA (lpString="*.mpeg") returned 6 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.944] lstrlenA (lpString="*.mpg") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.944] lstrlenA (lpString="*.flv") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.944] lstrlenA (lpString="*.avi") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.944] lstrlenA (lpString="*.mp4") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.944] lstrlenA (lpString="*.wmv") returned 5 [0135.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.944] lstrlenA (lpString="*.divx") returned 6 [0135.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.945] lstrlenA (lpString="*.mkv") returned 5 [0135.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.945] lstrlenA (lpString="*.mp3") returned 5 [0135.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.945] lstrlenA (lpString="*.wav") returned 5 [0135.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.945] lstrlenA (lpString="*.flac") returned 6 [0135.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.945] lstrlenA (lpString="*.ape") returned 5 [0135.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.945] lstrlenA (lpString="*.wma") returned 5 [0135.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.945] lstrlenA (lpString="*.ac3") returned 5 [0135.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P0e11b656#\\b479853c7efb40daa313ce770df3d212\\Microsoft.PowerShell.GPowerShell.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.945] lstrlenA (lpString="*.doc") returned 5 [0135.945] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0a9187, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3d0a9187, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3d0a9187, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.GPowerShell.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.945] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0135.945] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d0a9187, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3d0a9187, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3d0a9187, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b479853c7efb40daa313ce770df3d212", cAlternateFileName="B47985~1")) returned 0 [0135.946] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0135.946] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9c5cd98, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b78ce61, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b78ce61, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61007875, dwReserved1=0x78007875, cFileName="Microsoft.P10d01611#", cAlternateFileName="MICROS~1.P10")) returned 1 [0135.946] lstrcmpA (lpString1=".", lpString2="Microsoft.P10d01611#") returned -1 [0135.946] lstrcmpA (lpString1="..", lpString2="Microsoft.P10d01611#") returned -1 [0135.946] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.946] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.P10d01611#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#" [0135.946] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#") returned 67 [0135.946] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9c5cd98, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b78ce61, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b78ce61, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0135.946] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.946] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9c5cd98, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b78ce61, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b78ce61, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.946] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.946] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.946] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a8bcbda, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3a9a1913, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3a9a1913, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5586e007c81bb838149d6fecf517872f", cAlternateFileName="5586E0~1")) returned 1 [0135.946] lstrcmpA (lpString1=".", lpString2="5586e007c81bb838149d6fecf517872f") returned -1 [0135.946] lstrcmpA (lpString1="..", lpString2="5586e007c81bb838149d6fecf517872f") returned -1 [0135.946] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\*.*") returned="*.*" [0135.947] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\", lpString2="5586e007c81bb838149d6fecf517872f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f" [0135.947] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f") returned 100 [0135.947] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a8bcbda, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3a9a1913, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3a9a1913, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759f50 [0135.948] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.948] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a8bcbda, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3a9a1913, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3a9a1913, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.948] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.948] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.948] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a824335, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3a824335, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3a9c7b16, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x71fe00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Editor.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.948] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.949] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Editor.ni.dll") returned -1 [0135.949] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Editor.ni.dll") returned -1 [0135.949] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Editor.ni.dll") returned -1 [0135.949] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\*.*") returned="*.*" [0135.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\" [0135.949] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\") returned="" [0135.949] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\HOW TO DECRYPT FILES.txt" [0135.949] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p10d01611#\\5586e007c81bb838149d6fecf517872f\\how to decrypt files.txt")) returned 0xffffffff [0135.949] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p10d01611#\\5586e007c81bb838149d6fecf517872f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.950] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.950] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.951] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.951] CloseHandle (hObject=0x214) returned 1 [0135.952] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\", lpString2="Microsoft.PowerShell.Editor.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll" [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.zip") returned 0 [0135.952] lstrlenA (lpString="*.zip") returned 5 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.rar") returned 0 [0135.952] lstrlenA (lpString="*.rar") returned 5 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.7z") returned 0 [0135.952] lstrlenA (lpString="*.7z") returned 4 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.tar") returned 0 [0135.952] lstrlenA (lpString="*.tar") returned 5 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.gzip") returned 0 [0135.952] lstrlenA (lpString="*.gzip") returned 6 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.jpg") returned 0 [0135.952] lstrlenA (lpString="*.jpg") returned 5 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.jpeg") returned 0 [0135.952] lstrlenA (lpString="*.jpeg") returned 6 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.psd") returned 0 [0135.952] lstrlenA (lpString="*.psd") returned 5 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.cdr") returned 0 [0135.952] lstrlenA (lpString="*.cdr") returned 5 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.dwg") returned 0 [0135.952] lstrlenA (lpString="*.dwg") returned 5 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.max") returned 0 [0135.952] lstrlenA (lpString="*.max") returned 5 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.bmp") returned 0 [0135.952] lstrlenA (lpString="*.bmp") returned 5 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.gif") returned 0 [0135.952] lstrlenA (lpString="*.gif") returned 5 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.png") returned 0 [0135.952] lstrlenA (lpString="*.png") returned 5 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.doc") returned 0 [0135.952] lstrlenA (lpString="*.doc") returned 5 [0135.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.docx") returned 0 [0135.953] lstrlenA (lpString="*.docx") returned 6 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.xls") returned 0 [0135.953] lstrlenA (lpString="*.xls") returned 5 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.xlsx") returned 0 [0135.953] lstrlenA (lpString="*.xlsx") returned 6 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.ppt") returned 0 [0135.953] lstrlenA (lpString="*.ppt") returned 5 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.pptx") returned 0 [0135.953] lstrlenA (lpString="*.pptx") returned 6 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.txt") returned 0 [0135.953] lstrlenA (lpString="*.txt") returned 5 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.pdf") returned 0 [0135.953] lstrlenA (lpString="*.pdf") returned 5 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.djvu") returned 0 [0135.953] lstrlenA (lpString="*.djvu") returned 6 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.htm") returned 0 [0135.953] lstrlenA (lpString="*.htm") returned 5 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.html") returned 0 [0135.953] lstrlenA (lpString="*.html") returned 6 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mdb") returned 0 [0135.953] lstrlenA (lpString="*.mdb") returned 5 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.cer") returned 0 [0135.953] lstrlenA (lpString="*.cer") returned 5 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.p12") returned 0 [0135.953] lstrlenA (lpString="*.p12") returned 5 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.pfx") returned 0 [0135.953] lstrlenA (lpString="*.pfx") returned 5 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.kwm") returned 0 [0135.953] lstrlenA (lpString="*.kwm") returned 5 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.pwm") returned 0 [0135.953] lstrlenA (lpString="*.pwm") returned 5 [0135.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.1cd") returned 0 [0135.953] lstrlenA (lpString="*.1cd") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.md") returned 0 [0135.954] lstrlenA (lpString="*.md") returned 4 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mdf") returned 0 [0135.954] lstrlenA (lpString="*.mdf") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.dbf") returned 0 [0135.954] lstrlenA (lpString="*.dbf") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.odt") returned 0 [0135.954] lstrlenA (lpString="*.odt") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.vob") returned 0 [0135.954] lstrlenA (lpString="*.vob") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.ifo") returned 0 [0135.954] lstrlenA (lpString="*.ifo") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.lnk") returned 0 [0135.954] lstrlenA (lpString="*.lnk") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.torrent") returned 0 [0135.954] lstrlenA (lpString="*.torrent") returned 9 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mov") returned 0 [0135.954] lstrlenA (lpString="*.mov") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.m2v") returned 0 [0135.954] lstrlenA (lpString="*.m2v") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.3gp") returned 0 [0135.954] lstrlenA (lpString="*.3gp") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mpeg") returned 0 [0135.954] lstrlenA (lpString="*.mpeg") returned 6 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mpg") returned 0 [0135.954] lstrlenA (lpString="*.mpg") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.flv") returned 0 [0135.954] lstrlenA (lpString="*.flv") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.avi") returned 0 [0135.954] lstrlenA (lpString="*.avi") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mp4") returned 0 [0135.954] lstrlenA (lpString="*.mp4") returned 5 [0135.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.wmv") returned 0 [0135.955] lstrlenA (lpString="*.wmv") returned 5 [0135.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.divx") returned 0 [0135.955] lstrlenA (lpString="*.divx") returned 6 [0135.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mkv") returned 0 [0135.955] lstrlenA (lpString="*.mkv") returned 5 [0135.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mp3") returned 0 [0135.955] lstrlenA (lpString="*.mp3") returned 5 [0135.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.wav") returned 0 [0135.955] lstrlenA (lpString="*.wav") returned 5 [0135.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.flac") returned 0 [0135.955] lstrlenA (lpString="*.flac") returned 6 [0135.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.ape") returned 0 [0135.955] lstrlenA (lpString="*.ape") returned 5 [0135.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.wma") returned 0 [0135.955] lstrlenA (lpString="*.wma") returned 5 [0135.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.ac3") returned 0 [0135.955] lstrlenA (lpString="*.ac3") returned 5 [0135.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.doc") returned 0 [0135.955] lstrlenA (lpString="*.doc") returned 5 [0135.955] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a1913, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3a9a1913, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3a9a1913, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x94c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Editor.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.955] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.955] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Editor.ni.dll.aux") returned -1 [0135.955] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Editor.ni.dll.aux") returned -1 [0135.955] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Editor.ni.dll.aux") returned -1 [0135.955] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll") returned="Microsoft.PowerShell.Editor.ni.dll" [0135.955] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\" [0135.955] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\") returned="" [0135.955] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\HOW TO DECRYPT FILES.txt" [0135.955] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p10d01611#\\5586e007c81bb838149d6fecf517872f\\how to decrypt files.txt")) returned 0x20 [0135.955] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\", lpString2="Microsoft.PowerShell.Editor.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux" [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.956] lstrlenA (lpString="*.zip") returned 5 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.956] lstrlenA (lpString="*.rar") returned 5 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.956] lstrlenA (lpString="*.7z") returned 4 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.956] lstrlenA (lpString="*.tar") returned 5 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.956] lstrlenA (lpString="*.gzip") returned 6 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.956] lstrlenA (lpString="*.jpg") returned 5 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.956] lstrlenA (lpString="*.jpeg") returned 6 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.956] lstrlenA (lpString="*.psd") returned 5 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.956] lstrlenA (lpString="*.cdr") returned 5 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.956] lstrlenA (lpString="*.dwg") returned 5 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.max") returned 0 [0135.956] lstrlenA (lpString="*.max") returned 5 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.956] lstrlenA (lpString="*.bmp") returned 5 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.956] lstrlenA (lpString="*.gif") returned 5 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.png") returned 0 [0135.956] lstrlenA (lpString="*.png") returned 5 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.956] lstrlenA (lpString="*.doc") returned 5 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.956] lstrlenA (lpString="*.docx") returned 6 [0135.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.957] lstrlenA (lpString="*.xls") returned 5 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.957] lstrlenA (lpString="*.xlsx") returned 6 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.957] lstrlenA (lpString="*.ppt") returned 5 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.957] lstrlenA (lpString="*.pptx") returned 6 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.957] lstrlenA (lpString="*.txt") returned 5 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.957] lstrlenA (lpString="*.pdf") returned 5 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.957] lstrlenA (lpString="*.djvu") returned 6 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.957] lstrlenA (lpString="*.htm") returned 5 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.html") returned 0 [0135.957] lstrlenA (lpString="*.html") returned 6 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.957] lstrlenA (lpString="*.mdb") returned 5 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.957] lstrlenA (lpString="*.cer") returned 5 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.957] lstrlenA (lpString="*.p12") returned 5 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.957] lstrlenA (lpString="*.pfx") returned 5 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.957] lstrlenA (lpString="*.kwm") returned 5 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.957] lstrlenA (lpString="*.pwm") returned 5 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.957] lstrlenA (lpString="*.1cd") returned 5 [0135.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.md") returned 0 [0135.957] lstrlenA (lpString="*.md") returned 4 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.958] lstrlenA (lpString="*.mdf") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.958] lstrlenA (lpString="*.dbf") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.958] lstrlenA (lpString="*.odt") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.958] lstrlenA (lpString="*.vob") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.958] lstrlenA (lpString="*.ifo") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.958] lstrlenA (lpString="*.lnk") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.958] lstrlenA (lpString="*.torrent") returned 9 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.958] lstrlenA (lpString="*.mov") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.958] lstrlenA (lpString="*.m2v") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.958] lstrlenA (lpString="*.3gp") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.958] lstrlenA (lpString="*.mpeg") returned 6 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.958] lstrlenA (lpString="*.mpg") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.958] lstrlenA (lpString="*.flv") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.958] lstrlenA (lpString="*.avi") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.958] lstrlenA (lpString="*.mp4") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.958] lstrlenA (lpString="*.wmv") returned 5 [0135.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.958] lstrlenA (lpString="*.divx") returned 6 [0135.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.959] lstrlenA (lpString="*.mkv") returned 5 [0135.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.959] lstrlenA (lpString="*.mp3") returned 5 [0135.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.959] lstrlenA (lpString="*.wav") returned 5 [0135.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.959] lstrlenA (lpString="*.flac") returned 6 [0135.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.959] lstrlenA (lpString="*.ape") returned 5 [0135.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.959] lstrlenA (lpString="*.wma") returned 5 [0135.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.959] lstrlenA (lpString="*.ac3") returned 5 [0135.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P10d01611#\\5586e007c81bb838149d6fecf517872f\\Microsoft.PowerShell.Editor.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.959] lstrlenA (lpString="*.doc") returned 5 [0135.959] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a1913, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3a9a1913, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3a9a1913, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x94c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Editor.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.959] FindClose (in: hFindFile=0x759f50 | out: hFindFile=0x759f50) returned 1 [0135.959] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a8bcbda, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3a9a1913, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3a9a1913, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5586e007c81bb838149d6fecf517872f", cAlternateFileName="5586E0~1")) returned 0 [0135.959] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0135.960] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8f6609e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b41fc7d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b41fc7d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61007875, dwReserved1=0x78007875, cFileName="Microsoft.P1706cafe#", cAlternateFileName="MICROS~1.P17")) returned 1 [0135.960] lstrcmpA (lpString1=".", lpString2="Microsoft.P1706cafe#") returned -1 [0135.960] lstrcmpA (lpString1="..", lpString2="Microsoft.P1706cafe#") returned -1 [0135.960] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.960] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.P1706cafe#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#" [0135.960] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#") returned 67 [0135.960] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8f6609e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b41fc7d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b41fc7d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0135.960] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.960] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8f6609e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b41fc7d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b41fc7d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.961] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.961] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.961] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3188978f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x318af9b7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x318af9b7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c88674b71c60661da315ad83a8543888", cAlternateFileName="C88674~1")) returned 1 [0135.961] lstrcmpA (lpString1=".", lpString2="c88674b71c60661da315ad83a8543888") returned -1 [0135.961] lstrcmpA (lpString1="..", lpString2="c88674b71c60661da315ad83a8543888") returned -1 [0135.961] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\*.*") returned="*.*" [0135.961] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\", lpString2="c88674b71c60661da315ad83a8543888" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888" [0135.961] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888") returned 100 [0135.961] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3188978f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x318af9b7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x318af9b7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0135.973] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.973] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3188978f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x318af9b7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x318af9b7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.973] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.973] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.973] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188978f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3188978f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x318af9b7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5ea00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Commands.Diagnostics.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.973] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Commands.Diagnostics.ni.dll") returned -1 [0135.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Commands.Diagnostics.ni.dll") returned -1 [0135.973] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Commands.Diagnostics.ni.dll") returned -1 [0135.973] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\*.*") returned="*.*" [0135.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\" [0135.973] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\") returned="" [0135.973] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\HOW TO DECRYPT FILES.txt" [0135.974] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p1706cafe#\\c88674b71c60661da315ad83a8543888\\how to decrypt files.txt")) returned 0xffffffff [0135.974] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p1706cafe#\\c88674b71c60661da315ad83a8543888\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.975] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0135.975] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.976] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.976] CloseHandle (hObject=0x214) returned 1 [0135.976] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\", lpString2="Microsoft.PowerShell.Commands.Diagnostics.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll" [0135.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.zip") returned 0 [0135.976] lstrlenA (lpString="*.zip") returned 5 [0135.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.rar") returned 0 [0135.976] lstrlenA (lpString="*.rar") returned 5 [0135.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.7z") returned 0 [0135.976] lstrlenA (lpString="*.7z") returned 4 [0135.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.tar") returned 0 [0135.976] lstrlenA (lpString="*.tar") returned 5 [0135.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.gzip") returned 0 [0135.976] lstrlenA (lpString="*.gzip") returned 6 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.jpg") returned 0 [0135.977] lstrlenA (lpString="*.jpg") returned 5 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.jpeg") returned 0 [0135.977] lstrlenA (lpString="*.jpeg") returned 6 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.psd") returned 0 [0135.977] lstrlenA (lpString="*.psd") returned 5 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.cdr") returned 0 [0135.977] lstrlenA (lpString="*.cdr") returned 5 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.dwg") returned 0 [0135.977] lstrlenA (lpString="*.dwg") returned 5 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.max") returned 0 [0135.977] lstrlenA (lpString="*.max") returned 5 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.bmp") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.gif") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.png") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.doc") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.docx") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.xls") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.xlsx") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.ppt") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.pptx") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.txt") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.pdf") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.djvu") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.htm") returned 0 [0135.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.html") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mdb") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.cer") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.p12") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.pfx") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.kwm") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.pwm") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.1cd") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.md") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mdf") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.dbf") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.odt") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.vob") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.ifo") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.lnk") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.torrent") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mov") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.m2v") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.3gp") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mpeg") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mpg") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.flv") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.avi") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mp4") returned 0 [0135.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.wmv") returned 0 [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.divx") returned 0 [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mkv") returned 0 [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mp3") returned 0 [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.wav") returned 0 [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.flac") returned 0 [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.ape") returned 0 [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.wma") returned 0 [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.ac3") returned 0 [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.doc") returned 0 [0135.979] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188978f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3188978f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x318af9b7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.979] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.979] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux") returned -1 [0135.979] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux") returned -1 [0135.979] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux") returned -1 [0135.979] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll") returned="Microsoft.PowerShell.Commands.Diagnostics.ni.dll" [0135.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\" [0135.979] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\") returned="" [0135.979] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\HOW TO DECRYPT FILES.txt" [0135.979] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p1706cafe#\\c88674b71c60661da315ad83a8543888\\how to decrypt files.txt")) returned 0x20 [0135.979] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\", lpString2="Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux" [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.max") returned 0 [0135.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.png") returned 0 [0135.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.html") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.md") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P1706cafe#\\c88674b71c60661da315ad83a8543888\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.984] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188978f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3188978f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x318af9b7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Commands.Diagnostics.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.984] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0135.984] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3188978f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x318af9b7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x318af9b7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c88674b71c60661da315ad83a8543888", cAlternateFileName="C88674~1")) returned 0 [0135.984] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0135.985] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9fa415b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b6ce308, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b6ce308, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7875612e, dwReserved1=0x78007800, cFileName="Microsoft.P34f388c1#", cAlternateFileName="MICROS~1.P34")) returned 1 [0135.985] lstrcmpA (lpString1=".", lpString2="Microsoft.P34f388c1#") returned -1 [0135.985] lstrcmpA (lpString1="..", lpString2="Microsoft.P34f388c1#") returned -1 [0135.985] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0135.985] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.P34f388c1#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#" [0135.985] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9fa415b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b6ce308, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b6ce308, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759f10 [0135.985] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.985] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9fa415b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b6ce308, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b6ce308, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.985] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.985] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.985] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34c14652, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x34ec2f2c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x34ec2f2c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8d36ba3ca17e3d63745b71277e0c629e", cAlternateFileName="8D36BA~1")) returned 1 [0135.985] lstrcmpA (lpString1=".", lpString2="8d36ba3ca17e3d63745b71277e0c629e") returned -1 [0135.985] lstrcmpA (lpString1="..", lpString2="8d36ba3ca17e3d63745b71277e0c629e") returned -1 [0135.985] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\*.*") returned="*.*" [0135.985] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\", lpString2="8d36ba3ca17e3d63745b71277e0c629e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e" [0135.985] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34c14652, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x34ec2f2c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x34ec2f2c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0135.988] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.988] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34c14652, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x34ec2f2c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x34ec2f2c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0135.988] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.988] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.988] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c14652, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x34c14652, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x34ec2f2c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x6b800, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Diagnostics.Activities.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0135.988] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Diagnostics.Activities.ni.dll") returned -1 [0135.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Diagnostics.Activities.ni.dll") returned -1 [0135.988] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Diagnostics.Activities.ni.dll") returned -1 [0135.988] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\*.*") returned="*.*" [0135.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\" [0135.988] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\") returned="" [0135.988] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\HOW TO DECRYPT FILES.txt" [0135.988] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\how to decrypt files.txt")) returned 0xffffffff [0135.988] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0135.989] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0135.990] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.990] CloseHandle (hObject=0x214) returned 1 [0135.990] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\", lpString2="Microsoft.PowerShell.Diagnostics.Activities.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll" [0135.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.zip") returned 0 [0135.990] lstrlenA (lpString="*.zip") returned 5 [0135.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.rar") returned 0 [0135.990] lstrlenA (lpString="*.rar") returned 5 [0135.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.7z") returned 0 [0135.990] lstrlenA (lpString="*.7z") returned 4 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.tar") returned 0 [0135.991] lstrlenA (lpString="*.tar") returned 5 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.gzip") returned 0 [0135.991] lstrlenA (lpString="*.gzip") returned 6 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.jpg") returned 0 [0135.991] lstrlenA (lpString="*.jpg") returned 5 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.jpeg") returned 0 [0135.991] lstrlenA (lpString="*.jpeg") returned 6 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.psd") returned 0 [0135.991] lstrlenA (lpString="*.psd") returned 5 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.cdr") returned 0 [0135.991] lstrlenA (lpString="*.cdr") returned 5 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.dwg") returned 0 [0135.991] lstrlenA (lpString="*.dwg") returned 5 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.max") returned 0 [0135.991] lstrlenA (lpString="*.max") returned 5 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.bmp") returned 0 [0135.991] lstrlenA (lpString="*.bmp") returned 5 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.gif") returned 0 [0135.991] lstrlenA (lpString="*.gif") returned 5 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.png") returned 0 [0135.991] lstrlenA (lpString="*.png") returned 5 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.doc") returned 0 [0135.991] lstrlenA (lpString="*.doc") returned 5 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.docx") returned 0 [0135.991] lstrlenA (lpString="*.docx") returned 6 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.xls") returned 0 [0135.991] lstrlenA (lpString="*.xls") returned 5 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.xlsx") returned 0 [0135.991] lstrlenA (lpString="*.xlsx") returned 6 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.ppt") returned 0 [0135.991] lstrlenA (lpString="*.ppt") returned 5 [0135.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.pptx") returned 0 [0135.992] lstrlenA (lpString="*.pptx") returned 6 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.txt") returned 0 [0135.992] lstrlenA (lpString="*.txt") returned 5 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.pdf") returned 0 [0135.992] lstrlenA (lpString="*.pdf") returned 5 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.djvu") returned 0 [0135.992] lstrlenA (lpString="*.djvu") returned 6 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.htm") returned 0 [0135.992] lstrlenA (lpString="*.htm") returned 5 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.html") returned 0 [0135.992] lstrlenA (lpString="*.html") returned 6 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.mdb") returned 0 [0135.992] lstrlenA (lpString="*.mdb") returned 5 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.cer") returned 0 [0135.992] lstrlenA (lpString="*.cer") returned 5 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.p12") returned 0 [0135.992] lstrlenA (lpString="*.p12") returned 5 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.pfx") returned 0 [0135.992] lstrlenA (lpString="*.pfx") returned 5 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.kwm") returned 0 [0135.992] lstrlenA (lpString="*.kwm") returned 5 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.pwm") returned 0 [0135.992] lstrlenA (lpString="*.pwm") returned 5 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.1cd") returned 0 [0135.992] lstrlenA (lpString="*.1cd") returned 5 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.md") returned 0 [0135.992] lstrlenA (lpString="*.md") returned 4 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.mdf") returned 0 [0135.992] lstrlenA (lpString="*.mdf") returned 5 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.dbf") returned 0 [0135.992] lstrlenA (lpString="*.dbf") returned 5 [0135.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.odt") returned 0 [0135.992] lstrlenA (lpString="*.odt") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.vob") returned 0 [0135.993] lstrlenA (lpString="*.vob") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.ifo") returned 0 [0135.993] lstrlenA (lpString="*.ifo") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.lnk") returned 0 [0135.993] lstrlenA (lpString="*.lnk") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.torrent") returned 0 [0135.993] lstrlenA (lpString="*.torrent") returned 9 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.mov") returned 0 [0135.993] lstrlenA (lpString="*.mov") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.m2v") returned 0 [0135.993] lstrlenA (lpString="*.m2v") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.3gp") returned 0 [0135.993] lstrlenA (lpString="*.3gp") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.mpeg") returned 0 [0135.993] lstrlenA (lpString="*.mpeg") returned 6 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.mpg") returned 0 [0135.993] lstrlenA (lpString="*.mpg") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.flv") returned 0 [0135.993] lstrlenA (lpString="*.flv") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.avi") returned 0 [0135.993] lstrlenA (lpString="*.avi") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.mp4") returned 0 [0135.993] lstrlenA (lpString="*.mp4") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.wmv") returned 0 [0135.993] lstrlenA (lpString="*.wmv") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.divx") returned 0 [0135.993] lstrlenA (lpString="*.divx") returned 6 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.mkv") returned 0 [0135.993] lstrlenA (lpString="*.mkv") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.mp3") returned 0 [0135.993] lstrlenA (lpString="*.mp3") returned 5 [0135.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.wav") returned 0 [0135.994] lstrlenA (lpString="*.wav") returned 5 [0135.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.flac") returned 0 [0135.994] lstrlenA (lpString="*.flac") returned 6 [0135.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.ape") returned 0 [0135.994] lstrlenA (lpString="*.ape") returned 5 [0135.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.wma") returned 0 [0135.994] lstrlenA (lpString="*.wma") returned 5 [0135.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.ac3") returned 0 [0135.994] lstrlenA (lpString="*.ac3") returned 5 [0135.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll", pszSpec="*.doc") returned 0 [0135.994] lstrlenA (lpString="*.doc") returned 5 [0135.994] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c60aa6, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x34c60aa6, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x34ec2f2c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0135.994] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0135.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux") returned -1 [0135.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux") returned -1 [0135.994] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux") returned -1 [0135.994] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll") returned="Microsoft.PowerShell.Diagnostics.Activities.ni.dll" [0135.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\" [0135.994] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\") returned="" [0135.994] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\HOW TO DECRYPT FILES.txt" [0135.994] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\how to decrypt files.txt")) returned 0x20 [0135.994] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\", lpString2="Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux" [0135.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.zip") returned 0 [0135.994] lstrlenA (lpString="*.zip") returned 5 [0135.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.rar") returned 0 [0135.994] lstrlenA (lpString="*.rar") returned 5 [0135.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.7z") returned 0 [0135.994] lstrlenA (lpString="*.7z") returned 4 [0135.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.tar") returned 0 [0135.995] lstrlenA (lpString="*.tar") returned 5 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.gzip") returned 0 [0135.995] lstrlenA (lpString="*.gzip") returned 6 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.jpg") returned 0 [0135.995] lstrlenA (lpString="*.jpg") returned 5 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0135.995] lstrlenA (lpString="*.jpeg") returned 6 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.psd") returned 0 [0135.995] lstrlenA (lpString="*.psd") returned 5 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.cdr") returned 0 [0135.995] lstrlenA (lpString="*.cdr") returned 5 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.dwg") returned 0 [0135.995] lstrlenA (lpString="*.dwg") returned 5 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.max") returned 0 [0135.995] lstrlenA (lpString="*.max") returned 5 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.bmp") returned 0 [0135.995] lstrlenA (lpString="*.bmp") returned 5 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.gif") returned 0 [0135.995] lstrlenA (lpString="*.gif") returned 5 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.png") returned 0 [0135.995] lstrlenA (lpString="*.png") returned 5 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.995] lstrlenA (lpString="*.doc") returned 5 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.docx") returned 0 [0135.995] lstrlenA (lpString="*.docx") returned 6 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.xls") returned 0 [0135.995] lstrlenA (lpString="*.xls") returned 5 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0135.995] lstrlenA (lpString="*.xlsx") returned 6 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.ppt") returned 0 [0135.995] lstrlenA (lpString="*.ppt") returned 5 [0135.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.pptx") returned 0 [0135.995] lstrlenA (lpString="*.pptx") returned 6 [0135.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.txt") returned 0 [0135.996] lstrlenA (lpString="*.txt") returned 5 [0135.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.pdf") returned 0 [0135.996] lstrlenA (lpString="*.pdf") returned 5 [0135.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.djvu") returned 0 [0135.996] lstrlenA (lpString="*.djvu") returned 6 [0135.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.htm") returned 0 [0135.996] lstrlenA (lpString="*.htm") returned 5 [0135.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.html") returned 0 [0135.996] lstrlenA (lpString="*.html") returned 6 [0135.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.mdb") returned 0 [0135.996] lstrlenA (lpString="*.mdb") returned 5 [0135.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.cer") returned 0 [0135.996] lstrlenA (lpString="*.cer") returned 5 [0135.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.p12") returned 0 [0135.996] lstrlenA (lpString="*.p12") returned 5 [0135.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.pfx") returned 0 [0135.996] lstrlenA (lpString="*.pfx") returned 5 [0135.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.kwm") returned 0 [0135.996] lstrlenA (lpString="*.kwm") returned 5 [0135.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.pwm") returned 0 [0135.996] lstrlenA (lpString="*.pwm") returned 5 [0135.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.1cd") returned 0 [0135.997] lstrlenA (lpString="*.1cd") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.md") returned 0 [0135.997] lstrlenA (lpString="*.md") returned 4 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.mdf") returned 0 [0135.997] lstrlenA (lpString="*.mdf") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.dbf") returned 0 [0135.997] lstrlenA (lpString="*.dbf") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.odt") returned 0 [0135.997] lstrlenA (lpString="*.odt") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.vob") returned 0 [0135.997] lstrlenA (lpString="*.vob") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.ifo") returned 0 [0135.997] lstrlenA (lpString="*.ifo") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.lnk") returned 0 [0135.997] lstrlenA (lpString="*.lnk") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.torrent") returned 0 [0135.997] lstrlenA (lpString="*.torrent") returned 9 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.mov") returned 0 [0135.997] lstrlenA (lpString="*.mov") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.m2v") returned 0 [0135.997] lstrlenA (lpString="*.m2v") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.3gp") returned 0 [0135.997] lstrlenA (lpString="*.3gp") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0135.997] lstrlenA (lpString="*.mpeg") returned 6 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.mpg") returned 0 [0135.997] lstrlenA (lpString="*.mpg") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.flv") returned 0 [0135.997] lstrlenA (lpString="*.flv") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.avi") returned 0 [0135.997] lstrlenA (lpString="*.avi") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.mp4") returned 0 [0135.997] lstrlenA (lpString="*.mp4") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.wmv") returned 0 [0135.998] lstrlenA (lpString="*.wmv") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.divx") returned 0 [0135.998] lstrlenA (lpString="*.divx") returned 6 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.mkv") returned 0 [0135.998] lstrlenA (lpString="*.mkv") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.mp3") returned 0 [0135.998] lstrlenA (lpString="*.mp3") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.wav") returned 0 [0135.998] lstrlenA (lpString="*.wav") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.flac") returned 0 [0135.998] lstrlenA (lpString="*.flac") returned 6 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.ape") returned 0 [0135.998] lstrlenA (lpString="*.ape") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.wma") returned 0 [0135.998] lstrlenA (lpString="*.wma") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.ac3") returned 0 [0135.998] lstrlenA (lpString="*.ac3") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P34f388c1#\\8d36ba3ca17e3d63745b71277e0c629e\\Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0135.998] lstrlenA (lpString="*.doc") returned 5 [0135.998] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c60aa6, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x34c60aa6, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x34ec2f2c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0135.998] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0135.998] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34c14652, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x34ec2f2c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x34ec2f2c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8d36ba3ca17e3d63745b71277e0c629e", cAlternateFileName="8D36BA~1")) returned 0 [0135.999] FindClose (in: hFindFile=0x759f10 | out: hFindFile=0x759f10) returned 1 [0136.000] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93b84ee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b9c8e88, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b9c8e88, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x612e6c6c, dwReserved1=0x78007875, cFileName="Microsoft.P39041136#", cAlternateFileName="MICROS~1.P39")) returned 1 [0136.000] lstrcmpA (lpString1=".", lpString2="Microsoft.P39041136#") returned -1 [0136.000] lstrcmpA (lpString1="..", lpString2="Microsoft.P39041136#") returned -1 [0136.000] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.000] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.P39041136#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#" [0136.000] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#") returned 67 [0136.000] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93b84ee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b9c8e88, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b9c8e88, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.001] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.001] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93b84ee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b9c8e88, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b9c8e88, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.001] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.001] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.001] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4039b765, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4039b765, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4039b765, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7fde941a9f7eff6032a703d891b9fd02", cAlternateFileName="7FDE94~1")) returned 1 [0136.001] lstrcmpA (lpString1=".", lpString2="7fde941a9f7eff6032a703d891b9fd02") returned -1 [0136.001] lstrcmpA (lpString1="..", lpString2="7fde941a9f7eff6032a703d891b9fd02") returned -1 [0136.001] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\*.*") returned="*.*" [0136.001] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\", lpString2="7fde941a9f7eff6032a703d891b9fd02" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02" [0136.001] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02") returned 100 [0136.001] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4039b765, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4039b765, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4039b765, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759e90 [0136.003] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.003] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4039b765, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4039b765, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4039b765, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.003] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.003] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.003] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x403755d3, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x403755d3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4039b765, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.ScheduledJob.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.003] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.ScheduledJob.ni.dll") returned -1 [0136.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.ScheduledJob.ni.dll") returned -1 [0136.003] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.ScheduledJob.ni.dll") returned -1 [0136.003] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\*.*") returned="*.*" [0136.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\" [0136.003] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\") returned="" [0136.003] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\HOW TO DECRYPT FILES.txt" [0136.003] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p39041136#\\7fde941a9f7eff6032a703d891b9fd02\\how to decrypt files.txt")) returned 0xffffffff [0136.003] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p39041136#\\7fde941a9f7eff6032a703d891b9fd02\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.004] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.004] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.005] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.005] CloseHandle (hObject=0x214) returned 1 [0136.005] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\", lpString2="Microsoft.PowerShell.ScheduledJob.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll" [0136.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.zip") returned 0 [0136.005] lstrlenA (lpString="*.zip") returned 5 [0136.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.rar") returned 0 [0136.005] lstrlenA (lpString="*.rar") returned 5 [0136.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.7z") returned 0 [0136.005] lstrlenA (lpString="*.7z") returned 4 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.tar") returned 0 [0136.006] lstrlenA (lpString="*.tar") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.gzip") returned 0 [0136.006] lstrlenA (lpString="*.gzip") returned 6 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.jpg") returned 0 [0136.006] lstrlenA (lpString="*.jpg") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.jpeg") returned 0 [0136.006] lstrlenA (lpString="*.jpeg") returned 6 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.psd") returned 0 [0136.006] lstrlenA (lpString="*.psd") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.cdr") returned 0 [0136.006] lstrlenA (lpString="*.cdr") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.dwg") returned 0 [0136.006] lstrlenA (lpString="*.dwg") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.max") returned 0 [0136.006] lstrlenA (lpString="*.max") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.bmp") returned 0 [0136.006] lstrlenA (lpString="*.bmp") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.gif") returned 0 [0136.006] lstrlenA (lpString="*.gif") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.png") returned 0 [0136.006] lstrlenA (lpString="*.png") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.doc") returned 0 [0136.006] lstrlenA (lpString="*.doc") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.docx") returned 0 [0136.006] lstrlenA (lpString="*.docx") returned 6 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.xls") returned 0 [0136.006] lstrlenA (lpString="*.xls") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.xlsx") returned 0 [0136.006] lstrlenA (lpString="*.xlsx") returned 6 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.ppt") returned 0 [0136.006] lstrlenA (lpString="*.ppt") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.pptx") returned 0 [0136.007] lstrlenA (lpString="*.pptx") returned 6 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.txt") returned 0 [0136.007] lstrlenA (lpString="*.txt") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.pdf") returned 0 [0136.007] lstrlenA (lpString="*.pdf") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.djvu") returned 0 [0136.007] lstrlenA (lpString="*.djvu") returned 6 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.htm") returned 0 [0136.007] lstrlenA (lpString="*.htm") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.html") returned 0 [0136.007] lstrlenA (lpString="*.html") returned 6 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.mdb") returned 0 [0136.007] lstrlenA (lpString="*.mdb") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.cer") returned 0 [0136.007] lstrlenA (lpString="*.cer") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.p12") returned 0 [0136.007] lstrlenA (lpString="*.p12") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.pfx") returned 0 [0136.007] lstrlenA (lpString="*.pfx") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.kwm") returned 0 [0136.007] lstrlenA (lpString="*.kwm") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.pwm") returned 0 [0136.007] lstrlenA (lpString="*.pwm") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.1cd") returned 0 [0136.007] lstrlenA (lpString="*.1cd") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.md") returned 0 [0136.007] lstrlenA (lpString="*.md") returned 4 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.mdf") returned 0 [0136.007] lstrlenA (lpString="*.mdf") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.dbf") returned 0 [0136.007] lstrlenA (lpString="*.dbf") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.odt") returned 0 [0136.007] lstrlenA (lpString="*.odt") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.vob") returned 0 [0136.008] lstrlenA (lpString="*.vob") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.ifo") returned 0 [0136.008] lstrlenA (lpString="*.ifo") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.lnk") returned 0 [0136.008] lstrlenA (lpString="*.lnk") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.torrent") returned 0 [0136.008] lstrlenA (lpString="*.torrent") returned 9 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.mov") returned 0 [0136.008] lstrlenA (lpString="*.mov") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.m2v") returned 0 [0136.008] lstrlenA (lpString="*.m2v") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.3gp") returned 0 [0136.008] lstrlenA (lpString="*.3gp") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.mpeg") returned 0 [0136.008] lstrlenA (lpString="*.mpeg") returned 6 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.mpg") returned 0 [0136.008] lstrlenA (lpString="*.mpg") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.flv") returned 0 [0136.008] lstrlenA (lpString="*.flv") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.avi") returned 0 [0136.008] lstrlenA (lpString="*.avi") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.mp4") returned 0 [0136.008] lstrlenA (lpString="*.mp4") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.wmv") returned 0 [0136.008] lstrlenA (lpString="*.wmv") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.divx") returned 0 [0136.008] lstrlenA (lpString="*.divx") returned 6 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.mkv") returned 0 [0136.008] lstrlenA (lpString="*.mkv") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.mp3") returned 0 [0136.008] lstrlenA (lpString="*.mp3") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.wav") returned 0 [0136.008] lstrlenA (lpString="*.wav") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.flac") returned 0 [0136.009] lstrlenA (lpString="*.flac") returned 6 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.ape") returned 0 [0136.009] lstrlenA (lpString="*.ape") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.wma") returned 0 [0136.009] lstrlenA (lpString="*.wma") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.ac3") returned 0 [0136.009] lstrlenA (lpString="*.ac3") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll", pszSpec="*.doc") returned 0 [0136.009] lstrlenA (lpString="*.doc") returned 5 [0136.009] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4039b765, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4039b765, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4039b765, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ScheduledJob.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.009] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.ScheduledJob.ni.dll.aux") returned -1 [0136.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.ScheduledJob.ni.dll.aux") returned -1 [0136.009] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.ScheduledJob.ni.dll.aux") returned -1 [0136.009] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll") returned="Microsoft.PowerShell.ScheduledJob.ni.dll" [0136.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\" [0136.009] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\") returned="" [0136.009] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\HOW TO DECRYPT FILES.txt" [0136.009] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p39041136#\\7fde941a9f7eff6032a703d891b9fd02\\how to decrypt files.txt")) returned 0x20 [0136.009] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\", lpString2="Microsoft.PowerShell.ScheduledJob.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux" [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.009] lstrlenA (lpString="*.zip") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.009] lstrlenA (lpString="*.rar") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.009] lstrlenA (lpString="*.7z") returned 4 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.009] lstrlenA (lpString="*.tar") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.010] lstrlenA (lpString="*.gzip") returned 6 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.010] lstrlenA (lpString="*.jpg") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.010] lstrlenA (lpString="*.jpeg") returned 6 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.010] lstrlenA (lpString="*.psd") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.010] lstrlenA (lpString="*.cdr") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.010] lstrlenA (lpString="*.dwg") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.max") returned 0 [0136.010] lstrlenA (lpString="*.max") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.010] lstrlenA (lpString="*.bmp") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.010] lstrlenA (lpString="*.gif") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.png") returned 0 [0136.010] lstrlenA (lpString="*.png") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.010] lstrlenA (lpString="*.doc") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.010] lstrlenA (lpString="*.docx") returned 6 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.010] lstrlenA (lpString="*.xls") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.010] lstrlenA (lpString="*.xlsx") returned 6 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.010] lstrlenA (lpString="*.ppt") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.010] lstrlenA (lpString="*.pptx") returned 6 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.010] lstrlenA (lpString="*.txt") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.011] lstrlenA (lpString="*.pdf") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.011] lstrlenA (lpString="*.djvu") returned 6 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.011] lstrlenA (lpString="*.htm") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.html") returned 0 [0136.011] lstrlenA (lpString="*.html") returned 6 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.011] lstrlenA (lpString="*.mdb") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.011] lstrlenA (lpString="*.cer") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.011] lstrlenA (lpString="*.p12") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.011] lstrlenA (lpString="*.pfx") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.011] lstrlenA (lpString="*.kwm") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.011] lstrlenA (lpString="*.pwm") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.011] lstrlenA (lpString="*.1cd") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.md") returned 0 [0136.011] lstrlenA (lpString="*.md") returned 4 [0136.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.127] lstrlenA (lpString="*.mdf") returned 5 [0136.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.127] lstrlenA (lpString="*.dbf") returned 5 [0136.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.128] lstrlenA (lpString="*.odt") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.128] lstrlenA (lpString="*.vob") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.128] lstrlenA (lpString="*.ifo") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.128] lstrlenA (lpString="*.lnk") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.128] lstrlenA (lpString="*.torrent") returned 9 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.128] lstrlenA (lpString="*.mov") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.128] lstrlenA (lpString="*.m2v") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.128] lstrlenA (lpString="*.3gp") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.128] lstrlenA (lpString="*.mpeg") returned 6 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.128] lstrlenA (lpString="*.mpg") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.128] lstrlenA (lpString="*.flv") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.128] lstrlenA (lpString="*.avi") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.128] lstrlenA (lpString="*.mp4") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.128] lstrlenA (lpString="*.wmv") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.128] lstrlenA (lpString="*.divx") returned 6 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.128] lstrlenA (lpString="*.mkv") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.128] lstrlenA (lpString="*.mp3") returned 5 [0136.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.129] lstrlenA (lpString="*.wav") returned 5 [0136.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.129] lstrlenA (lpString="*.flac") returned 6 [0136.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.129] lstrlenA (lpString="*.ape") returned 5 [0136.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.129] lstrlenA (lpString="*.wma") returned 5 [0136.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.129] lstrlenA (lpString="*.ac3") returned 5 [0136.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P39041136#\\7fde941a9f7eff6032a703d891b9fd02\\Microsoft.PowerShell.ScheduledJob.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.129] lstrlenA (lpString="*.doc") returned 5 [0136.129] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4039b765, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4039b765, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4039b765, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ScheduledJob.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.129] FindClose (in: hFindFile=0x759e90 | out: hFindFile=0x759e90) returned 1 [0136.130] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4039b765, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4039b765, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4039b765, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7fde941a9f7eff6032a703d891b9fd02", cAlternateFileName="7FDE94~1")) returned 0 [0136.130] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.130] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9771fec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b4de6d9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b4de6d9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x612e6c6c, dwReserved1=0x78007875, cFileName="Microsoft.P521220ea#", cAlternateFileName="MICROS~1.P52")) returned 1 [0136.130] lstrcmpA (lpString1=".", lpString2="Microsoft.P521220ea#") returned -1 [0136.130] lstrcmpA (lpString1="..", lpString2="Microsoft.P521220ea#") returned -1 [0136.130] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.130] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.P521220ea#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#" [0136.130] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#") returned 67 [0136.130] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9771fec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b4de6d9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b4de6d9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0136.131] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.131] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9771fec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b4de6d9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b4de6d9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.131] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.131] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.131] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae27b883, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xae2a1adf, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xae2a1adf, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ef5134befe85cd2a63fcba3154e260fb", cAlternateFileName="EF5134~1")) returned 1 [0136.131] lstrcmpA (lpString1=".", lpString2="ef5134befe85cd2a63fcba3154e260fb") returned -1 [0136.131] lstrcmpA (lpString1="..", lpString2="ef5134befe85cd2a63fcba3154e260fb") returned -1 [0136.131] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\*.*") returned="*.*" [0136.131] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\", lpString2="ef5134befe85cd2a63fcba3154e260fb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb" [0136.131] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb") returned 100 [0136.131] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae27b883, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xae2a1adf, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xae2a1adf, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759b50 [0136.133] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.133] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae27b883, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xae2a1adf, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xae2a1adf, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.133] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.133] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.133] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae1bcca4, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xae1bcca4, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xae2edfb3, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0xce3000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Commands.Utility.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.133] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.133] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Commands.Utility.ni.dll") returned -1 [0136.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Commands.Utility.ni.dll") returned -1 [0136.133] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Commands.Utility.ni.dll") returned -1 [0136.133] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\*.*") returned="*.*" [0136.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\" [0136.133] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\") returned="" [0136.133] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\HOW TO DECRYPT FILES.txt" [0136.133] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\how to decrypt files.txt")) returned 0xffffffff [0136.134] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.134] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.134] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.135] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.135] CloseHandle (hObject=0x214) returned 1 [0136.136] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\", lpString2="Microsoft.PowerShell.Commands.Utility.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll" [0136.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.zip") returned 0 [0136.136] lstrlenA (lpString="*.zip") returned 5 [0136.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.rar") returned 0 [0136.136] lstrlenA (lpString="*.rar") returned 5 [0136.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.7z") returned 0 [0136.136] lstrlenA (lpString="*.7z") returned 4 [0136.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.tar") returned 0 [0136.136] lstrlenA (lpString="*.tar") returned 5 [0136.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.gzip") returned 0 [0136.136] lstrlenA (lpString="*.gzip") returned 6 [0136.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.jpg") returned 0 [0136.136] lstrlenA (lpString="*.jpg") returned 5 [0136.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.jpeg") returned 0 [0136.136] lstrlenA (lpString="*.jpeg") returned 6 [0136.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.psd") returned 0 [0136.136] lstrlenA (lpString="*.psd") returned 5 [0136.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.cdr") returned 0 [0136.136] lstrlenA (lpString="*.cdr") returned 5 [0136.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.dwg") returned 0 [0136.136] lstrlenA (lpString="*.dwg") returned 5 [0136.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.max") returned 0 [0136.137] lstrlenA (lpString="*.max") returned 5 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.bmp") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.gif") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.png") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.doc") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.docx") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.xls") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.xlsx") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.ppt") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.pptx") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.txt") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.pdf") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.djvu") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.htm") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.html") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mdb") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.cer") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.p12") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.pfx") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.kwm") returned 0 [0136.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.pwm") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.1cd") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.md") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mdf") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.dbf") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.odt") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.vob") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.ifo") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.lnk") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.torrent") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mov") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.m2v") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.3gp") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mpeg") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mpg") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.flv") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.avi") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mp4") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.wmv") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.divx") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mkv") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mp3") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.wav") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.flac") returned 0 [0136.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.ape") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.wma") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.ac3") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.doc") returned 0 [0136.139] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2a1adf, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xae2a1adf, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Commands.Utility.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.139] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Commands.Utility.ni.dll.aux") returned -1 [0136.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Commands.Utility.ni.dll.aux") returned -1 [0136.139] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Commands.Utility.ni.dll.aux") returned -1 [0136.139] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll") returned="Microsoft.PowerShell.Commands.Utility.ni.dll" [0136.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\" [0136.139] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\") returned="" [0136.139] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\HOW TO DECRYPT FILES.txt" [0136.139] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\how to decrypt files.txt")) returned 0x20 [0136.139] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\", lpString2="Microsoft.PowerShell.Commands.Utility.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux" [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.max") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.png") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.html") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.md") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\ef5134befe85cd2a63fcba3154e260fb\\Microsoft.PowerShell.Commands.Utility.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.141] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2a1adf, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xae2a1adf, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Commands.Utility.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.142] FindClose (in: hFindFile=0x759b50 | out: hFindFile=0x759b50) returned 1 [0136.142] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae27b883, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xae2a1adf, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xae2a1adf, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ef5134befe85cd2a63fcba3154e260fb", cAlternateFileName="EF5134~1")) returned 0 [0136.142] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0136.142] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9adf5f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b387353, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b387353, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x612e6c00, dwReserved1=0x78007875, cFileName="Microsoft.P655586bb#", cAlternateFileName="MICROS~1.P65")) returned 1 [0136.142] lstrcmpA (lpString1=".", lpString2="Microsoft.P655586bb#") returned -1 [0136.142] lstrcmpA (lpString1="..", lpString2="Microsoft.P655586bb#") returned -1 [0136.142] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.142] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.P655586bb#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#" [0136.142] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9adf5f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b387353, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b387353, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e50 [0136.143] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.143] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9adf5f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b387353, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b387353, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.143] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.143] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.143] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30b21439, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x30b6d912, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x30b6d912, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4e0b6ae94c63e2e59d25194728fdbcd1", cAlternateFileName="4E0B6A~1")) returned 1 [0136.143] lstrcmpA (lpString1=".", lpString2="4e0b6ae94c63e2e59d25194728fdbcd1") returned -1 [0136.143] lstrcmpA (lpString1="..", lpString2="4e0b6ae94c63e2e59d25194728fdbcd1") returned -1 [0136.143] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\*.*") returned="*.*" [0136.143] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\", lpString2="4e0b6ae94c63e2e59d25194728fdbcd1" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1" [0136.143] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30b21439, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x30b6d912, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x30b6d912, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0136.145] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.145] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30b21439, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x30b6d912, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x30b6d912, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.145] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.145] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.145] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30afb217, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x30afb217, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x30b93aaf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1c8e00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Activities.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.145] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Activities.ni.dll") returned -1 [0136.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Activities.ni.dll") returned -1 [0136.145] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Activities.ni.dll") returned -1 [0136.145] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\*.*") returned="*.*" [0136.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\" [0136.145] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\") returned="" [0136.145] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\HOW TO DECRYPT FILES.txt" [0136.145] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\how to decrypt files.txt")) returned 0xffffffff [0136.145] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.147] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.148] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.148] CloseHandle (hObject=0x214) returned 1 [0136.148] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\", lpString2="Microsoft.PowerShell.Activities.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll" [0136.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.zip") returned 0 [0136.148] lstrlenA (lpString="*.zip") returned 5 [0136.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.rar") returned 0 [0136.148] lstrlenA (lpString="*.rar") returned 5 [0136.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.7z") returned 0 [0136.148] lstrlenA (lpString="*.7z") returned 4 [0136.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.tar") returned 0 [0136.148] lstrlenA (lpString="*.tar") returned 5 [0136.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.gzip") returned 0 [0136.148] lstrlenA (lpString="*.gzip") returned 6 [0136.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.jpg") returned 0 [0136.148] lstrlenA (lpString="*.jpg") returned 5 [0136.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.jpeg") returned 0 [0136.148] lstrlenA (lpString="*.jpeg") returned 6 [0136.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.psd") returned 0 [0136.148] lstrlenA (lpString="*.psd") returned 5 [0136.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.cdr") returned 0 [0136.148] lstrlenA (lpString="*.cdr") returned 5 [0136.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.dwg") returned 0 [0136.148] lstrlenA (lpString="*.dwg") returned 5 [0136.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.max") returned 0 [0136.148] lstrlenA (lpString="*.max") returned 5 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.bmp") returned 0 [0136.149] lstrlenA (lpString="*.bmp") returned 5 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.gif") returned 0 [0136.149] lstrlenA (lpString="*.gif") returned 5 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.png") returned 0 [0136.149] lstrlenA (lpString="*.png") returned 5 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.doc") returned 0 [0136.149] lstrlenA (lpString="*.doc") returned 5 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.docx") returned 0 [0136.149] lstrlenA (lpString="*.docx") returned 6 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.xls") returned 0 [0136.149] lstrlenA (lpString="*.xls") returned 5 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.xlsx") returned 0 [0136.149] lstrlenA (lpString="*.xlsx") returned 6 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.ppt") returned 0 [0136.149] lstrlenA (lpString="*.ppt") returned 5 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.pptx") returned 0 [0136.149] lstrlenA (lpString="*.pptx") returned 6 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.txt") returned 0 [0136.149] lstrlenA (lpString="*.txt") returned 5 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.pdf") returned 0 [0136.149] lstrlenA (lpString="*.pdf") returned 5 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.djvu") returned 0 [0136.149] lstrlenA (lpString="*.djvu") returned 6 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.htm") returned 0 [0136.149] lstrlenA (lpString="*.htm") returned 5 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.html") returned 0 [0136.149] lstrlenA (lpString="*.html") returned 6 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.mdb") returned 0 [0136.149] lstrlenA (lpString="*.mdb") returned 5 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.cer") returned 0 [0136.149] lstrlenA (lpString="*.cer") returned 5 [0136.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.p12") returned 0 [0136.150] lstrlenA (lpString="*.p12") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.pfx") returned 0 [0136.150] lstrlenA (lpString="*.pfx") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.kwm") returned 0 [0136.150] lstrlenA (lpString="*.kwm") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.pwm") returned 0 [0136.150] lstrlenA (lpString="*.pwm") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.1cd") returned 0 [0136.150] lstrlenA (lpString="*.1cd") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.md") returned 0 [0136.150] lstrlenA (lpString="*.md") returned 4 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.mdf") returned 0 [0136.150] lstrlenA (lpString="*.mdf") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.dbf") returned 0 [0136.150] lstrlenA (lpString="*.dbf") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.odt") returned 0 [0136.150] lstrlenA (lpString="*.odt") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.vob") returned 0 [0136.150] lstrlenA (lpString="*.vob") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.ifo") returned 0 [0136.150] lstrlenA (lpString="*.ifo") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.lnk") returned 0 [0136.150] lstrlenA (lpString="*.lnk") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.torrent") returned 0 [0136.150] lstrlenA (lpString="*.torrent") returned 9 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.mov") returned 0 [0136.150] lstrlenA (lpString="*.mov") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.m2v") returned 0 [0136.150] lstrlenA (lpString="*.m2v") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.3gp") returned 0 [0136.150] lstrlenA (lpString="*.3gp") returned 5 [0136.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.mpeg") returned 0 [0136.150] lstrlenA (lpString="*.mpeg") returned 6 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.mpg") returned 0 [0136.151] lstrlenA (lpString="*.mpg") returned 5 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.flv") returned 0 [0136.151] lstrlenA (lpString="*.flv") returned 5 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.avi") returned 0 [0136.151] lstrlenA (lpString="*.avi") returned 5 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.mp4") returned 0 [0136.151] lstrlenA (lpString="*.mp4") returned 5 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.wmv") returned 0 [0136.151] lstrlenA (lpString="*.wmv") returned 5 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.divx") returned 0 [0136.151] lstrlenA (lpString="*.divx") returned 6 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.mkv") returned 0 [0136.151] lstrlenA (lpString="*.mkv") returned 5 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.mp3") returned 0 [0136.151] lstrlenA (lpString="*.mp3") returned 5 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.wav") returned 0 [0136.151] lstrlenA (lpString="*.wav") returned 5 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.flac") returned 0 [0136.151] lstrlenA (lpString="*.flac") returned 6 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.ape") returned 0 [0136.151] lstrlenA (lpString="*.ape") returned 5 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.wma") returned 0 [0136.151] lstrlenA (lpString="*.wma") returned 5 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.ac3") returned 0 [0136.151] lstrlenA (lpString="*.ac3") returned 5 [0136.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll", pszSpec="*.doc") returned 0 [0136.151] lstrlenA (lpString="*.doc") returned 5 [0136.151] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b6d912, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x30b6d912, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x30b6d912, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xd08, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.151] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.151] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Activities.ni.dll.aux") returned -1 [0136.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Activities.ni.dll.aux") returned -1 [0136.151] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Activities.ni.dll.aux") returned -1 [0136.152] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll") returned="Microsoft.PowerShell.Activities.ni.dll" [0136.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\" [0136.152] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\") returned="" [0136.152] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\HOW TO DECRYPT FILES.txt" [0136.152] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\how to decrypt files.txt")) returned 0x20 [0136.152] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\", lpString2="Microsoft.PowerShell.Activities.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux" [0136.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.152] lstrlenA (lpString="*.zip") returned 5 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.153] lstrlenA (lpString="*.rar") returned 5 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.153] lstrlenA (lpString="*.7z") returned 4 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.153] lstrlenA (lpString="*.tar") returned 5 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.153] lstrlenA (lpString="*.gzip") returned 6 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.153] lstrlenA (lpString="*.jpg") returned 5 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.153] lstrlenA (lpString="*.jpeg") returned 6 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.153] lstrlenA (lpString="*.psd") returned 5 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.153] lstrlenA (lpString="*.cdr") returned 5 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.153] lstrlenA (lpString="*.dwg") returned 5 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.max") returned 0 [0136.153] lstrlenA (lpString="*.max") returned 5 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.153] lstrlenA (lpString="*.bmp") returned 5 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.153] lstrlenA (lpString="*.gif") returned 5 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.png") returned 0 [0136.153] lstrlenA (lpString="*.png") returned 5 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.153] lstrlenA (lpString="*.doc") returned 5 [0136.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.153] lstrlenA (lpString="*.docx") returned 6 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.154] lstrlenA (lpString="*.xls") returned 5 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.154] lstrlenA (lpString="*.xlsx") returned 6 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.154] lstrlenA (lpString="*.ppt") returned 5 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.154] lstrlenA (lpString="*.pptx") returned 6 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.154] lstrlenA (lpString="*.txt") returned 5 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.154] lstrlenA (lpString="*.pdf") returned 5 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.154] lstrlenA (lpString="*.djvu") returned 6 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.154] lstrlenA (lpString="*.htm") returned 5 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.html") returned 0 [0136.154] lstrlenA (lpString="*.html") returned 6 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.154] lstrlenA (lpString="*.mdb") returned 5 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.154] lstrlenA (lpString="*.cer") returned 5 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.154] lstrlenA (lpString="*.p12") returned 5 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.154] lstrlenA (lpString="*.pfx") returned 5 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.154] lstrlenA (lpString="*.kwm") returned 5 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.154] lstrlenA (lpString="*.pwm") returned 5 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.154] lstrlenA (lpString="*.1cd") returned 5 [0136.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.md") returned 0 [0136.154] lstrlenA (lpString="*.md") returned 4 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.155] lstrlenA (lpString="*.mdf") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.155] lstrlenA (lpString="*.dbf") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.155] lstrlenA (lpString="*.odt") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.155] lstrlenA (lpString="*.vob") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.155] lstrlenA (lpString="*.ifo") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.155] lstrlenA (lpString="*.lnk") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.155] lstrlenA (lpString="*.torrent") returned 9 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.155] lstrlenA (lpString="*.mov") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.155] lstrlenA (lpString="*.m2v") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.155] lstrlenA (lpString="*.3gp") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.155] lstrlenA (lpString="*.mpeg") returned 6 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.155] lstrlenA (lpString="*.mpg") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.155] lstrlenA (lpString="*.flv") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.155] lstrlenA (lpString="*.avi") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.155] lstrlenA (lpString="*.mp4") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.155] lstrlenA (lpString="*.wmv") returned 5 [0136.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.155] lstrlenA (lpString="*.divx") returned 6 [0136.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.156] lstrlenA (lpString="*.mkv") returned 5 [0136.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.156] lstrlenA (lpString="*.mp3") returned 5 [0136.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.156] lstrlenA (lpString="*.wav") returned 5 [0136.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.156] lstrlenA (lpString="*.flac") returned 6 [0136.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.156] lstrlenA (lpString="*.ape") returned 5 [0136.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.156] lstrlenA (lpString="*.wma") returned 5 [0136.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.156] lstrlenA (lpString="*.ac3") returned 5 [0136.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P655586bb#\\4e0b6ae94c63e2e59d25194728fdbcd1\\Microsoft.PowerShell.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.156] lstrlenA (lpString="*.doc") returned 5 [0136.156] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b6d912, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x30b6d912, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x30b6d912, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xd08, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.156] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0136.156] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30b21439, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x30b6d912, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x30b6d912, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4e0b6ae94c63e2e59d25194728fdbcd1", cAlternateFileName="4E0B6A~1")) returned 0 [0136.156] FindClose (in: hFindFile=0x759e50 | out: hFindFile=0x759e50) returned 1 [0136.157] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb98c9514, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5ba3b4ed, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5ba3b4ed, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x612e6c00, dwReserved1=0x78007875, cFileName="Microsoft.P6f792626#", cAlternateFileName="MICROS~2.P6F")) returned 1 [0136.157] lstrcmpA (lpString1=".", lpString2="Microsoft.P6f792626#") returned -1 [0136.157] lstrcmpA (lpString1="..", lpString2="Microsoft.P6f792626#") returned -1 [0136.157] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.157] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.P6f792626#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#" [0136.157] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#") returned 67 [0136.157] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb98c9514, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5ba3b4ed, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5ba3b4ed, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0136.157] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.157] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb98c9514, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5ba3b4ed, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5ba3b4ed, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.157] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.157] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.157] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafc1cdb0, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xafc1cdb0, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xafc1cdb0, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bfd708f85bf72e32e6d5657326a5421d", cAlternateFileName="BFD708~1")) returned 1 [0136.157] lstrcmpA (lpString1=".", lpString2="bfd708f85bf72e32e6d5657326a5421d") returned -1 [0136.157] lstrcmpA (lpString1="..", lpString2="bfd708f85bf72e32e6d5657326a5421d") returned -1 [0136.157] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\*.*") returned="*.*" [0136.157] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\", lpString2="bfd708f85bf72e32e6d5657326a5421d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d" [0136.157] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d") returned 100 [0136.158] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafc1cdb0, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xafc1cdb0, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xafc1cdb0, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0136.159] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.159] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafc1cdb0, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xafc1cdb0, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xafc1cdb0, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.159] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.159] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.159] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc1cdb0, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xafc1cdb0, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xafc1cdb0, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x5d200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Security.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.159] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.159] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Security.ni.dll") returned -1 [0136.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Security.ni.dll") returned -1 [0136.160] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Security.ni.dll") returned -1 [0136.160] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\*.*") returned="*.*" [0136.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\" [0136.160] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\") returned="" [0136.160] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\HOW TO DECRYPT FILES.txt" [0136.160] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\how to decrypt files.txt")) returned 0xffffffff [0136.160] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.160] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.161] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.161] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.161] CloseHandle (hObject=0x214) returned 1 [0136.162] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\", lpString2="Microsoft.PowerShell.Security.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll" [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.zip") returned 0 [0136.162] lstrlenA (lpString="*.zip") returned 5 [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.rar") returned 0 [0136.162] lstrlenA (lpString="*.rar") returned 5 [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.7z") returned 0 [0136.162] lstrlenA (lpString="*.7z") returned 4 [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.tar") returned 0 [0136.162] lstrlenA (lpString="*.tar") returned 5 [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.gzip") returned 0 [0136.162] lstrlenA (lpString="*.gzip") returned 6 [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.jpg") returned 0 [0136.162] lstrlenA (lpString="*.jpg") returned 5 [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.jpeg") returned 0 [0136.162] lstrlenA (lpString="*.jpeg") returned 6 [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.psd") returned 0 [0136.162] lstrlenA (lpString="*.psd") returned 5 [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.cdr") returned 0 [0136.162] lstrlenA (lpString="*.cdr") returned 5 [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.dwg") returned 0 [0136.162] lstrlenA (lpString="*.dwg") returned 5 [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.max") returned 0 [0136.162] lstrlenA (lpString="*.max") returned 5 [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.bmp") returned 0 [0136.162] lstrlenA (lpString="*.bmp") returned 5 [0136.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.gif") returned 0 [0136.162] lstrlenA (lpString="*.gif") returned 5 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.png") returned 0 [0136.163] lstrlenA (lpString="*.png") returned 5 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.doc") returned 0 [0136.163] lstrlenA (lpString="*.doc") returned 5 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.docx") returned 0 [0136.163] lstrlenA (lpString="*.docx") returned 6 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.xls") returned 0 [0136.163] lstrlenA (lpString="*.xls") returned 5 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.xlsx") returned 0 [0136.163] lstrlenA (lpString="*.xlsx") returned 6 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.ppt") returned 0 [0136.163] lstrlenA (lpString="*.ppt") returned 5 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.pptx") returned 0 [0136.163] lstrlenA (lpString="*.pptx") returned 6 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.txt") returned 0 [0136.163] lstrlenA (lpString="*.txt") returned 5 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.pdf") returned 0 [0136.163] lstrlenA (lpString="*.pdf") returned 5 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.djvu") returned 0 [0136.163] lstrlenA (lpString="*.djvu") returned 6 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.htm") returned 0 [0136.163] lstrlenA (lpString="*.htm") returned 5 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.html") returned 0 [0136.163] lstrlenA (lpString="*.html") returned 6 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mdb") returned 0 [0136.163] lstrlenA (lpString="*.mdb") returned 5 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.cer") returned 0 [0136.163] lstrlenA (lpString="*.cer") returned 5 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.p12") returned 0 [0136.163] lstrlenA (lpString="*.p12") returned 5 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.pfx") returned 0 [0136.163] lstrlenA (lpString="*.pfx") returned 5 [0136.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.kwm") returned 0 [0136.163] lstrlenA (lpString="*.kwm") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.pwm") returned 0 [0136.164] lstrlenA (lpString="*.pwm") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.1cd") returned 0 [0136.164] lstrlenA (lpString="*.1cd") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.md") returned 0 [0136.164] lstrlenA (lpString="*.md") returned 4 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mdf") returned 0 [0136.164] lstrlenA (lpString="*.mdf") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.dbf") returned 0 [0136.164] lstrlenA (lpString="*.dbf") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.odt") returned 0 [0136.164] lstrlenA (lpString="*.odt") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.vob") returned 0 [0136.164] lstrlenA (lpString="*.vob") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.ifo") returned 0 [0136.164] lstrlenA (lpString="*.ifo") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.lnk") returned 0 [0136.164] lstrlenA (lpString="*.lnk") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.torrent") returned 0 [0136.164] lstrlenA (lpString="*.torrent") returned 9 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mov") returned 0 [0136.164] lstrlenA (lpString="*.mov") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.m2v") returned 0 [0136.164] lstrlenA (lpString="*.m2v") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.3gp") returned 0 [0136.164] lstrlenA (lpString="*.3gp") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mpeg") returned 0 [0136.164] lstrlenA (lpString="*.mpeg") returned 6 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mpg") returned 0 [0136.164] lstrlenA (lpString="*.mpg") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.flv") returned 0 [0136.164] lstrlenA (lpString="*.flv") returned 5 [0136.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.avi") returned 0 [0136.164] lstrlenA (lpString="*.avi") returned 5 [0136.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mp4") returned 0 [0136.165] lstrlenA (lpString="*.mp4") returned 5 [0136.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.wmv") returned 0 [0136.165] lstrlenA (lpString="*.wmv") returned 5 [0136.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.divx") returned 0 [0136.165] lstrlenA (lpString="*.divx") returned 6 [0136.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mkv") returned 0 [0136.165] lstrlenA (lpString="*.mkv") returned 5 [0136.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mp3") returned 0 [0136.165] lstrlenA (lpString="*.mp3") returned 5 [0136.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.wav") returned 0 [0136.165] lstrlenA (lpString="*.wav") returned 5 [0136.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.flac") returned 0 [0136.165] lstrlenA (lpString="*.flac") returned 6 [0136.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.ape") returned 0 [0136.165] lstrlenA (lpString="*.ape") returned 5 [0136.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.wma") returned 0 [0136.165] lstrlenA (lpString="*.wma") returned 5 [0136.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.ac3") returned 0 [0136.165] lstrlenA (lpString="*.ac3") returned 5 [0136.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.doc") returned 0 [0136.165] lstrlenA (lpString="*.doc") returned 5 [0136.165] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc1cdb0, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xafc1cdb0, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.165] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.165] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Security.ni.dll.aux") returned -1 [0136.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Security.ni.dll.aux") returned -1 [0136.165] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Security.ni.dll.aux") returned -1 [0136.165] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll") returned="Microsoft.PowerShell.Security.ni.dll" [0136.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\" [0136.165] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\") returned="" [0136.165] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\HOW TO DECRYPT FILES.txt" [0136.166] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\how to decrypt files.txt")) returned 0x20 [0136.166] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\", lpString2="Microsoft.PowerShell.Security.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux" [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.166] lstrlenA (lpString="*.zip") returned 5 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.166] lstrlenA (lpString="*.rar") returned 5 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.166] lstrlenA (lpString="*.7z") returned 4 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.166] lstrlenA (lpString="*.tar") returned 5 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.166] lstrlenA (lpString="*.gzip") returned 6 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.166] lstrlenA (lpString="*.jpg") returned 5 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.166] lstrlenA (lpString="*.jpeg") returned 6 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.166] lstrlenA (lpString="*.psd") returned 5 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.166] lstrlenA (lpString="*.cdr") returned 5 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.166] lstrlenA (lpString="*.dwg") returned 5 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.max") returned 0 [0136.166] lstrlenA (lpString="*.max") returned 5 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.166] lstrlenA (lpString="*.bmp") returned 5 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.166] lstrlenA (lpString="*.gif") returned 5 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.png") returned 0 [0136.166] lstrlenA (lpString="*.png") returned 5 [0136.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.166] lstrlenA (lpString="*.doc") returned 5 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.167] lstrlenA (lpString="*.docx") returned 6 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.167] lstrlenA (lpString="*.xls") returned 5 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.167] lstrlenA (lpString="*.xlsx") returned 6 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.167] lstrlenA (lpString="*.ppt") returned 5 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.167] lstrlenA (lpString="*.pptx") returned 6 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.167] lstrlenA (lpString="*.txt") returned 5 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.167] lstrlenA (lpString="*.pdf") returned 5 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.167] lstrlenA (lpString="*.djvu") returned 6 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.167] lstrlenA (lpString="*.htm") returned 5 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.html") returned 0 [0136.167] lstrlenA (lpString="*.html") returned 6 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.167] lstrlenA (lpString="*.mdb") returned 5 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.167] lstrlenA (lpString="*.cer") returned 5 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.167] lstrlenA (lpString="*.p12") returned 5 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.167] lstrlenA (lpString="*.pfx") returned 5 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.167] lstrlenA (lpString="*.kwm") returned 5 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.167] lstrlenA (lpString="*.pwm") returned 5 [0136.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.231] lstrlenA (lpString="*.1cd") returned 5 [0136.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.md") returned 0 [0136.231] lstrlenA (lpString="*.md") returned 4 [0136.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.231] lstrlenA (lpString="*.mdf") returned 5 [0136.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.231] lstrlenA (lpString="*.dbf") returned 5 [0136.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.231] lstrlenA (lpString="*.odt") returned 5 [0136.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.231] lstrlenA (lpString="*.vob") returned 5 [0136.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.231] lstrlenA (lpString="*.ifo") returned 5 [0136.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.231] lstrlenA (lpString="*.lnk") returned 5 [0136.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.231] lstrlenA (lpString="*.torrent") returned 9 [0136.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.231] lstrlenA (lpString="*.mov") returned 5 [0136.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.232] lstrlenA (lpString="*.m2v") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.232] lstrlenA (lpString="*.3gp") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.232] lstrlenA (lpString="*.mpeg") returned 6 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.232] lstrlenA (lpString="*.mpg") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.232] lstrlenA (lpString="*.flv") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.232] lstrlenA (lpString="*.avi") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.232] lstrlenA (lpString="*.mp4") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.232] lstrlenA (lpString="*.wmv") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.232] lstrlenA (lpString="*.divx") returned 6 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.232] lstrlenA (lpString="*.mkv") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.232] lstrlenA (lpString="*.mp3") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.232] lstrlenA (lpString="*.wav") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.232] lstrlenA (lpString="*.flac") returned 6 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.232] lstrlenA (lpString="*.ape") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.232] lstrlenA (lpString="*.wma") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.232] lstrlenA (lpString="*.ac3") returned 5 [0136.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\bfd708f85bf72e32e6d5657326a5421d\\Microsoft.PowerShell.Security.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.232] lstrlenA (lpString="*.doc") returned 5 [0136.233] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc1cdb0, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xafc1cdb0, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.233] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0136.233] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafc1cdb0, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xafc1cdb0, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xafc1cdb0, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bfd708f85bf72e32e6d5657326a5421d", cAlternateFileName="BFD708~1")) returned 0 [0136.233] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0136.234] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8fd87a5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5ba8794f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5ba8794f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x612e6c00, dwReserved1=0x78007875, cFileName="Microsoft.P6f9a5e83#", cAlternateFileName="MICROS~1.P6F")) returned 1 [0136.234] lstrcmpA (lpString1=".", lpString2="Microsoft.P6f9a5e83#") returned -1 [0136.234] lstrcmpA (lpString1="..", lpString2="Microsoft.P6f9a5e83#") returned -1 [0136.234] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.234] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.P6f9a5e83#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#" [0136.234] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#") returned 67 [0136.234] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8fd87a5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5ba8794f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5ba8794f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0136.235] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.235] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8fd87a5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5ba8794f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5ba8794f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.235] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.235] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.235] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a034de, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x40a034de, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x40a034de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6f55c292ba3b66d31c77a408eb4a7761", cAlternateFileName="6F55C2~1")) returned 1 [0136.235] lstrcmpA (lpString1=".", lpString2="6f55c292ba3b66d31c77a408eb4a7761") returned -1 [0136.235] lstrcmpA (lpString1="..", lpString2="6f55c292ba3b66d31c77a408eb4a7761") returned -1 [0136.235] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\*.*") returned="*.*" [0136.235] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\", lpString2="6f55c292ba3b66d31c77a408eb4a7761" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761" [0136.235] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761") returned 100 [0136.235] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a034de, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x40a034de, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x40a034de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759fd0 [0136.237] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.237] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a034de, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x40a034de, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x40a034de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.237] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.237] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.237] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409dd2c6, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x409dd2c6, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x40a034de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x51200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Security.Activities.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.237] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.237] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Security.Activities.ni.dll") returned -1 [0136.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Security.Activities.ni.dll") returned -1 [0136.237] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Security.Activities.ni.dll") returned -1 [0136.237] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\*.*") returned="*.*" [0136.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\" [0136.237] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\") returned="" [0136.237] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\HOW TO DECRYPT FILES.txt" [0136.238] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\how to decrypt files.txt")) returned 0xffffffff [0136.238] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.238] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.238] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.239] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.239] CloseHandle (hObject=0x214) returned 1 [0136.240] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\", lpString2="Microsoft.PowerShell.Security.Activities.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll" [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.zip") returned 0 [0136.240] lstrlenA (lpString="*.zip") returned 5 [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.rar") returned 0 [0136.240] lstrlenA (lpString="*.rar") returned 5 [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.7z") returned 0 [0136.240] lstrlenA (lpString="*.7z") returned 4 [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.tar") returned 0 [0136.240] lstrlenA (lpString="*.tar") returned 5 [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.gzip") returned 0 [0136.240] lstrlenA (lpString="*.gzip") returned 6 [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.jpg") returned 0 [0136.240] lstrlenA (lpString="*.jpg") returned 5 [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.jpeg") returned 0 [0136.240] lstrlenA (lpString="*.jpeg") returned 6 [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.psd") returned 0 [0136.240] lstrlenA (lpString="*.psd") returned 5 [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.cdr") returned 0 [0136.240] lstrlenA (lpString="*.cdr") returned 5 [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.dwg") returned 0 [0136.240] lstrlenA (lpString="*.dwg") returned 5 [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.max") returned 0 [0136.240] lstrlenA (lpString="*.max") returned 5 [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.bmp") returned 0 [0136.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.gif") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.png") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.doc") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.docx") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.xls") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.xlsx") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.ppt") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.pptx") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.txt") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.pdf") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.djvu") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.htm") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.html") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.mdb") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.cer") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.p12") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.pfx") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.kwm") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.pwm") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.1cd") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.md") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.mdf") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.dbf") returned 0 [0136.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.odt") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.vob") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.ifo") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.lnk") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.torrent") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.mov") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.m2v") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.3gp") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.mpeg") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.mpg") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.flv") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.avi") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.mp4") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.wmv") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.divx") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.mkv") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.mp3") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.wav") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.flac") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.ape") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.wma") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.ac3") returned 0 [0136.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll", pszSpec="*.doc") returned 0 [0136.242] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40a034de, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x40a034de, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x40a034de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.242] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.242] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Security.Activities.ni.dll.aux") returned -1 [0136.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Security.Activities.ni.dll.aux") returned -1 [0136.243] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Security.Activities.ni.dll.aux") returned -1 [0136.243] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll") returned="Microsoft.PowerShell.Security.Activities.ni.dll" [0136.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\" [0136.243] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\") returned="" [0136.243] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\HOW TO DECRYPT FILES.txt" [0136.243] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\how to decrypt files.txt")) returned 0x20 [0136.243] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\", lpString2="Microsoft.PowerShell.Security.Activities.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux" [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.max") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.png") returned 0 [0136.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.html") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.md") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f9a5e83#\\6f55c292ba3b66d31c77a408eb4a7761\\Microsoft.PowerShell.Security.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.245] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40a034de, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x40a034de, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x40a034de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.245] FindClose (in: hFindFile=0x759fd0 | out: hFindFile=0x759fd0) returned 1 [0136.247] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a034de, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x40a034de, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x40a034de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6f55c292ba3b66d31c77a408eb4a7761", cAlternateFileName="6F55C2~1")) returned 0 [0136.247] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0136.247] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb96d965d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b97ca1f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b97ca1f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x787561, dwReserved1=0x78007875, cFileName="Microsoft.P9de5a786#", cAlternateFileName="MICROS~1.P9D")) returned 1 [0136.247] lstrcmpA (lpString1=".", lpString2="Microsoft.P9de5a786#") returned -1 [0136.247] lstrcmpA (lpString1="..", lpString2="Microsoft.P9de5a786#") returned -1 [0136.247] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.247] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.P9de5a786#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#" [0136.247] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb96d965d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b97ca1f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b97ca1f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0136.247] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.247] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb96d965d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b97ca1f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b97ca1f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.247] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.247] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.247] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fa85304, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3faab55c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3faab55c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cf71e2683f2a19a66bb6f1b9c044d99c", cAlternateFileName="CF71E2~1")) returned 1 [0136.247] lstrcmpA (lpString1=".", lpString2="cf71e2683f2a19a66bb6f1b9c044d99c") returned -1 [0136.247] lstrcmpA (lpString1="..", lpString2="cf71e2683f2a19a66bb6f1b9c044d99c") returned -1 [0136.247] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\*.*") returned="*.*" [0136.248] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\", lpString2="cf71e2683f2a19a66bb6f1b9c044d99c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c" [0136.248] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fa85304, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3faab55c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3faab55c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.249] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.250] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fa85304, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3faab55c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3faab55c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.250] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.250] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.250] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fa5f0ed, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3fa5f0ed, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3faab55c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1ae400, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Management.Activities.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.250] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.250] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Management.Activities.ni.dll") returned -1 [0136.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Management.Activities.ni.dll") returned -1 [0136.250] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Management.Activities.ni.dll") returned -1 [0136.250] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\*.*") returned="*.*" [0136.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\" [0136.250] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\") returned="" [0136.250] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\HOW TO DECRYPT FILES.txt" [0136.250] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\how to decrypt files.txt")) returned 0xffffffff [0136.250] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.251] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.252] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.252] CloseHandle (hObject=0x214) returned 1 [0136.252] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\", lpString2="Microsoft.PowerShell.Management.Activities.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll" [0136.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.zip") returned 0 [0136.252] lstrlenA (lpString="*.zip") returned 5 [0136.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.rar") returned 0 [0136.252] lstrlenA (lpString="*.rar") returned 5 [0136.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.7z") returned 0 [0136.252] lstrlenA (lpString="*.7z") returned 4 [0136.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.tar") returned 0 [0136.252] lstrlenA (lpString="*.tar") returned 5 [0136.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.gzip") returned 0 [0136.252] lstrlenA (lpString="*.gzip") returned 6 [0136.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.jpg") returned 0 [0136.252] lstrlenA (lpString="*.jpg") returned 5 [0136.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.jpeg") returned 0 [0136.252] lstrlenA (lpString="*.jpeg") returned 6 [0136.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.psd") returned 0 [0136.252] lstrlenA (lpString="*.psd") returned 5 [0136.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.cdr") returned 0 [0136.253] lstrlenA (lpString="*.cdr") returned 5 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.dwg") returned 0 [0136.253] lstrlenA (lpString="*.dwg") returned 5 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.max") returned 0 [0136.253] lstrlenA (lpString="*.max") returned 5 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.bmp") returned 0 [0136.253] lstrlenA (lpString="*.bmp") returned 5 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.gif") returned 0 [0136.253] lstrlenA (lpString="*.gif") returned 5 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.png") returned 0 [0136.253] lstrlenA (lpString="*.png") returned 5 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.doc") returned 0 [0136.253] lstrlenA (lpString="*.doc") returned 5 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.docx") returned 0 [0136.253] lstrlenA (lpString="*.docx") returned 6 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.xls") returned 0 [0136.253] lstrlenA (lpString="*.xls") returned 5 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.xlsx") returned 0 [0136.253] lstrlenA (lpString="*.xlsx") returned 6 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.ppt") returned 0 [0136.253] lstrlenA (lpString="*.ppt") returned 5 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.pptx") returned 0 [0136.253] lstrlenA (lpString="*.pptx") returned 6 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.txt") returned 0 [0136.253] lstrlenA (lpString="*.txt") returned 5 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.pdf") returned 0 [0136.253] lstrlenA (lpString="*.pdf") returned 5 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.djvu") returned 0 [0136.253] lstrlenA (lpString="*.djvu") returned 6 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.htm") returned 0 [0136.253] lstrlenA (lpString="*.htm") returned 5 [0136.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.html") returned 0 [0136.254] lstrlenA (lpString="*.html") returned 6 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.mdb") returned 0 [0136.254] lstrlenA (lpString="*.mdb") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.cer") returned 0 [0136.254] lstrlenA (lpString="*.cer") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.p12") returned 0 [0136.254] lstrlenA (lpString="*.p12") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.pfx") returned 0 [0136.254] lstrlenA (lpString="*.pfx") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.kwm") returned 0 [0136.254] lstrlenA (lpString="*.kwm") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.pwm") returned 0 [0136.254] lstrlenA (lpString="*.pwm") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.1cd") returned 0 [0136.254] lstrlenA (lpString="*.1cd") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.md") returned 0 [0136.254] lstrlenA (lpString="*.md") returned 4 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.mdf") returned 0 [0136.254] lstrlenA (lpString="*.mdf") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.dbf") returned 0 [0136.254] lstrlenA (lpString="*.dbf") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.odt") returned 0 [0136.254] lstrlenA (lpString="*.odt") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.vob") returned 0 [0136.254] lstrlenA (lpString="*.vob") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.ifo") returned 0 [0136.254] lstrlenA (lpString="*.ifo") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.lnk") returned 0 [0136.254] lstrlenA (lpString="*.lnk") returned 5 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.torrent") returned 0 [0136.254] lstrlenA (lpString="*.torrent") returned 9 [0136.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.mov") returned 0 [0136.254] lstrlenA (lpString="*.mov") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.m2v") returned 0 [0136.255] lstrlenA (lpString="*.m2v") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.3gp") returned 0 [0136.255] lstrlenA (lpString="*.3gp") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.mpeg") returned 0 [0136.255] lstrlenA (lpString="*.mpeg") returned 6 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.mpg") returned 0 [0136.255] lstrlenA (lpString="*.mpg") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.flv") returned 0 [0136.255] lstrlenA (lpString="*.flv") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.avi") returned 0 [0136.255] lstrlenA (lpString="*.avi") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.mp4") returned 0 [0136.255] lstrlenA (lpString="*.mp4") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.wmv") returned 0 [0136.255] lstrlenA (lpString="*.wmv") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.divx") returned 0 [0136.255] lstrlenA (lpString="*.divx") returned 6 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.mkv") returned 0 [0136.255] lstrlenA (lpString="*.mkv") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.mp3") returned 0 [0136.255] lstrlenA (lpString="*.mp3") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.wav") returned 0 [0136.255] lstrlenA (lpString="*.wav") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.flac") returned 0 [0136.255] lstrlenA (lpString="*.flac") returned 6 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.ape") returned 0 [0136.255] lstrlenA (lpString="*.ape") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.wma") returned 0 [0136.255] lstrlenA (lpString="*.wma") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.ac3") returned 0 [0136.255] lstrlenA (lpString="*.ac3") returned 5 [0136.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll", pszSpec="*.doc") returned 0 [0136.255] lstrlenA (lpString="*.doc") returned 5 [0136.256] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3faab55c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3faab55c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3faab55c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x894, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.256] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.256] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Management.Activities.ni.dll.aux") returned -1 [0136.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Management.Activities.ni.dll.aux") returned -1 [0136.256] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Management.Activities.ni.dll.aux") returned -1 [0136.256] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll") returned="Microsoft.PowerShell.Management.Activities.ni.dll" [0136.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\" [0136.256] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\") returned="" [0136.256] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\HOW TO DECRYPT FILES.txt" [0136.256] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\how to decrypt files.txt")) returned 0x20 [0136.256] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\", lpString2="Microsoft.PowerShell.Management.Activities.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux" [0136.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.256] lstrlenA (lpString="*.zip") returned 5 [0136.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.256] lstrlenA (lpString="*.rar") returned 5 [0136.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.256] lstrlenA (lpString="*.7z") returned 4 [0136.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.256] lstrlenA (lpString="*.tar") returned 5 [0136.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.256] lstrlenA (lpString="*.gzip") returned 6 [0136.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.256] lstrlenA (lpString="*.jpg") returned 5 [0136.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.256] lstrlenA (lpString="*.jpeg") returned 6 [0136.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.256] lstrlenA (lpString="*.psd") returned 5 [0136.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.257] lstrlenA (lpString="*.cdr") returned 5 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.257] lstrlenA (lpString="*.dwg") returned 5 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.max") returned 0 [0136.257] lstrlenA (lpString="*.max") returned 5 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.257] lstrlenA (lpString="*.bmp") returned 5 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.257] lstrlenA (lpString="*.gif") returned 5 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.png") returned 0 [0136.257] lstrlenA (lpString="*.png") returned 5 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.257] lstrlenA (lpString="*.doc") returned 5 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.257] lstrlenA (lpString="*.docx") returned 6 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.257] lstrlenA (lpString="*.xls") returned 5 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.257] lstrlenA (lpString="*.xlsx") returned 6 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.257] lstrlenA (lpString="*.ppt") returned 5 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.257] lstrlenA (lpString="*.pptx") returned 6 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.257] lstrlenA (lpString="*.txt") returned 5 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.257] lstrlenA (lpString="*.pdf") returned 5 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.257] lstrlenA (lpString="*.djvu") returned 6 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.257] lstrlenA (lpString="*.htm") returned 5 [0136.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.html") returned 0 [0136.257] lstrlenA (lpString="*.html") returned 6 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.258] lstrlenA (lpString="*.mdb") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.258] lstrlenA (lpString="*.cer") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.258] lstrlenA (lpString="*.p12") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.258] lstrlenA (lpString="*.pfx") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.258] lstrlenA (lpString="*.kwm") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.258] lstrlenA (lpString="*.pwm") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.258] lstrlenA (lpString="*.1cd") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.md") returned 0 [0136.258] lstrlenA (lpString="*.md") returned 4 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.258] lstrlenA (lpString="*.mdf") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.258] lstrlenA (lpString="*.dbf") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.258] lstrlenA (lpString="*.odt") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.258] lstrlenA (lpString="*.vob") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.258] lstrlenA (lpString="*.ifo") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.258] lstrlenA (lpString="*.lnk") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.258] lstrlenA (lpString="*.torrent") returned 9 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.258] lstrlenA (lpString="*.mov") returned 5 [0136.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.259] lstrlenA (lpString="*.m2v") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.259] lstrlenA (lpString="*.3gp") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.259] lstrlenA (lpString="*.mpeg") returned 6 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.259] lstrlenA (lpString="*.mpg") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.259] lstrlenA (lpString="*.flv") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.259] lstrlenA (lpString="*.avi") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.259] lstrlenA (lpString="*.mp4") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.259] lstrlenA (lpString="*.wmv") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.259] lstrlenA (lpString="*.divx") returned 6 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.259] lstrlenA (lpString="*.mkv") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.259] lstrlenA (lpString="*.mp3") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.259] lstrlenA (lpString="*.wav") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.259] lstrlenA (lpString="*.flac") returned 6 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.259] lstrlenA (lpString="*.ape") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.259] lstrlenA (lpString="*.wma") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.259] lstrlenA (lpString="*.ac3") returned 5 [0136.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P9de5a786#\\cf71e2683f2a19a66bb6f1b9c044d99c\\Microsoft.PowerShell.Management.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.259] lstrlenA (lpString="*.doc") returned 5 [0136.260] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3faab55c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3faab55c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3faab55c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x894, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.260] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.260] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fa85304, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3faab55c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3faab55c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cf71e2683f2a19a66bb6f1b9c044d99c", cAlternateFileName="CF71E2~1")) returned 0 [0136.260] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0136.260] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1104f18b, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1104f18b, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1104f18b, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75612e6c, dwReserved1=0x78000078, cFileName="Microsoft.Pa0bb478f#", cAlternateFileName="MICROS~1.PA0")) returned 1 [0136.260] lstrcmpA (lpString1=".", lpString2="Microsoft.Pa0bb478f#") returned -1 [0136.260] lstrcmpA (lpString1="..", lpString2="Microsoft.Pa0bb478f#") returned -1 [0136.260] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.260] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Pa0bb478f#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#" [0136.260] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#") returned 67 [0136.260] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1104f18b, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1104f18b, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1104f18b, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759fd0 [0136.261] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.261] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1104f18b, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1104f18b, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1104f18b, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.262] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.262] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.262] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1104f18b, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1104f18b, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1104f18b, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="389a1852c85e4f7b4e1b011f6fcc9ab9", cAlternateFileName="389A18~1")) returned 1 [0136.262] lstrcmpA (lpString1=".", lpString2="389a1852c85e4f7b4e1b011f6fcc9ab9") returned -1 [0136.262] lstrcmpA (lpString1="..", lpString2="389a1852c85e4f7b4e1b011f6fcc9ab9") returned -1 [0136.262] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\*.*") returned="*.*" [0136.262] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\", lpString2="389a1852c85e4f7b4e1b011f6fcc9ab9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9" [0136.262] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9") returned 100 [0136.262] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1104f18b, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1104f18b, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1104f18b, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d90 [0136.263] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.263] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1104f18b, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1104f18b, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1104f18b, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.264] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.264] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.264] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1104f18b, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1104f18b, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1104f18b, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0xdc200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Powershell.PSReadline.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.264] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Powershell.PSReadline.ni.dll") returned -1 [0136.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Powershell.PSReadline.ni.dll") returned -1 [0136.264] lstrcmpiA (lpString1="", lpString2="Microsoft.Powershell.PSReadline.ni.dll") returned -1 [0136.264] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\*.*") returned="*.*" [0136.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\" [0136.264] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\") returned="" [0136.264] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\HOW TO DECRYPT FILES.txt" [0136.264] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\how to decrypt files.txt")) returned 0xffffffff [0136.264] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.265] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.265] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.266] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.266] CloseHandle (hObject=0x214) returned 1 [0136.266] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\", lpString2="Microsoft.Powershell.PSReadline.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll" [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.zip") returned 0 [0136.267] lstrlenA (lpString="*.zip") returned 5 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.rar") returned 0 [0136.267] lstrlenA (lpString="*.rar") returned 5 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.7z") returned 0 [0136.267] lstrlenA (lpString="*.7z") returned 4 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.tar") returned 0 [0136.267] lstrlenA (lpString="*.tar") returned 5 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.gzip") returned 0 [0136.267] lstrlenA (lpString="*.gzip") returned 6 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.jpg") returned 0 [0136.267] lstrlenA (lpString="*.jpg") returned 5 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.jpeg") returned 0 [0136.267] lstrlenA (lpString="*.jpeg") returned 6 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.psd") returned 0 [0136.267] lstrlenA (lpString="*.psd") returned 5 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.cdr") returned 0 [0136.267] lstrlenA (lpString="*.cdr") returned 5 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.dwg") returned 0 [0136.267] lstrlenA (lpString="*.dwg") returned 5 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.max") returned 0 [0136.267] lstrlenA (lpString="*.max") returned 5 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.bmp") returned 0 [0136.267] lstrlenA (lpString="*.bmp") returned 5 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.gif") returned 0 [0136.267] lstrlenA (lpString="*.gif") returned 5 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.png") returned 0 [0136.267] lstrlenA (lpString="*.png") returned 5 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.doc") returned 0 [0136.267] lstrlenA (lpString="*.doc") returned 5 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.docx") returned 0 [0136.267] lstrlenA (lpString="*.docx") returned 6 [0136.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.xls") returned 0 [0136.268] lstrlenA (lpString="*.xls") returned 5 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.xlsx") returned 0 [0136.268] lstrlenA (lpString="*.xlsx") returned 6 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.ppt") returned 0 [0136.268] lstrlenA (lpString="*.ppt") returned 5 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.pptx") returned 0 [0136.268] lstrlenA (lpString="*.pptx") returned 6 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.txt") returned 0 [0136.268] lstrlenA (lpString="*.txt") returned 5 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.pdf") returned 0 [0136.268] lstrlenA (lpString="*.pdf") returned 5 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.djvu") returned 0 [0136.268] lstrlenA (lpString="*.djvu") returned 6 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.htm") returned 0 [0136.268] lstrlenA (lpString="*.htm") returned 5 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.html") returned 0 [0136.268] lstrlenA (lpString="*.html") returned 6 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.mdb") returned 0 [0136.268] lstrlenA (lpString="*.mdb") returned 5 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.cer") returned 0 [0136.268] lstrlenA (lpString="*.cer") returned 5 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.p12") returned 0 [0136.268] lstrlenA (lpString="*.p12") returned 5 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.pfx") returned 0 [0136.268] lstrlenA (lpString="*.pfx") returned 5 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.kwm") returned 0 [0136.268] lstrlenA (lpString="*.kwm") returned 5 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.pwm") returned 0 [0136.268] lstrlenA (lpString="*.pwm") returned 5 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.1cd") returned 0 [0136.268] lstrlenA (lpString="*.1cd") returned 5 [0136.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.md") returned 0 [0136.268] lstrlenA (lpString="*.md") returned 4 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.mdf") returned 0 [0136.269] lstrlenA (lpString="*.mdf") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.dbf") returned 0 [0136.269] lstrlenA (lpString="*.dbf") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.odt") returned 0 [0136.269] lstrlenA (lpString="*.odt") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.vob") returned 0 [0136.269] lstrlenA (lpString="*.vob") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.ifo") returned 0 [0136.269] lstrlenA (lpString="*.ifo") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.lnk") returned 0 [0136.269] lstrlenA (lpString="*.lnk") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.torrent") returned 0 [0136.269] lstrlenA (lpString="*.torrent") returned 9 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.mov") returned 0 [0136.269] lstrlenA (lpString="*.mov") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.m2v") returned 0 [0136.269] lstrlenA (lpString="*.m2v") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.3gp") returned 0 [0136.269] lstrlenA (lpString="*.3gp") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.mpeg") returned 0 [0136.269] lstrlenA (lpString="*.mpeg") returned 6 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.mpg") returned 0 [0136.269] lstrlenA (lpString="*.mpg") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.flv") returned 0 [0136.269] lstrlenA (lpString="*.flv") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.avi") returned 0 [0136.269] lstrlenA (lpString="*.avi") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.mp4") returned 0 [0136.269] lstrlenA (lpString="*.mp4") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.wmv") returned 0 [0136.269] lstrlenA (lpString="*.wmv") returned 5 [0136.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.divx") returned 0 [0136.270] lstrlenA (lpString="*.divx") returned 6 [0136.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.mkv") returned 0 [0136.270] lstrlenA (lpString="*.mkv") returned 5 [0136.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.mp3") returned 0 [0136.270] lstrlenA (lpString="*.mp3") returned 5 [0136.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.wav") returned 0 [0136.270] lstrlenA (lpString="*.wav") returned 5 [0136.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.flac") returned 0 [0136.270] lstrlenA (lpString="*.flac") returned 6 [0136.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.ape") returned 0 [0136.270] lstrlenA (lpString="*.ape") returned 5 [0136.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.wma") returned 0 [0136.270] lstrlenA (lpString="*.wma") returned 5 [0136.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.ac3") returned 0 [0136.270] lstrlenA (lpString="*.ac3") returned 5 [0136.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll", pszSpec="*.doc") returned 0 [0136.270] lstrlenA (lpString="*.doc") returned 5 [0136.270] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1104f18b, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1104f18b, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1104f18b, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Powershell.PSReadline.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.270] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.270] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Powershell.PSReadline.ni.dll.aux") returned -1 [0136.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Powershell.PSReadline.ni.dll.aux") returned -1 [0136.270] lstrcmpiA (lpString1="", lpString2="Microsoft.Powershell.PSReadline.ni.dll.aux") returned -1 [0136.270] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll") returned="Microsoft.Powershell.PSReadline.ni.dll" [0136.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\" [0136.270] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\") returned="" [0136.270] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\HOW TO DECRYPT FILES.txt" [0136.270] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\how to decrypt files.txt")) returned 0x20 [0136.270] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\", lpString2="Microsoft.Powershell.PSReadline.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux" [0136.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.270] lstrlenA (lpString="*.zip") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.271] lstrlenA (lpString="*.rar") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.271] lstrlenA (lpString="*.7z") returned 4 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.271] lstrlenA (lpString="*.tar") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.271] lstrlenA (lpString="*.gzip") returned 6 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.271] lstrlenA (lpString="*.jpg") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.271] lstrlenA (lpString="*.jpeg") returned 6 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.271] lstrlenA (lpString="*.psd") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.271] lstrlenA (lpString="*.cdr") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.271] lstrlenA (lpString="*.dwg") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.max") returned 0 [0136.271] lstrlenA (lpString="*.max") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.271] lstrlenA (lpString="*.bmp") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.271] lstrlenA (lpString="*.gif") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.png") returned 0 [0136.271] lstrlenA (lpString="*.png") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.271] lstrlenA (lpString="*.doc") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.271] lstrlenA (lpString="*.docx") returned 6 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.271] lstrlenA (lpString="*.xls") returned 5 [0136.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.272] lstrlenA (lpString="*.xlsx") returned 6 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.272] lstrlenA (lpString="*.ppt") returned 5 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.272] lstrlenA (lpString="*.pptx") returned 6 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.272] lstrlenA (lpString="*.txt") returned 5 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.272] lstrlenA (lpString="*.pdf") returned 5 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.272] lstrlenA (lpString="*.djvu") returned 6 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.272] lstrlenA (lpString="*.htm") returned 5 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.html") returned 0 [0136.272] lstrlenA (lpString="*.html") returned 6 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.272] lstrlenA (lpString="*.mdb") returned 5 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.272] lstrlenA (lpString="*.cer") returned 5 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.272] lstrlenA (lpString="*.p12") returned 5 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.272] lstrlenA (lpString="*.pfx") returned 5 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.272] lstrlenA (lpString="*.kwm") returned 5 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.272] lstrlenA (lpString="*.pwm") returned 5 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.272] lstrlenA (lpString="*.1cd") returned 5 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.md") returned 0 [0136.272] lstrlenA (lpString="*.md") returned 4 [0136.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.272] lstrlenA (lpString="*.mdf") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.273] lstrlenA (lpString="*.dbf") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.273] lstrlenA (lpString="*.odt") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.273] lstrlenA (lpString="*.vob") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.273] lstrlenA (lpString="*.ifo") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.273] lstrlenA (lpString="*.lnk") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.273] lstrlenA (lpString="*.torrent") returned 9 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.273] lstrlenA (lpString="*.mov") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.273] lstrlenA (lpString="*.m2v") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.273] lstrlenA (lpString="*.3gp") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.273] lstrlenA (lpString="*.mpeg") returned 6 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.273] lstrlenA (lpString="*.mpg") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.273] lstrlenA (lpString="*.flv") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.273] lstrlenA (lpString="*.avi") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.273] lstrlenA (lpString="*.mp4") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.273] lstrlenA (lpString="*.wmv") returned 5 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.273] lstrlenA (lpString="*.divx") returned 6 [0136.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.274] lstrlenA (lpString="*.mkv") returned 5 [0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.274] lstrlenA (lpString="*.mp3") returned 5 [0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.274] lstrlenA (lpString="*.wav") returned 5 [0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.274] lstrlenA (lpString="*.flac") returned 6 [0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.274] lstrlenA (lpString="*.ape") returned 5 [0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.274] lstrlenA (lpString="*.wma") returned 5 [0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.274] lstrlenA (lpString="*.ac3") returned 5 [0136.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pa0bb478f#\\389a1852c85e4f7b4e1b011f6fcc9ab9\\Microsoft.Powershell.PSReadline.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.274] lstrlenA (lpString="*.doc") returned 5 [0136.274] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1104f18b, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1104f18b, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1104f18b, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Powershell.PSReadline.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.274] FindClose (in: hFindFile=0x759d90 | out: hFindFile=0x759d90) returned 1 [0136.274] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1104f18b, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1104f18b, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1104f18b, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="389a1852c85e4f7b4e1b011f6fcc9ab9", cAlternateFileName="389A18~1")) returned 0 [0136.274] FindClose (in: hFindFile=0x759fd0 | out: hFindFile=0x759fd0) returned 1 [0136.275] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9ee55aa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b3d37ae, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b3d37ae, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75612e6c, dwReserved1=0x78000078, cFileName="Microsoft.Pad0e0718#", cAlternateFileName="MICROS~1.PAD")) returned 1 [0136.275] lstrcmpA (lpString1=".", lpString2="Microsoft.Pad0e0718#") returned -1 [0136.275] lstrcmpA (lpString1="..", lpString2="Microsoft.Pad0e0718#") returned -1 [0136.275] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.275] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Pad0e0718#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#" [0136.275] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#") returned 67 [0136.275] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9ee55aa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b3d37ae, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b3d37ae, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.317] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.317] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9ee55aa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b3d37ae, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b3d37ae, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.317] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.317] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.317] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x311fb806, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x313c5413, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x313c5413, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5a6da82203d85c4f8c90724b7880dda9", cAlternateFileName="5A6DA8~1")) returned 1 [0136.317] lstrcmpA (lpString1=".", lpString2="5a6da82203d85c4f8c90724b7880dda9") returned -1 [0136.317] lstrcmpA (lpString1="..", lpString2="5a6da82203d85c4f8c90724b7880dda9") returned -1 [0136.317] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\*.*") returned="*.*" [0136.317] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\", lpString2="5a6da82203d85c4f8c90724b7880dda9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9" [0136.317] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9") returned 100 [0136.317] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x311fb806, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x313c5413, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x313c5413, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0136.319] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.319] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x311fb806, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x313c5413, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x313c5413, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.319] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.319] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.319] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x311fb806, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x311fb806, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x313c5413, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x34400, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Cmdletization.OData.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.319] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.319] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Cmdletization.OData.ni.dll") returned -1 [0136.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Cmdletization.OData.ni.dll") returned -1 [0136.319] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Cmdletization.OData.ni.dll") returned -1 [0136.319] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\*.*") returned="*.*" [0136.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\" [0136.319] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\") returned="" [0136.319] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\HOW TO DECRYPT FILES.txt" [0136.319] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\how to decrypt files.txt")) returned 0xffffffff [0136.320] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.321] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.321] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.322] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.322] CloseHandle (hObject=0x214) returned 1 [0136.322] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\", lpString2="Microsoft.PowerShell.Cmdletization.OData.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll" [0136.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.zip") returned 0 [0136.322] lstrlenA (lpString="*.zip") returned 5 [0136.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.rar") returned 0 [0136.322] lstrlenA (lpString="*.rar") returned 5 [0136.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.7z") returned 0 [0136.322] lstrlenA (lpString="*.7z") returned 4 [0136.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.tar") returned 0 [0136.322] lstrlenA (lpString="*.tar") returned 5 [0136.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.gzip") returned 0 [0136.322] lstrlenA (lpString="*.gzip") returned 6 [0136.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.jpg") returned 0 [0136.322] lstrlenA (lpString="*.jpg") returned 5 [0136.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.jpeg") returned 0 [0136.322] lstrlenA (lpString="*.jpeg") returned 6 [0136.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.psd") returned 0 [0136.322] lstrlenA (lpString="*.psd") returned 5 [0136.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.cdr") returned 0 [0136.322] lstrlenA (lpString="*.cdr") returned 5 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.dwg") returned 0 [0136.323] lstrlenA (lpString="*.dwg") returned 5 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.max") returned 0 [0136.323] lstrlenA (lpString="*.max") returned 5 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.bmp") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.gif") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.png") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.doc") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.docx") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.xls") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.xlsx") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.ppt") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.pptx") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.txt") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.pdf") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.djvu") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.htm") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.html") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.mdb") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.cer") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.p12") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.pfx") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.kwm") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.pwm") returned 0 [0136.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.1cd") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.md") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.mdf") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.dbf") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.odt") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.vob") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.ifo") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.lnk") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.torrent") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.mov") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.m2v") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.3gp") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.mpeg") returned 0 [0136.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.mpg") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.flv") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.avi") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.mp4") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.wmv") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.divx") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.mkv") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.mp3") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.wav") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.flac") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.ape") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.wma") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.ac3") returned 0 [0136.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll", pszSpec="*.doc") returned 0 [0136.325] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x311fb806, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x311fb806, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x313c5413, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.325] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.325] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux") returned -1 [0136.325] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux") returned -1 [0136.325] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux") returned -1 [0136.325] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll") returned="Microsoft.PowerShell.Cmdletization.OData.ni.dll" [0136.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\" [0136.325] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\") returned="" [0136.325] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\HOW TO DECRYPT FILES.txt" [0136.325] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\how to decrypt files.txt")) returned 0x20 [0136.325] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\", lpString2="Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux" [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.max") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.png") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.html") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.md") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pad0e0718#\\5a6da82203d85c4f8c90724b7880dda9\\Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.328] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x311fb806, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x311fb806, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x313c5413, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Cmdletization.OData.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.328] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0136.329] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x311fb806, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x313c5413, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x313c5413, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5a6da82203d85c4f8c90724b7880dda9", cAlternateFileName="5A6DA8~1")) returned 0 [0136.329] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.329] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9097371, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b46c03e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b46c03e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x787561, dwReserved1=0x78000078, cFileName="Microsoft.Pae3498d9#", cAlternateFileName="MICROS~1.PAE")) returned 1 [0136.329] lstrcmpA (lpString1=".", lpString2="Microsoft.Pae3498d9#") returned -1 [0136.329] lstrcmpA (lpString1="..", lpString2="Microsoft.Pae3498d9#") returned -1 [0136.329] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.329] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Pae3498d9#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#" [0136.329] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9097371, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b46c03e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b46c03e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d90 [0136.329] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.329] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9097371, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b46c03e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b46c03e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.329] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.330] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.330] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf1ae8e6, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xaf1ae8e6, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xaf1ae8e6, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="daa7bf1b1d2f6c35917869ebff1fa067", cAlternateFileName="DAA7BF~1")) returned 1 [0136.330] lstrcmpA (lpString1=".", lpString2="daa7bf1b1d2f6c35917869ebff1fa067") returned -1 [0136.330] lstrcmpA (lpString1="..", lpString2="daa7bf1b1d2f6c35917869ebff1fa067") returned -1 [0136.330] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\*.*") returned="*.*" [0136.330] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\", lpString2="daa7bf1b1d2f6c35917869ebff1fa067" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067" [0136.330] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf1ae8e6, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xaf1ae8e6, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xaf1ae8e6, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.331] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.331] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf1ae8e6, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xaf1ae8e6, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xaf1ae8e6, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.332] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.332] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.332] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf188684, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xaf188684, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xaf1ae8e6, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x22f200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Commands.Management.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.332] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.332] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Commands.Management.ni.dll") returned -1 [0136.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Commands.Management.ni.dll") returned -1 [0136.332] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Commands.Management.ni.dll") returned -1 [0136.332] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\*.*") returned="*.*" [0136.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\" [0136.332] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\") returned="" [0136.332] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\HOW TO DECRYPT FILES.txt" [0136.332] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\how to decrypt files.txt")) returned 0xffffffff [0136.332] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.333] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.334] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.334] CloseHandle (hObject=0x214) returned 1 [0136.334] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\", lpString2="Microsoft.PowerShell.Commands.Management.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll" [0136.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.zip") returned 0 [0136.334] lstrlenA (lpString="*.zip") returned 5 [0136.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.rar") returned 0 [0136.334] lstrlenA (lpString="*.rar") returned 5 [0136.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.7z") returned 0 [0136.334] lstrlenA (lpString="*.7z") returned 4 [0136.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.tar") returned 0 [0136.334] lstrlenA (lpString="*.tar") returned 5 [0136.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.gzip") returned 0 [0136.334] lstrlenA (lpString="*.gzip") returned 6 [0136.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.jpg") returned 0 [0136.334] lstrlenA (lpString="*.jpg") returned 5 [0136.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.jpeg") returned 0 [0136.334] lstrlenA (lpString="*.jpeg") returned 6 [0136.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.psd") returned 0 [0136.334] lstrlenA (lpString="*.psd") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.cdr") returned 0 [0136.335] lstrlenA (lpString="*.cdr") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.dwg") returned 0 [0136.335] lstrlenA (lpString="*.dwg") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.max") returned 0 [0136.335] lstrlenA (lpString="*.max") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.bmp") returned 0 [0136.335] lstrlenA (lpString="*.bmp") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.gif") returned 0 [0136.335] lstrlenA (lpString="*.gif") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.png") returned 0 [0136.335] lstrlenA (lpString="*.png") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.doc") returned 0 [0136.335] lstrlenA (lpString="*.doc") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.docx") returned 0 [0136.335] lstrlenA (lpString="*.docx") returned 6 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.xls") returned 0 [0136.335] lstrlenA (lpString="*.xls") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.xlsx") returned 0 [0136.335] lstrlenA (lpString="*.xlsx") returned 6 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.ppt") returned 0 [0136.335] lstrlenA (lpString="*.ppt") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.pptx") returned 0 [0136.335] lstrlenA (lpString="*.pptx") returned 6 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.txt") returned 0 [0136.335] lstrlenA (lpString="*.txt") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.pdf") returned 0 [0136.335] lstrlenA (lpString="*.pdf") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.djvu") returned 0 [0136.335] lstrlenA (lpString="*.djvu") returned 6 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.htm") returned 0 [0136.335] lstrlenA (lpString="*.htm") returned 5 [0136.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.html") returned 0 [0136.336] lstrlenA (lpString="*.html") returned 6 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mdb") returned 0 [0136.336] lstrlenA (lpString="*.mdb") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.cer") returned 0 [0136.336] lstrlenA (lpString="*.cer") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.p12") returned 0 [0136.336] lstrlenA (lpString="*.p12") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.pfx") returned 0 [0136.336] lstrlenA (lpString="*.pfx") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.kwm") returned 0 [0136.336] lstrlenA (lpString="*.kwm") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.pwm") returned 0 [0136.336] lstrlenA (lpString="*.pwm") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.1cd") returned 0 [0136.336] lstrlenA (lpString="*.1cd") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.md") returned 0 [0136.336] lstrlenA (lpString="*.md") returned 4 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mdf") returned 0 [0136.336] lstrlenA (lpString="*.mdf") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.dbf") returned 0 [0136.336] lstrlenA (lpString="*.dbf") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.odt") returned 0 [0136.336] lstrlenA (lpString="*.odt") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.vob") returned 0 [0136.336] lstrlenA (lpString="*.vob") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.ifo") returned 0 [0136.336] lstrlenA (lpString="*.ifo") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.lnk") returned 0 [0136.336] lstrlenA (lpString="*.lnk") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.torrent") returned 0 [0136.336] lstrlenA (lpString="*.torrent") returned 9 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mov") returned 0 [0136.336] lstrlenA (lpString="*.mov") returned 5 [0136.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.m2v") returned 0 [0136.337] lstrlenA (lpString="*.m2v") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.3gp") returned 0 [0136.337] lstrlenA (lpString="*.3gp") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mpeg") returned 0 [0136.337] lstrlenA (lpString="*.mpeg") returned 6 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mpg") returned 0 [0136.337] lstrlenA (lpString="*.mpg") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.flv") returned 0 [0136.337] lstrlenA (lpString="*.flv") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.avi") returned 0 [0136.337] lstrlenA (lpString="*.avi") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mp4") returned 0 [0136.337] lstrlenA (lpString="*.mp4") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.wmv") returned 0 [0136.337] lstrlenA (lpString="*.wmv") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.divx") returned 0 [0136.337] lstrlenA (lpString="*.divx") returned 6 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mkv") returned 0 [0136.337] lstrlenA (lpString="*.mkv") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mp3") returned 0 [0136.337] lstrlenA (lpString="*.mp3") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.wav") returned 0 [0136.337] lstrlenA (lpString="*.wav") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.flac") returned 0 [0136.337] lstrlenA (lpString="*.flac") returned 6 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.ape") returned 0 [0136.337] lstrlenA (lpString="*.ape") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.wma") returned 0 [0136.337] lstrlenA (lpString="*.wma") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.ac3") returned 0 [0136.337] lstrlenA (lpString="*.ac3") returned 5 [0136.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.doc") returned 0 [0136.337] lstrlenA (lpString="*.doc") returned 5 [0136.338] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1ae8e6, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xaf1ae8e6, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Commands.Management.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.338] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Commands.Management.ni.dll.aux") returned -1 [0136.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Commands.Management.ni.dll.aux") returned -1 [0136.338] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Commands.Management.ni.dll.aux") returned -1 [0136.338] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll") returned="Microsoft.PowerShell.Commands.Management.ni.dll" [0136.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\" [0136.338] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\") returned="" [0136.338] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\HOW TO DECRYPT FILES.txt" [0136.338] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\how to decrypt files.txt")) returned 0x20 [0136.338] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\", lpString2="Microsoft.PowerShell.Commands.Management.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux" [0136.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.338] lstrlenA (lpString="*.zip") returned 5 [0136.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.338] lstrlenA (lpString="*.rar") returned 5 [0136.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.338] lstrlenA (lpString="*.7z") returned 4 [0136.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.338] lstrlenA (lpString="*.tar") returned 5 [0136.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.338] lstrlenA (lpString="*.gzip") returned 6 [0136.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.338] lstrlenA (lpString="*.jpg") returned 5 [0136.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.338] lstrlenA (lpString="*.jpeg") returned 6 [0136.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.338] lstrlenA (lpString="*.psd") returned 5 [0136.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.338] lstrlenA (lpString="*.cdr") returned 5 [0136.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.339] lstrlenA (lpString="*.dwg") returned 5 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.max") returned 0 [0136.339] lstrlenA (lpString="*.max") returned 5 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.339] lstrlenA (lpString="*.bmp") returned 5 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.339] lstrlenA (lpString="*.gif") returned 5 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.png") returned 0 [0136.339] lstrlenA (lpString="*.png") returned 5 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.339] lstrlenA (lpString="*.doc") returned 5 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.339] lstrlenA (lpString="*.docx") returned 6 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.339] lstrlenA (lpString="*.xls") returned 5 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.339] lstrlenA (lpString="*.xlsx") returned 6 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.339] lstrlenA (lpString="*.ppt") returned 5 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.339] lstrlenA (lpString="*.pptx") returned 6 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.339] lstrlenA (lpString="*.txt") returned 5 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.339] lstrlenA (lpString="*.pdf") returned 5 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.339] lstrlenA (lpString="*.djvu") returned 6 [0136.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.340] lstrlenA (lpString="*.htm") returned 5 [0136.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.html") returned 0 [0136.340] lstrlenA (lpString="*.html") returned 6 [0136.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.340] lstrlenA (lpString="*.mdb") returned 5 [0136.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.340] lstrlenA (lpString="*.cer") returned 5 [0136.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.340] lstrlenA (lpString="*.p12") returned 5 [0136.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.340] lstrlenA (lpString="*.pfx") returned 5 [0136.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.340] lstrlenA (lpString="*.kwm") returned 5 [0136.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.340] lstrlenA (lpString="*.pwm") returned 5 [0136.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.340] lstrlenA (lpString="*.1cd") returned 5 [0136.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.md") returned 0 [0136.340] lstrlenA (lpString="*.md") returned 4 [0136.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.340] lstrlenA (lpString="*.mdf") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.341] lstrlenA (lpString="*.dbf") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.341] lstrlenA (lpString="*.odt") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.341] lstrlenA (lpString="*.vob") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.341] lstrlenA (lpString="*.ifo") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.341] lstrlenA (lpString="*.lnk") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.341] lstrlenA (lpString="*.torrent") returned 9 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.341] lstrlenA (lpString="*.mov") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.341] lstrlenA (lpString="*.m2v") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.341] lstrlenA (lpString="*.3gp") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.341] lstrlenA (lpString="*.mpeg") returned 6 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.341] lstrlenA (lpString="*.mpg") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.341] lstrlenA (lpString="*.flv") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.341] lstrlenA (lpString="*.avi") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.341] lstrlenA (lpString="*.mp4") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.341] lstrlenA (lpString="*.wmv") returned 5 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.341] lstrlenA (lpString="*.divx") returned 6 [0136.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.342] lstrlenA (lpString="*.mkv") returned 5 [0136.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.342] lstrlenA (lpString="*.mp3") returned 5 [0136.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.342] lstrlenA (lpString="*.wav") returned 5 [0136.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.342] lstrlenA (lpString="*.flac") returned 6 [0136.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.342] lstrlenA (lpString="*.ape") returned 5 [0136.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.342] lstrlenA (lpString="*.wma") returned 5 [0136.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.342] lstrlenA (lpString="*.ac3") returned 5 [0136.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\daa7bf1b1d2f6c35917869ebff1fa067\\Microsoft.PowerShell.Commands.Management.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.342] lstrlenA (lpString="*.doc") returned 5 [0136.342] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1ae8e6, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xaf1ae8e6, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Commands.Management.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.342] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0136.342] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf1ae8e6, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xaf1ae8e6, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xaf1ae8e6, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="daa7bf1b1d2f6c35917869ebff1fa067", cAlternateFileName="DAA7BF~1")) returned 0 [0136.342] FindClose (in: hFindFile=0x759d90 | out: hFindFile=0x759d90) returned 1 [0136.343] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb91c864a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b550d60, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b550d60, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x787561, dwReserved1=0x78000078, cFileName="Microsoft.Pb378ec07#", cAlternateFileName="MICROS~1.PB3")) returned 1 [0136.343] lstrcmpA (lpString1=".", lpString2="Microsoft.Pb378ec07#") returned -1 [0136.343] lstrcmpA (lpString1="..", lpString2="Microsoft.Pb378ec07#") returned -1 [0136.343] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.343] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Pb378ec07#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#" [0136.343] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#") returned 67 [0136.343] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb91c864a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b550d60, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b550d60, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0136.344] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.344] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb91c864a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b550d60, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b550d60, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.344] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.344] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.344] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaacfca74, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xaacfca74, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xaacfca74, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="04bf37c79005c8e72182b5a7bf45a001", cAlternateFileName="04BF37~1")) returned 1 [0136.344] lstrcmpA (lpString1=".", lpString2="04bf37c79005c8e72182b5a7bf45a001") returned -1 [0136.344] lstrcmpA (lpString1="..", lpString2="04bf37c79005c8e72182b5a7bf45a001") returned -1 [0136.344] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\*.*") returned="*.*" [0136.344] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\", lpString2="04bf37c79005c8e72182b5a7bf45a001" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001" [0136.344] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001") returned 100 [0136.344] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaacfca74, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xaacfca74, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xaacfca74, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.346] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.346] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaacfca74, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xaacfca74, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xaacfca74, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.346] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.346] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.346] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacd6809, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xaacd6809, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xaacfca74, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0xa3e00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.ConsoleHost.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.346] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.346] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.ConsoleHost.ni.dll") returned -1 [0136.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.ConsoleHost.ni.dll") returned -1 [0136.346] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.ConsoleHost.ni.dll") returned -1 [0136.346] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\*.*") returned="*.*" [0136.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\" [0136.346] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\") returned="" [0136.346] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\HOW TO DECRYPT FILES.txt" [0136.346] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\how to decrypt files.txt")) returned 0xffffffff [0136.346] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.347] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.347] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.348] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.348] CloseHandle (hObject=0x214) returned 1 [0136.348] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\", lpString2="Microsoft.PowerShell.ConsoleHost.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll" [0136.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.zip") returned 0 [0136.348] lstrlenA (lpString="*.zip") returned 5 [0136.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.rar") returned 0 [0136.348] lstrlenA (lpString="*.rar") returned 5 [0136.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.7z") returned 0 [0136.348] lstrlenA (lpString="*.7z") returned 4 [0136.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.tar") returned 0 [0136.348] lstrlenA (lpString="*.tar") returned 5 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.gzip") returned 0 [0136.349] lstrlenA (lpString="*.gzip") returned 6 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.jpg") returned 0 [0136.349] lstrlenA (lpString="*.jpg") returned 5 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.jpeg") returned 0 [0136.349] lstrlenA (lpString="*.jpeg") returned 6 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.psd") returned 0 [0136.349] lstrlenA (lpString="*.psd") returned 5 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.cdr") returned 0 [0136.349] lstrlenA (lpString="*.cdr") returned 5 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.dwg") returned 0 [0136.349] lstrlenA (lpString="*.dwg") returned 5 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.max") returned 0 [0136.349] lstrlenA (lpString="*.max") returned 5 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.bmp") returned 0 [0136.349] lstrlenA (lpString="*.bmp") returned 5 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.gif") returned 0 [0136.349] lstrlenA (lpString="*.gif") returned 5 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.png") returned 0 [0136.349] lstrlenA (lpString="*.png") returned 5 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.doc") returned 0 [0136.349] lstrlenA (lpString="*.doc") returned 5 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.docx") returned 0 [0136.349] lstrlenA (lpString="*.docx") returned 6 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.xls") returned 0 [0136.349] lstrlenA (lpString="*.xls") returned 5 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.xlsx") returned 0 [0136.349] lstrlenA (lpString="*.xlsx") returned 6 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.ppt") returned 0 [0136.349] lstrlenA (lpString="*.ppt") returned 5 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.pptx") returned 0 [0136.349] lstrlenA (lpString="*.pptx") returned 6 [0136.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.txt") returned 0 [0136.350] lstrlenA (lpString="*.txt") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.pdf") returned 0 [0136.350] lstrlenA (lpString="*.pdf") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.djvu") returned 0 [0136.350] lstrlenA (lpString="*.djvu") returned 6 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.htm") returned 0 [0136.350] lstrlenA (lpString="*.htm") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.html") returned 0 [0136.350] lstrlenA (lpString="*.html") returned 6 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mdb") returned 0 [0136.350] lstrlenA (lpString="*.mdb") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.cer") returned 0 [0136.350] lstrlenA (lpString="*.cer") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.p12") returned 0 [0136.350] lstrlenA (lpString="*.p12") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.pfx") returned 0 [0136.350] lstrlenA (lpString="*.pfx") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.kwm") returned 0 [0136.350] lstrlenA (lpString="*.kwm") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.pwm") returned 0 [0136.350] lstrlenA (lpString="*.pwm") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.1cd") returned 0 [0136.350] lstrlenA (lpString="*.1cd") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.md") returned 0 [0136.350] lstrlenA (lpString="*.md") returned 4 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mdf") returned 0 [0136.350] lstrlenA (lpString="*.mdf") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.dbf") returned 0 [0136.350] lstrlenA (lpString="*.dbf") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.odt") returned 0 [0136.350] lstrlenA (lpString="*.odt") returned 5 [0136.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.vob") returned 0 [0136.350] lstrlenA (lpString="*.vob") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.ifo") returned 0 [0136.351] lstrlenA (lpString="*.ifo") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.lnk") returned 0 [0136.351] lstrlenA (lpString="*.lnk") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.torrent") returned 0 [0136.351] lstrlenA (lpString="*.torrent") returned 9 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mov") returned 0 [0136.351] lstrlenA (lpString="*.mov") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.m2v") returned 0 [0136.351] lstrlenA (lpString="*.m2v") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.3gp") returned 0 [0136.351] lstrlenA (lpString="*.3gp") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mpeg") returned 0 [0136.351] lstrlenA (lpString="*.mpeg") returned 6 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mpg") returned 0 [0136.351] lstrlenA (lpString="*.mpg") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.flv") returned 0 [0136.351] lstrlenA (lpString="*.flv") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.avi") returned 0 [0136.351] lstrlenA (lpString="*.avi") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mp4") returned 0 [0136.351] lstrlenA (lpString="*.mp4") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.wmv") returned 0 [0136.351] lstrlenA (lpString="*.wmv") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.divx") returned 0 [0136.351] lstrlenA (lpString="*.divx") returned 6 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mkv") returned 0 [0136.351] lstrlenA (lpString="*.mkv") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mp3") returned 0 [0136.351] lstrlenA (lpString="*.mp3") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.wav") returned 0 [0136.351] lstrlenA (lpString="*.wav") returned 5 [0136.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.flac") returned 0 [0136.351] lstrlenA (lpString="*.flac") returned 6 [0136.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.ape") returned 0 [0136.352] lstrlenA (lpString="*.ape") returned 5 [0136.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.wma") returned 0 [0136.352] lstrlenA (lpString="*.wma") returned 5 [0136.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.ac3") returned 0 [0136.352] lstrlenA (lpString="*.ac3") returned 5 [0136.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.doc") returned 0 [0136.352] lstrlenA (lpString="*.doc") returned 5 [0136.352] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacfca74, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xaacfca74, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ConsoleHost.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.352] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.352] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.ConsoleHost.ni.dll.aux") returned -1 [0136.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.ConsoleHost.ni.dll.aux") returned -1 [0136.352] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.ConsoleHost.ni.dll.aux") returned -1 [0136.352] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll") returned="Microsoft.PowerShell.ConsoleHost.ni.dll" [0136.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\" [0136.352] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\") returned="" [0136.352] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\HOW TO DECRYPT FILES.txt" [0136.352] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\how to decrypt files.txt")) returned 0x20 [0136.352] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\", lpString2="Microsoft.PowerShell.ConsoleHost.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux" [0136.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.352] lstrlenA (lpString="*.zip") returned 5 [0136.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.352] lstrlenA (lpString="*.rar") returned 5 [0136.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.352] lstrlenA (lpString="*.7z") returned 4 [0136.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.352] lstrlenA (lpString="*.tar") returned 5 [0136.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.352] lstrlenA (lpString="*.gzip") returned 6 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.353] lstrlenA (lpString="*.jpg") returned 5 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.353] lstrlenA (lpString="*.jpeg") returned 6 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.353] lstrlenA (lpString="*.psd") returned 5 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.353] lstrlenA (lpString="*.cdr") returned 5 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.353] lstrlenA (lpString="*.dwg") returned 5 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.max") returned 0 [0136.353] lstrlenA (lpString="*.max") returned 5 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.353] lstrlenA (lpString="*.bmp") returned 5 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.353] lstrlenA (lpString="*.gif") returned 5 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.png") returned 0 [0136.353] lstrlenA (lpString="*.png") returned 5 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.353] lstrlenA (lpString="*.doc") returned 5 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.353] lstrlenA (lpString="*.docx") returned 6 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.353] lstrlenA (lpString="*.xls") returned 5 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.353] lstrlenA (lpString="*.xlsx") returned 6 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.353] lstrlenA (lpString="*.ppt") returned 5 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.353] lstrlenA (lpString="*.pptx") returned 6 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.353] lstrlenA (lpString="*.txt") returned 5 [0136.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.354] lstrlenA (lpString="*.pdf") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.354] lstrlenA (lpString="*.djvu") returned 6 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.354] lstrlenA (lpString="*.htm") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.html") returned 0 [0136.354] lstrlenA (lpString="*.html") returned 6 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.354] lstrlenA (lpString="*.mdb") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.354] lstrlenA (lpString="*.cer") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.354] lstrlenA (lpString="*.p12") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.354] lstrlenA (lpString="*.pfx") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.354] lstrlenA (lpString="*.kwm") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.354] lstrlenA (lpString="*.pwm") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.354] lstrlenA (lpString="*.1cd") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.md") returned 0 [0136.354] lstrlenA (lpString="*.md") returned 4 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.354] lstrlenA (lpString="*.mdf") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.354] lstrlenA (lpString="*.dbf") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.354] lstrlenA (lpString="*.odt") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.354] lstrlenA (lpString="*.vob") returned 5 [0136.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.354] lstrlenA (lpString="*.ifo") returned 5 [0136.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.355] lstrlenA (lpString="*.lnk") returned 5 [0136.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.355] lstrlenA (lpString="*.torrent") returned 9 [0136.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.355] lstrlenA (lpString="*.mov") returned 5 [0136.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.355] lstrlenA (lpString="*.m2v") returned 5 [0136.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.355] lstrlenA (lpString="*.3gp") returned 5 [0136.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.355] lstrlenA (lpString="*.mpeg") returned 6 [0136.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.355] lstrlenA (lpString="*.mpg") returned 5 [0136.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.355] lstrlenA (lpString="*.flv") returned 5 [0136.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.360] lstrlenA (lpString="*.avi") returned 5 [0136.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.360] lstrlenA (lpString="*.mp4") returned 5 [0136.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.360] lstrlenA (lpString="*.wmv") returned 5 [0136.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.360] lstrlenA (lpString="*.divx") returned 6 [0136.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.361] lstrlenA (lpString="*.mkv") returned 5 [0136.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.361] lstrlenA (lpString="*.mp3") returned 5 [0136.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.361] lstrlenA (lpString="*.wav") returned 5 [0136.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.361] lstrlenA (lpString="*.flac") returned 6 [0136.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.361] lstrlenA (lpString="*.ape") returned 5 [0136.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.361] lstrlenA (lpString="*.wma") returned 5 [0136.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.361] lstrlenA (lpString="*.ac3") returned 5 [0136.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\04bf37c79005c8e72182b5a7bf45a001\\Microsoft.PowerShell.ConsoleHost.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.361] lstrlenA (lpString="*.doc") returned 5 [0136.361] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacfca74, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xaacfca74, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ConsoleHost.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.361] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.361] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaacfca74, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xaacfca74, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xaacfca74, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="04bf37c79005c8e72182b5a7bf45a001", cAlternateFileName="04BF37~1")) returned 0 [0136.362] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0136.362] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9260fbd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b8bdf67, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b8bdf67, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x787561, dwReserved1=0x78000078, cFileName="Microsoft.Pcd26229b#", cAlternateFileName="MICROS~1.PCD")) returned 1 [0136.362] lstrcmpA (lpString1=".", lpString2="Microsoft.Pcd26229b#") returned -1 [0136.362] lstrcmpA (lpString1="..", lpString2="Microsoft.Pcd26229b#") returned -1 [0136.362] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.362] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Pcd26229b#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#" [0136.362] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#") returned 67 [0136.362] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9260fbd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b8bdf67, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b8bdf67, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.362] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.362] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9260fbd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b8bdf67, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b8bdf67, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.362] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.362] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.362] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e2d5a1f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e2d5a1f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e2d5a1f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="27911c281557c446a41b11cad8ebf2f1", cAlternateFileName="27911C~1")) returned 1 [0136.362] lstrcmpA (lpString1=".", lpString2="27911c281557c446a41b11cad8ebf2f1") returned -1 [0136.362] lstrcmpA (lpString1="..", lpString2="27911c281557c446a41b11cad8ebf2f1") returned -1 [0136.362] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\*.*") returned="*.*" [0136.363] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\", lpString2="27911c281557c446a41b11cad8ebf2f1" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1" [0136.363] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1") returned 100 [0136.363] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e2d5a1f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e2d5a1f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e2d5a1f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.364] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.364] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e2d5a1f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e2d5a1f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e2d5a1f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.364] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.364] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.364] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2af7f4, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e2af7f4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e2fbc52, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x166400, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.GraphicalHost.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.364] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.364] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.GraphicalHost.ni.dll") returned -1 [0136.364] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.GraphicalHost.ni.dll") returned -1 [0136.364] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.GraphicalHost.ni.dll") returned -1 [0136.364] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\*.*") returned="*.*" [0136.364] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\" [0136.364] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\") returned="" [0136.365] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\HOW TO DECRYPT FILES.txt" [0136.365] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\how to decrypt files.txt")) returned 0xffffffff [0136.365] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.366] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.366] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.367] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.367] CloseHandle (hObject=0x214) returned 1 [0136.367] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\", lpString2="Microsoft.PowerShell.GraphicalHost.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll" [0136.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.zip") returned 0 [0136.367] lstrlenA (lpString="*.zip") returned 5 [0136.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.rar") returned 0 [0136.367] lstrlenA (lpString="*.rar") returned 5 [0136.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.7z") returned 0 [0136.367] lstrlenA (lpString="*.7z") returned 4 [0136.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.tar") returned 0 [0136.367] lstrlenA (lpString="*.tar") returned 5 [0136.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.gzip") returned 0 [0136.367] lstrlenA (lpString="*.gzip") returned 6 [0136.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.jpg") returned 0 [0136.368] lstrlenA (lpString="*.jpg") returned 5 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.jpeg") returned 0 [0136.368] lstrlenA (lpString="*.jpeg") returned 6 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.psd") returned 0 [0136.368] lstrlenA (lpString="*.psd") returned 5 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.cdr") returned 0 [0136.368] lstrlenA (lpString="*.cdr") returned 5 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.dwg") returned 0 [0136.368] lstrlenA (lpString="*.dwg") returned 5 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.max") returned 0 [0136.368] lstrlenA (lpString="*.max") returned 5 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.bmp") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.gif") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.png") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.doc") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.docx") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.xls") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.xlsx") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.ppt") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.pptx") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.txt") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.pdf") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.djvu") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.htm") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.html") returned 0 [0136.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mdb") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.cer") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.p12") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.pfx") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.kwm") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.pwm") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.1cd") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.md") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mdf") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.dbf") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.odt") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.vob") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.ifo") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.lnk") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.torrent") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mov") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.m2v") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.3gp") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mpeg") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mpg") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.flv") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.avi") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mp4") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.wmv") returned 0 [0136.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.divx") returned 0 [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mkv") returned 0 [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mp3") returned 0 [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.wav") returned 0 [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.flac") returned 0 [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.ape") returned 0 [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.wma") returned 0 [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.ac3") returned 0 [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.doc") returned 0 [0136.370] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2d5a1f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e2d5a1f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e2d5a1f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.GraphicalHost.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.370] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.370] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.GraphicalHost.ni.dll.aux") returned -1 [0136.370] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.GraphicalHost.ni.dll.aux") returned -1 [0136.370] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.GraphicalHost.ni.dll.aux") returned -1 [0136.370] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll") returned="Microsoft.PowerShell.GraphicalHost.ni.dll" [0136.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\" [0136.370] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\") returned="" [0136.370] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\HOW TO DECRYPT FILES.txt" [0136.370] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\how to decrypt files.txt")) returned 0x20 [0136.370] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\", lpString2="Microsoft.PowerShell.GraphicalHost.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux" [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.max") returned 0 [0136.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.png") returned 0 [0136.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.html") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.md") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pcd26229b#\\27911c281557c446a41b11cad8ebf2f1\\Microsoft.PowerShell.GraphicalHost.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.373] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2d5a1f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e2d5a1f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e2d5a1f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.GraphicalHost.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.373] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.374] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e2d5a1f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e2d5a1f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e2d5a1f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="27911c281557c446a41b11cad8ebf2f1", cAlternateFileName="27911C~1")) returned 0 [0136.374] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0136.374] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9666f5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b9305b7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b9305b7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x787561, dwReserved1=0x78000078, cFileName="Microsoft.Pd3efef62#", cAlternateFileName="MICROS~1.PD3")) returned 1 [0136.374] lstrcmpA (lpString1=".", lpString2="Microsoft.Pd3efef62#") returned -1 [0136.374] lstrcmpA (lpString1="..", lpString2="Microsoft.Pd3efef62#") returned -1 [0136.374] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.374] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Pd3efef62#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#" [0136.374] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9666f5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b9305b7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b9305b7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.375] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.375] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9666f5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b9305b7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5b9305b7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.375] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.375] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.375] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e5d0573, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e5d0573, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e5d0573, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3e8cac7665eaf109fb381e78da11ef25", cAlternateFileName="3E8CAC~1")) returned 1 [0136.375] lstrcmpA (lpString1=".", lpString2="3e8cac7665eaf109fb381e78da11ef25") returned -1 [0136.375] lstrcmpA (lpString1="..", lpString2="3e8cac7665eaf109fb381e78da11ef25") returned -1 [0136.375] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\*.*") returned="*.*" [0136.375] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\", lpString2="3e8cac7665eaf109fb381e78da11ef25" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25" [0136.375] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e5d0573, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e5d0573, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e5d0573, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759f10 [0136.377] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.377] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e5d0573, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e5d0573, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e5d0573, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.377] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.377] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.377] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e5d0573, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e5d0573, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e5d0573, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.ISECommon.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.377] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.ISECommon.ni.dll") returned -1 [0136.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.ISECommon.ni.dll") returned -1 [0136.377] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.ISECommon.ni.dll") returned -1 [0136.377] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\*.*") returned="*.*" [0136.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\" [0136.377] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\") returned="" [0136.377] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\HOW TO DECRYPT FILES.txt" [0136.377] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\how to decrypt files.txt")) returned 0xffffffff [0136.377] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.378] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.379] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.379] CloseHandle (hObject=0x214) returned 1 [0136.380] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\", lpString2="Microsoft.PowerShell.ISECommon.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll" [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.zip") returned 0 [0136.380] lstrlenA (lpString="*.zip") returned 5 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.rar") returned 0 [0136.380] lstrlenA (lpString="*.rar") returned 5 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.7z") returned 0 [0136.380] lstrlenA (lpString="*.7z") returned 4 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.tar") returned 0 [0136.380] lstrlenA (lpString="*.tar") returned 5 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.gzip") returned 0 [0136.380] lstrlenA (lpString="*.gzip") returned 6 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.jpg") returned 0 [0136.380] lstrlenA (lpString="*.jpg") returned 5 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.jpeg") returned 0 [0136.380] lstrlenA (lpString="*.jpeg") returned 6 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.psd") returned 0 [0136.380] lstrlenA (lpString="*.psd") returned 5 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.cdr") returned 0 [0136.380] lstrlenA (lpString="*.cdr") returned 5 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.dwg") returned 0 [0136.380] lstrlenA (lpString="*.dwg") returned 5 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.max") returned 0 [0136.380] lstrlenA (lpString="*.max") returned 5 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.bmp") returned 0 [0136.380] lstrlenA (lpString="*.bmp") returned 5 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.gif") returned 0 [0136.380] lstrlenA (lpString="*.gif") returned 5 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.png") returned 0 [0136.380] lstrlenA (lpString="*.png") returned 5 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.doc") returned 0 [0136.380] lstrlenA (lpString="*.doc") returned 5 [0136.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.docx") returned 0 [0136.381] lstrlenA (lpString="*.docx") returned 6 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.xls") returned 0 [0136.381] lstrlenA (lpString="*.xls") returned 5 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.xlsx") returned 0 [0136.381] lstrlenA (lpString="*.xlsx") returned 6 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.ppt") returned 0 [0136.381] lstrlenA (lpString="*.ppt") returned 5 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.pptx") returned 0 [0136.381] lstrlenA (lpString="*.pptx") returned 6 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.txt") returned 0 [0136.381] lstrlenA (lpString="*.txt") returned 5 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.pdf") returned 0 [0136.381] lstrlenA (lpString="*.pdf") returned 5 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.djvu") returned 0 [0136.381] lstrlenA (lpString="*.djvu") returned 6 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.htm") returned 0 [0136.381] lstrlenA (lpString="*.htm") returned 5 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.html") returned 0 [0136.381] lstrlenA (lpString="*.html") returned 6 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.mdb") returned 0 [0136.381] lstrlenA (lpString="*.mdb") returned 5 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.cer") returned 0 [0136.381] lstrlenA (lpString="*.cer") returned 5 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.p12") returned 0 [0136.381] lstrlenA (lpString="*.p12") returned 5 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.pfx") returned 0 [0136.381] lstrlenA (lpString="*.pfx") returned 5 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.kwm") returned 0 [0136.381] lstrlenA (lpString="*.kwm") returned 5 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.pwm") returned 0 [0136.381] lstrlenA (lpString="*.pwm") returned 5 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.1cd") returned 0 [0136.381] lstrlenA (lpString="*.1cd") returned 5 [0136.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.md") returned 0 [0136.382] lstrlenA (lpString="*.md") returned 4 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.mdf") returned 0 [0136.382] lstrlenA (lpString="*.mdf") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.dbf") returned 0 [0136.382] lstrlenA (lpString="*.dbf") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.odt") returned 0 [0136.382] lstrlenA (lpString="*.odt") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.vob") returned 0 [0136.382] lstrlenA (lpString="*.vob") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.ifo") returned 0 [0136.382] lstrlenA (lpString="*.ifo") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.lnk") returned 0 [0136.382] lstrlenA (lpString="*.lnk") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.torrent") returned 0 [0136.382] lstrlenA (lpString="*.torrent") returned 9 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.mov") returned 0 [0136.382] lstrlenA (lpString="*.mov") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.m2v") returned 0 [0136.382] lstrlenA (lpString="*.m2v") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.3gp") returned 0 [0136.382] lstrlenA (lpString="*.3gp") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.mpeg") returned 0 [0136.382] lstrlenA (lpString="*.mpeg") returned 6 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.mpg") returned 0 [0136.382] lstrlenA (lpString="*.mpg") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.flv") returned 0 [0136.382] lstrlenA (lpString="*.flv") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.avi") returned 0 [0136.382] lstrlenA (lpString="*.avi") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.mp4") returned 0 [0136.382] lstrlenA (lpString="*.mp4") returned 5 [0136.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.wmv") returned 0 [0136.382] lstrlenA (lpString="*.wmv") returned 5 [0136.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.divx") returned 0 [0136.383] lstrlenA (lpString="*.divx") returned 6 [0136.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.mkv") returned 0 [0136.383] lstrlenA (lpString="*.mkv") returned 5 [0136.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.mp3") returned 0 [0136.383] lstrlenA (lpString="*.mp3") returned 5 [0136.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.wav") returned 0 [0136.383] lstrlenA (lpString="*.wav") returned 5 [0136.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.flac") returned 0 [0136.383] lstrlenA (lpString="*.flac") returned 6 [0136.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.ape") returned 0 [0136.383] lstrlenA (lpString="*.ape") returned 5 [0136.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.wma") returned 0 [0136.383] lstrlenA (lpString="*.wma") returned 5 [0136.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.ac3") returned 0 [0136.383] lstrlenA (lpString="*.ac3") returned 5 [0136.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll", pszSpec="*.doc") returned 0 [0136.383] lstrlenA (lpString="*.doc") returned 5 [0136.383] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e5d0573, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e5d0573, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e5d0573, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ISECommon.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.383] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.ISECommon.ni.dll.aux") returned -1 [0136.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.ISECommon.ni.dll.aux") returned -1 [0136.383] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.ISECommon.ni.dll.aux") returned -1 [0136.383] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll") returned="Microsoft.PowerShell.ISECommon.ni.dll" [0136.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\" [0136.383] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\") returned="" [0136.383] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\HOW TO DECRYPT FILES.txt" [0136.383] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\how to decrypt files.txt")) returned 0x20 [0136.383] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\", lpString2="Microsoft.PowerShell.ISECommon.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux" [0136.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.384] lstrlenA (lpString="*.zip") returned 5 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.384] lstrlenA (lpString="*.rar") returned 5 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.384] lstrlenA (lpString="*.7z") returned 4 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.384] lstrlenA (lpString="*.tar") returned 5 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.384] lstrlenA (lpString="*.gzip") returned 6 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.384] lstrlenA (lpString="*.jpg") returned 5 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.384] lstrlenA (lpString="*.jpeg") returned 6 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.384] lstrlenA (lpString="*.psd") returned 5 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.384] lstrlenA (lpString="*.cdr") returned 5 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.384] lstrlenA (lpString="*.dwg") returned 5 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.max") returned 0 [0136.384] lstrlenA (lpString="*.max") returned 5 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.384] lstrlenA (lpString="*.bmp") returned 5 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.384] lstrlenA (lpString="*.gif") returned 5 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.png") returned 0 [0136.384] lstrlenA (lpString="*.png") returned 5 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.384] lstrlenA (lpString="*.doc") returned 5 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.384] lstrlenA (lpString="*.docx") returned 6 [0136.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.384] lstrlenA (lpString="*.xls") returned 5 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.385] lstrlenA (lpString="*.xlsx") returned 6 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.385] lstrlenA (lpString="*.ppt") returned 5 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.385] lstrlenA (lpString="*.pptx") returned 6 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.385] lstrlenA (lpString="*.txt") returned 5 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.385] lstrlenA (lpString="*.pdf") returned 5 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.385] lstrlenA (lpString="*.djvu") returned 6 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.385] lstrlenA (lpString="*.htm") returned 5 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.html") returned 0 [0136.385] lstrlenA (lpString="*.html") returned 6 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.385] lstrlenA (lpString="*.mdb") returned 5 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.385] lstrlenA (lpString="*.cer") returned 5 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.385] lstrlenA (lpString="*.p12") returned 5 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.385] lstrlenA (lpString="*.pfx") returned 5 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.385] lstrlenA (lpString="*.kwm") returned 5 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.385] lstrlenA (lpString="*.pwm") returned 5 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.385] lstrlenA (lpString="*.1cd") returned 5 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.md") returned 0 [0136.385] lstrlenA (lpString="*.md") returned 4 [0136.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.386] lstrlenA (lpString="*.mdf") returned 5 [0136.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.386] lstrlenA (lpString="*.dbf") returned 5 [0136.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.386] lstrlenA (lpString="*.odt") returned 5 [0136.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.386] lstrlenA (lpString="*.vob") returned 5 [0136.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.386] lstrlenA (lpString="*.ifo") returned 5 [0136.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.386] lstrlenA (lpString="*.lnk") returned 5 [0136.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.386] lstrlenA (lpString="*.torrent") returned 9 [0136.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.386] lstrlenA (lpString="*.mov") returned 5 [0136.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.386] lstrlenA (lpString="*.m2v") returned 5 [0136.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.386] lstrlenA (lpString="*.3gp") returned 5 [0136.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.386] lstrlenA (lpString="*.mpeg") returned 6 [0136.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.386] lstrlenA (lpString="*.mpg") returned 5 [0136.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.386] lstrlenA (lpString="*.flv") returned 5 [0136.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.387] lstrlenA (lpString="*.avi") returned 5 [0136.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.387] lstrlenA (lpString="*.mp4") returned 5 [0136.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.387] lstrlenA (lpString="*.wmv") returned 5 [0136.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.387] lstrlenA (lpString="*.divx") returned 6 [0136.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.387] lstrlenA (lpString="*.mkv") returned 5 [0136.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.387] lstrlenA (lpString="*.mp3") returned 5 [0136.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.387] lstrlenA (lpString="*.wav") returned 5 [0136.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.387] lstrlenA (lpString="*.flac") returned 6 [0136.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.387] lstrlenA (lpString="*.ape") returned 5 [0136.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.387] lstrlenA (lpString="*.wma") returned 5 [0136.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.387] lstrlenA (lpString="*.ac3") returned 5 [0136.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pd3efef62#\\3e8cac7665eaf109fb381e78da11ef25\\Microsoft.PowerShell.ISECommon.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.387] lstrlenA (lpString="*.doc") returned 5 [0136.387] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e5d0573, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e5d0573, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e5d0573, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ISECommon.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.387] FindClose (in: hFindFile=0x759f10 | out: hFindFile=0x759f10) returned 1 [0136.388] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e5d0573, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x3e5d0573, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3e5d0573, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3e8cac7665eaf109fb381e78da11ef25", cAlternateFileName="3E8CAC~1")) returned 0 [0136.388] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.388] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9fa415b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5baf9fd5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5baf9fd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x787561, dwReserved1=0x78000078, cFileName="Microsoft.Pefb7a36b#", cAlternateFileName="MICROS~1.PEF")) returned 1 [0136.388] lstrcmpA (lpString1=".", lpString2="Microsoft.Pefb7a36b#") returned -1 [0136.388] lstrcmpA (lpString1="..", lpString2="Microsoft.Pefb7a36b#") returned -1 [0136.388] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.388] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Pefb7a36b#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#" [0136.388] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#") returned 67 [0136.388] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9fa415b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5baf9fd5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5baf9fd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.389] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.389] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9fa415b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5baf9fd5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5baf9fd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.389] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.389] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.389] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4342bac7, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43451cec, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43451cec, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de6fef11543aedcad4fd1f579b5b11f7", cAlternateFileName="DE6FEF~1")) returned 1 [0136.389] lstrcmpA (lpString1=".", lpString2="de6fef11543aedcad4fd1f579b5b11f7") returned -1 [0136.389] lstrcmpA (lpString1="..", lpString2="de6fef11543aedcad4fd1f579b5b11f7") returned -1 [0136.389] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\*.*") returned="*.*" [0136.389] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\", lpString2="de6fef11543aedcad4fd1f579b5b11f7" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7" [0136.389] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7") returned 100 [0136.389] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4342bac7, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43451cec, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43451cec, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0136.391] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.391] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4342bac7, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43451cec, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43451cec, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.391] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.391] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.391] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434058a9, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x434058a9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43451cec, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x253400, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.391] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.391] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Workflow.ServiceCore.ni.dll") returned -1 [0136.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Workflow.ServiceCore.ni.dll") returned -1 [0136.391] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Workflow.ServiceCore.ni.dll") returned -1 [0136.391] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\*.*") returned="*.*" [0136.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\" [0136.391] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\") returned="" [0136.391] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\HOW TO DECRYPT FILES.txt" [0136.391] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\how to decrypt files.txt")) returned 0xffffffff [0136.391] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.393] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.393] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.393] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.394] CloseHandle (hObject=0x214) returned 1 [0136.394] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\", lpString2="Microsoft.PowerShell.Workflow.ServiceCore.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll" [0136.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.zip") returned 0 [0136.394] lstrlenA (lpString="*.zip") returned 5 [0136.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.rar") returned 0 [0136.394] lstrlenA (lpString="*.rar") returned 5 [0136.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.7z") returned 0 [0136.394] lstrlenA (lpString="*.7z") returned 4 [0136.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.tar") returned 0 [0136.394] lstrlenA (lpString="*.tar") returned 5 [0136.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.gzip") returned 0 [0136.394] lstrlenA (lpString="*.gzip") returned 6 [0136.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.jpg") returned 0 [0136.394] lstrlenA (lpString="*.jpg") returned 5 [0136.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.jpeg") returned 0 [0136.394] lstrlenA (lpString="*.jpeg") returned 6 [0136.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.psd") returned 0 [0136.394] lstrlenA (lpString="*.psd") returned 5 [0136.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.cdr") returned 0 [0136.394] lstrlenA (lpString="*.cdr") returned 5 [0136.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.dwg") returned 0 [0136.394] lstrlenA (lpString="*.dwg") returned 5 [0136.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.max") returned 0 [0136.394] lstrlenA (lpString="*.max") returned 5 [0136.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.bmp") returned 0 [0136.394] lstrlenA (lpString="*.bmp") returned 5 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.gif") returned 0 [0136.395] lstrlenA (lpString="*.gif") returned 5 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.png") returned 0 [0136.395] lstrlenA (lpString="*.png") returned 5 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.doc") returned 0 [0136.395] lstrlenA (lpString="*.doc") returned 5 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.docx") returned 0 [0136.395] lstrlenA (lpString="*.docx") returned 6 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.xls") returned 0 [0136.395] lstrlenA (lpString="*.xls") returned 5 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.xlsx") returned 0 [0136.395] lstrlenA (lpString="*.xlsx") returned 6 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.ppt") returned 0 [0136.395] lstrlenA (lpString="*.ppt") returned 5 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.pptx") returned 0 [0136.395] lstrlenA (lpString="*.pptx") returned 6 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.txt") returned 0 [0136.395] lstrlenA (lpString="*.txt") returned 5 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.pdf") returned 0 [0136.395] lstrlenA (lpString="*.pdf") returned 5 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.djvu") returned 0 [0136.395] lstrlenA (lpString="*.djvu") returned 6 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.htm") returned 0 [0136.395] lstrlenA (lpString="*.htm") returned 5 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.html") returned 0 [0136.395] lstrlenA (lpString="*.html") returned 6 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.mdb") returned 0 [0136.395] lstrlenA (lpString="*.mdb") returned 5 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.cer") returned 0 [0136.395] lstrlenA (lpString="*.cer") returned 5 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.p12") returned 0 [0136.395] lstrlenA (lpString="*.p12") returned 5 [0136.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.pfx") returned 0 [0136.395] lstrlenA (lpString="*.pfx") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.kwm") returned 0 [0136.396] lstrlenA (lpString="*.kwm") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.pwm") returned 0 [0136.396] lstrlenA (lpString="*.pwm") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.1cd") returned 0 [0136.396] lstrlenA (lpString="*.1cd") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.md") returned 0 [0136.396] lstrlenA (lpString="*.md") returned 4 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.mdf") returned 0 [0136.396] lstrlenA (lpString="*.mdf") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.dbf") returned 0 [0136.396] lstrlenA (lpString="*.dbf") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.odt") returned 0 [0136.396] lstrlenA (lpString="*.odt") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.vob") returned 0 [0136.396] lstrlenA (lpString="*.vob") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.ifo") returned 0 [0136.396] lstrlenA (lpString="*.ifo") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.lnk") returned 0 [0136.396] lstrlenA (lpString="*.lnk") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.torrent") returned 0 [0136.396] lstrlenA (lpString="*.torrent") returned 9 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.mov") returned 0 [0136.396] lstrlenA (lpString="*.mov") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.m2v") returned 0 [0136.396] lstrlenA (lpString="*.m2v") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.3gp") returned 0 [0136.396] lstrlenA (lpString="*.3gp") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.mpeg") returned 0 [0136.396] lstrlenA (lpString="*.mpeg") returned 6 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.mpg") returned 0 [0136.396] lstrlenA (lpString="*.mpg") returned 5 [0136.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.flv") returned 0 [0136.397] lstrlenA (lpString="*.flv") returned 5 [0136.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.avi") returned 0 [0136.397] lstrlenA (lpString="*.avi") returned 5 [0136.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.mp4") returned 0 [0136.397] lstrlenA (lpString="*.mp4") returned 5 [0136.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.wmv") returned 0 [0136.397] lstrlenA (lpString="*.wmv") returned 5 [0136.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.divx") returned 0 [0136.397] lstrlenA (lpString="*.divx") returned 6 [0136.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.mkv") returned 0 [0136.397] lstrlenA (lpString="*.mkv") returned 5 [0136.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.mp3") returned 0 [0136.397] lstrlenA (lpString="*.mp3") returned 5 [0136.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.wav") returned 0 [0136.397] lstrlenA (lpString="*.wav") returned 5 [0136.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.flac") returned 0 [0136.397] lstrlenA (lpString="*.flac") returned 6 [0136.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.ape") returned 0 [0136.397] lstrlenA (lpString="*.ape") returned 5 [0136.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.wma") returned 0 [0136.397] lstrlenA (lpString="*.wma") returned 5 [0136.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.ac3") returned 0 [0136.397] lstrlenA (lpString="*.ac3") returned 5 [0136.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll", pszSpec="*.doc") returned 0 [0136.397] lstrlenA (lpString="*.doc") returned 5 [0136.397] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43451cec, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43451cec, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43451cec, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.397] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.397] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux") returned -1 [0136.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux") returned -1 [0136.397] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux") returned -1 [0136.397] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll") returned="Microsoft.PowerShell.Workflow.ServiceCore.ni.dll" [0136.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\" [0136.398] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\") returned="" [0136.398] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\HOW TO DECRYPT FILES.txt" [0136.398] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\how to decrypt files.txt")) returned 0x20 [0136.398] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\", lpString2="Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux" [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.398] lstrlenA (lpString="*.zip") returned 5 [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.398] lstrlenA (lpString="*.rar") returned 5 [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.398] lstrlenA (lpString="*.7z") returned 4 [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.398] lstrlenA (lpString="*.tar") returned 5 [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.398] lstrlenA (lpString="*.gzip") returned 6 [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.398] lstrlenA (lpString="*.jpg") returned 5 [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.398] lstrlenA (lpString="*.jpeg") returned 6 [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.398] lstrlenA (lpString="*.psd") returned 5 [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.398] lstrlenA (lpString="*.cdr") returned 5 [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.398] lstrlenA (lpString="*.dwg") returned 5 [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.max") returned 0 [0136.398] lstrlenA (lpString="*.max") returned 5 [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.398] lstrlenA (lpString="*.bmp") returned 5 [0136.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.398] lstrlenA (lpString="*.gif") returned 5 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.png") returned 0 [0136.399] lstrlenA (lpString="*.png") returned 5 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.399] lstrlenA (lpString="*.doc") returned 5 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.399] lstrlenA (lpString="*.docx") returned 6 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.399] lstrlenA (lpString="*.xls") returned 5 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.399] lstrlenA (lpString="*.xlsx") returned 6 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.399] lstrlenA (lpString="*.ppt") returned 5 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.399] lstrlenA (lpString="*.pptx") returned 6 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.399] lstrlenA (lpString="*.txt") returned 5 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.399] lstrlenA (lpString="*.pdf") returned 5 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.399] lstrlenA (lpString="*.djvu") returned 6 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.399] lstrlenA (lpString="*.htm") returned 5 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.html") returned 0 [0136.399] lstrlenA (lpString="*.html") returned 6 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.399] lstrlenA (lpString="*.mdb") returned 5 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.399] lstrlenA (lpString="*.cer") returned 5 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.399] lstrlenA (lpString="*.p12") returned 5 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.399] lstrlenA (lpString="*.pfx") returned 5 [0136.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.400] lstrlenA (lpString="*.kwm") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.400] lstrlenA (lpString="*.pwm") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.400] lstrlenA (lpString="*.1cd") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.md") returned 0 [0136.400] lstrlenA (lpString="*.md") returned 4 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.400] lstrlenA (lpString="*.mdf") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.400] lstrlenA (lpString="*.dbf") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.400] lstrlenA (lpString="*.odt") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.400] lstrlenA (lpString="*.vob") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.400] lstrlenA (lpString="*.ifo") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.400] lstrlenA (lpString="*.lnk") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.400] lstrlenA (lpString="*.torrent") returned 9 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.400] lstrlenA (lpString="*.mov") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.400] lstrlenA (lpString="*.m2v") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.400] lstrlenA (lpString="*.3gp") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.400] lstrlenA (lpString="*.mpeg") returned 6 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.400] lstrlenA (lpString="*.mpg") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.400] lstrlenA (lpString="*.flv") returned 5 [0136.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.401] lstrlenA (lpString="*.avi") returned 5 [0136.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.401] lstrlenA (lpString="*.mp4") returned 5 [0136.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.401] lstrlenA (lpString="*.wmv") returned 5 [0136.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.401] lstrlenA (lpString="*.divx") returned 6 [0136.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.401] lstrlenA (lpString="*.mkv") returned 5 [0136.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.401] lstrlenA (lpString="*.mp3") returned 5 [0136.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.401] lstrlenA (lpString="*.wav") returned 5 [0136.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.401] lstrlenA (lpString="*.flac") returned 6 [0136.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.401] lstrlenA (lpString="*.ape") returned 5 [0136.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.401] lstrlenA (lpString="*.wma") returned 5 [0136.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.401] lstrlenA (lpString="*.ac3") returned 5 [0136.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pefb7a36b#\\de6fef11543aedcad4fd1f579b5b11f7\\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.401] lstrlenA (lpString="*.doc") returned 5 [0136.401] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43451cec, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43451cec, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43451cec, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.401] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0136.402] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4342bac7, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43451cec, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43451cec, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de6fef11543aedcad4fd1f579b5b11f7", cAlternateFileName="DE6FEF~1")) returned 0 [0136.402] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.415] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8ac778d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bd0fe22, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bd0fe22, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7875612e, dwReserved1=0x78000000, cFileName="Microsoft.S0f8e494c#", cAlternateFileName="MICROS~1.S0F")) returned 1 [0136.415] lstrcmpA (lpString1=".", lpString2="Microsoft.S0f8e494c#") returned -1 [0136.415] lstrcmpA (lpString1="..", lpString2="Microsoft.S0f8e494c#") returned -1 [0136.415] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.415] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.S0f8e494c#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#" [0136.415] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#") returned 67 [0136.415] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8ac778d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bd0fe22, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bd0fe22, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ed0 [0136.416] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.416] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8ac778d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bd0fe22, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bd0fe22, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.416] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.416] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.416] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4454d44b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4454d44b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4454d44b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bb2521eda9f00e6fafdd59dbb6baed7f", cAlternateFileName="BB2521~1")) returned 1 [0136.416] lstrcmpA (lpString1=".", lpString2="bb2521eda9f00e6fafdd59dbb6baed7f") returned -1 [0136.416] lstrcmpA (lpString1="..", lpString2="bb2521eda9f00e6fafdd59dbb6baed7f") returned -1 [0136.416] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\*.*") returned="*.*" [0136.416] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\", lpString2="bb2521eda9f00e6fafdd59dbb6baed7f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f" [0136.416] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f") returned 100 [0136.417] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4454d44b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4454d44b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4454d44b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0136.420] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.420] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4454d44b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4454d44b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4454d44b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.420] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.420] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.420] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4454d44b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4454d44b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4454d44b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x3be00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.420] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll") returned -1 [0136.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll") returned -1 [0136.420] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll") returned -1 [0136.420] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\*.*") returned="*.*" [0136.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\" [0136.420] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\") returned="" [0136.420] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\HOW TO DECRYPT FILES.txt" [0136.420] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\how to decrypt files.txt")) returned 0xffffffff [0136.421] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.422] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.422] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.422] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.423] CloseHandle (hObject=0x214) returned 1 [0136.423] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll" [0136.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.zip") returned 0 [0136.423] lstrlenA (lpString="*.zip") returned 5 [0136.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.rar") returned 0 [0136.423] lstrlenA (lpString="*.rar") returned 5 [0136.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.7z") returned 0 [0136.423] lstrlenA (lpString="*.7z") returned 4 [0136.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.tar") returned 0 [0136.423] lstrlenA (lpString="*.tar") returned 5 [0136.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.gzip") returned 0 [0136.423] lstrlenA (lpString="*.gzip") returned 6 [0136.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.jpg") returned 0 [0136.423] lstrlenA (lpString="*.jpg") returned 5 [0136.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.jpeg") returned 0 [0136.423] lstrlenA (lpString="*.jpeg") returned 6 [0136.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.psd") returned 0 [0136.423] lstrlenA (lpString="*.psd") returned 5 [0136.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.cdr") returned 0 [0136.423] lstrlenA (lpString="*.cdr") returned 5 [0136.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.dwg") returned 0 [0136.423] lstrlenA (lpString="*.dwg") returned 5 [0136.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.max") returned 0 [0136.424] lstrlenA (lpString="*.max") returned 5 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.bmp") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.gif") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.png") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.doc") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.docx") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.xls") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.xlsx") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.ppt") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.pptx") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.txt") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.pdf") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.djvu") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.htm") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.html") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mdb") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.cer") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.p12") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.pfx") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.kwm") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.pwm") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.1cd") returned 0 [0136.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.md") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mdf") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.dbf") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.odt") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.vob") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.ifo") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.lnk") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.torrent") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mov") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.m2v") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.3gp") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mpeg") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mpg") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.flv") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.avi") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mp4") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.wmv") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.divx") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mkv") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mp3") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.wav") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.flac") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.ape") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.wma") returned 0 [0136.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.ac3") returned 0 [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.doc") returned 0 [0136.426] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4454d44b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4454d44b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4454d44b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.426] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux") returned -1 [0136.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux") returned -1 [0136.426] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux") returned -1 [0136.426] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll") returned="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll" [0136.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\" [0136.426] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\") returned="" [0136.426] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\HOW TO DECRYPT FILES.txt" [0136.426] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\how to decrypt files.txt")) returned 0x20 [0136.426] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux" [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.max") returned 0 [0136.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.png") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.html") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.md") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S0f8e494c#\\bb2521eda9f00e6fafdd59dbb6baed7f\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.428] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4454d44b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4454d44b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4454d44b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.429] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0136.429] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4454d44b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4454d44b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4454d44b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bb2521eda9f00e6fafdd59dbb6baed7f", cAlternateFileName="BB2521~1")) returned 0 [0136.429] FindClose (in: hFindFile=0x759ed0 | out: hFindFile=0x759ed0) returned 1 [0136.429] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9a20a37, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bb4640e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bb4640e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f502e74, dwReserved1=0x7963696c, cFileName="Microsoft.S1bc92e04#", cAlternateFileName="MICROS~1.S1B")) returned 1 [0136.429] lstrcmpA (lpString1=".", lpString2="Microsoft.S1bc92e04#") returned -1 [0136.429] lstrcmpA (lpString1="..", lpString2="Microsoft.S1bc92e04#") returned -1 [0136.429] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.429] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.S1bc92e04#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#" [0136.430] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9a20a37, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bb4640e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bb4640e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.430] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.430] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9a20a37, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bb4640e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bb4640e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.430] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.430] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.430] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43772aaf, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43772aaf, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43772aaf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5f160aabb0adfc9717e94aa9a6d03e4e", cAlternateFileName="5F160A~1")) returned 1 [0136.430] lstrcmpA (lpString1=".", lpString2="5f160aabb0adfc9717e94aa9a6d03e4e") returned -1 [0136.430] lstrcmpA (lpString1="..", lpString2="5f160aabb0adfc9717e94aa9a6d03e4e") returned -1 [0136.430] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\*.*") returned="*.*" [0136.430] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\", lpString2="5f160aabb0adfc9717e94aa9a6d03e4e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e" [0136.430] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43772aaf, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43772aaf, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43772aaf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0136.432] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.432] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43772aaf, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43772aaf, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43772aaf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.432] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.432] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.432] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43772aaf, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43772aaf, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43798cc7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1cc00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.SecureBoot.Commands.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.432] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.SecureBoot.Commands.ni.dll") returned -1 [0136.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.SecureBoot.Commands.ni.dll") returned -1 [0136.432] lstrcmpiA (lpString1="", lpString2="Microsoft.SecureBoot.Commands.ni.dll") returned -1 [0136.432] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\*.*") returned="*.*" [0136.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\" [0136.432] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\") returned="" [0136.432] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\HOW TO DECRYPT FILES.txt" [0136.432] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\how to decrypt files.txt")) returned 0xffffffff [0136.432] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.434] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.435] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.435] CloseHandle (hObject=0x214) returned 1 [0136.436] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\", lpString2="Microsoft.SecureBoot.Commands.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll" [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.zip") returned 0 [0136.436] lstrlenA (lpString="*.zip") returned 5 [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.rar") returned 0 [0136.436] lstrlenA (lpString="*.rar") returned 5 [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.7z") returned 0 [0136.436] lstrlenA (lpString="*.7z") returned 4 [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.tar") returned 0 [0136.436] lstrlenA (lpString="*.tar") returned 5 [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.gzip") returned 0 [0136.436] lstrlenA (lpString="*.gzip") returned 6 [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.jpg") returned 0 [0136.436] lstrlenA (lpString="*.jpg") returned 5 [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.jpeg") returned 0 [0136.436] lstrlenA (lpString="*.jpeg") returned 6 [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.psd") returned 0 [0136.436] lstrlenA (lpString="*.psd") returned 5 [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.cdr") returned 0 [0136.436] lstrlenA (lpString="*.cdr") returned 5 [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.dwg") returned 0 [0136.436] lstrlenA (lpString="*.dwg") returned 5 [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.max") returned 0 [0136.436] lstrlenA (lpString="*.max") returned 5 [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.bmp") returned 0 [0136.436] lstrlenA (lpString="*.bmp") returned 5 [0136.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.gif") returned 0 [0136.437] lstrlenA (lpString="*.gif") returned 5 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.png") returned 0 [0136.437] lstrlenA (lpString="*.png") returned 5 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.doc") returned 0 [0136.437] lstrlenA (lpString="*.doc") returned 5 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.docx") returned 0 [0136.437] lstrlenA (lpString="*.docx") returned 6 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.xls") returned 0 [0136.437] lstrlenA (lpString="*.xls") returned 5 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.xlsx") returned 0 [0136.437] lstrlenA (lpString="*.xlsx") returned 6 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.ppt") returned 0 [0136.437] lstrlenA (lpString="*.ppt") returned 5 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.pptx") returned 0 [0136.437] lstrlenA (lpString="*.pptx") returned 6 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.txt") returned 0 [0136.437] lstrlenA (lpString="*.txt") returned 5 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.pdf") returned 0 [0136.437] lstrlenA (lpString="*.pdf") returned 5 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.djvu") returned 0 [0136.437] lstrlenA (lpString="*.djvu") returned 6 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.htm") returned 0 [0136.437] lstrlenA (lpString="*.htm") returned 5 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.html") returned 0 [0136.437] lstrlenA (lpString="*.html") returned 6 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.mdb") returned 0 [0136.437] lstrlenA (lpString="*.mdb") returned 5 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.cer") returned 0 [0136.437] lstrlenA (lpString="*.cer") returned 5 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.p12") returned 0 [0136.437] lstrlenA (lpString="*.p12") returned 5 [0136.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.pfx") returned 0 [0136.437] lstrlenA (lpString="*.pfx") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.kwm") returned 0 [0136.438] lstrlenA (lpString="*.kwm") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.pwm") returned 0 [0136.438] lstrlenA (lpString="*.pwm") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.1cd") returned 0 [0136.438] lstrlenA (lpString="*.1cd") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.md") returned 0 [0136.438] lstrlenA (lpString="*.md") returned 4 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.mdf") returned 0 [0136.438] lstrlenA (lpString="*.mdf") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.dbf") returned 0 [0136.438] lstrlenA (lpString="*.dbf") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.odt") returned 0 [0136.438] lstrlenA (lpString="*.odt") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.vob") returned 0 [0136.438] lstrlenA (lpString="*.vob") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.ifo") returned 0 [0136.438] lstrlenA (lpString="*.ifo") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.lnk") returned 0 [0136.438] lstrlenA (lpString="*.lnk") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.torrent") returned 0 [0136.438] lstrlenA (lpString="*.torrent") returned 9 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.mov") returned 0 [0136.438] lstrlenA (lpString="*.mov") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.m2v") returned 0 [0136.438] lstrlenA (lpString="*.m2v") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.3gp") returned 0 [0136.438] lstrlenA (lpString="*.3gp") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.mpeg") returned 0 [0136.438] lstrlenA (lpString="*.mpeg") returned 6 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.mpg") returned 0 [0136.438] lstrlenA (lpString="*.mpg") returned 5 [0136.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.flv") returned 0 [0136.438] lstrlenA (lpString="*.flv") returned 5 [0136.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.avi") returned 0 [0136.439] lstrlenA (lpString="*.avi") returned 5 [0136.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.mp4") returned 0 [0136.439] lstrlenA (lpString="*.mp4") returned 5 [0136.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.wmv") returned 0 [0136.439] lstrlenA (lpString="*.wmv") returned 5 [0136.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.divx") returned 0 [0136.439] lstrlenA (lpString="*.divx") returned 6 [0136.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.mkv") returned 0 [0136.439] lstrlenA (lpString="*.mkv") returned 5 [0136.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.mp3") returned 0 [0136.439] lstrlenA (lpString="*.mp3") returned 5 [0136.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.wav") returned 0 [0136.439] lstrlenA (lpString="*.wav") returned 5 [0136.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.flac") returned 0 [0136.439] lstrlenA (lpString="*.flac") returned 6 [0136.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.ape") returned 0 [0136.439] lstrlenA (lpString="*.ape") returned 5 [0136.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.wma") returned 0 [0136.439] lstrlenA (lpString="*.wma") returned 5 [0136.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.ac3") returned 0 [0136.439] lstrlenA (lpString="*.ac3") returned 5 [0136.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll", pszSpec="*.doc") returned 0 [0136.439] lstrlenA (lpString="*.doc") returned 5 [0136.439] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43772aaf, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43772aaf, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43772aaf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SecureBoot.Commands.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.439] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.439] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.SecureBoot.Commands.ni.dll.aux") returned -1 [0136.439] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.SecureBoot.Commands.ni.dll.aux") returned -1 [0136.439] lstrcmpiA (lpString1="", lpString2="Microsoft.SecureBoot.Commands.ni.dll.aux") returned -1 [0136.439] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll") returned="Microsoft.SecureBoot.Commands.ni.dll" [0136.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\" [0136.439] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\") returned="" [0136.440] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\HOW TO DECRYPT FILES.txt" [0136.440] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\how to decrypt files.txt")) returned 0x20 [0136.440] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\", lpString2="Microsoft.SecureBoot.Commands.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux" [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.440] lstrlenA (lpString="*.zip") returned 5 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.440] lstrlenA (lpString="*.rar") returned 5 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.440] lstrlenA (lpString="*.7z") returned 4 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.440] lstrlenA (lpString="*.tar") returned 5 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.440] lstrlenA (lpString="*.gzip") returned 6 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.440] lstrlenA (lpString="*.jpg") returned 5 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.440] lstrlenA (lpString="*.jpeg") returned 6 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.440] lstrlenA (lpString="*.psd") returned 5 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.440] lstrlenA (lpString="*.cdr") returned 5 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.440] lstrlenA (lpString="*.dwg") returned 5 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.max") returned 0 [0136.440] lstrlenA (lpString="*.max") returned 5 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.440] lstrlenA (lpString="*.bmp") returned 5 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.440] lstrlenA (lpString="*.gif") returned 5 [0136.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.png") returned 0 [0136.441] lstrlenA (lpString="*.png") returned 5 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.441] lstrlenA (lpString="*.doc") returned 5 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.441] lstrlenA (lpString="*.docx") returned 6 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.441] lstrlenA (lpString="*.xls") returned 5 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.441] lstrlenA (lpString="*.xlsx") returned 6 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.441] lstrlenA (lpString="*.ppt") returned 5 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.441] lstrlenA (lpString="*.pptx") returned 6 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.441] lstrlenA (lpString="*.txt") returned 5 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.441] lstrlenA (lpString="*.pdf") returned 5 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.441] lstrlenA (lpString="*.djvu") returned 6 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.441] lstrlenA (lpString="*.htm") returned 5 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.html") returned 0 [0136.441] lstrlenA (lpString="*.html") returned 6 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.441] lstrlenA (lpString="*.mdb") returned 5 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.441] lstrlenA (lpString="*.cer") returned 5 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.441] lstrlenA (lpString="*.p12") returned 5 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.441] lstrlenA (lpString="*.pfx") returned 5 [0136.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.442] lstrlenA (lpString="*.kwm") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.442] lstrlenA (lpString="*.pwm") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.442] lstrlenA (lpString="*.1cd") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.md") returned 0 [0136.442] lstrlenA (lpString="*.md") returned 4 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.442] lstrlenA (lpString="*.mdf") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.442] lstrlenA (lpString="*.dbf") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.442] lstrlenA (lpString="*.odt") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.442] lstrlenA (lpString="*.vob") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.442] lstrlenA (lpString="*.ifo") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.442] lstrlenA (lpString="*.lnk") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.442] lstrlenA (lpString="*.torrent") returned 9 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.442] lstrlenA (lpString="*.mov") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.442] lstrlenA (lpString="*.m2v") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.442] lstrlenA (lpString="*.3gp") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.442] lstrlenA (lpString="*.mpeg") returned 6 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.442] lstrlenA (lpString="*.mpg") returned 5 [0136.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.442] lstrlenA (lpString="*.flv") returned 5 [0136.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.443] lstrlenA (lpString="*.avi") returned 5 [0136.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.443] lstrlenA (lpString="*.mp4") returned 5 [0136.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.443] lstrlenA (lpString="*.wmv") returned 5 [0136.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.443] lstrlenA (lpString="*.divx") returned 6 [0136.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.443] lstrlenA (lpString="*.mkv") returned 5 [0136.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.443] lstrlenA (lpString="*.mp3") returned 5 [0136.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.443] lstrlenA (lpString="*.wav") returned 5 [0136.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.443] lstrlenA (lpString="*.flac") returned 6 [0136.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.443] lstrlenA (lpString="*.ape") returned 5 [0136.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.443] lstrlenA (lpString="*.wma") returned 5 [0136.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.443] lstrlenA (lpString="*.ac3") returned 5 [0136.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S1bc92e04#\\5f160aabb0adfc9717e94aa9a6d03e4e\\Microsoft.SecureBoot.Commands.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.443] lstrlenA (lpString="*.doc") returned 5 [0136.443] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43772aaf, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43772aaf, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43772aaf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SecureBoot.Commands.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.443] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0136.444] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43772aaf, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43772aaf, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43772aaf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5f160aabb0adfc9717e94aa9a6d03e4e", cAlternateFileName="5F160A~1")) returned 0 [0136.444] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0136.444] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb88b1686, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bc7757a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bc7757a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f502e74, dwReserved1=0x7963696c, cFileName="Microsoft.S356e1ba0#", cAlternateFileName="MICROS~1.S35")) returned 1 [0136.445] lstrcmpA (lpString1=".", lpString2="Microsoft.S356e1ba0#") returned -1 [0136.445] lstrcmpA (lpString1="..", lpString2="Microsoft.S356e1ba0#") returned -1 [0136.445] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.445] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.S356e1ba0#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#" [0136.445] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#") returned 67 [0136.445] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb88b1686, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bc7757a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bc7757a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0136.446] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.446] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb88b1686, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bc7757a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bc7757a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.446] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.446] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.446] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43e00a3c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43e00a3c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43e00a3c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cc43b4a23bf60bfb560a148f5690dfe9", cAlternateFileName="CC43B4~1")) returned 1 [0136.446] lstrcmpA (lpString1=".", lpString2="cc43b4a23bf60bfb560a148f5690dfe9") returned -1 [0136.446] lstrcmpA (lpString1="..", lpString2="cc43b4a23bf60bfb560a148f5690dfe9") returned -1 [0136.446] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\*.*") returned="*.*" [0136.446] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\", lpString2="cc43b4a23bf60bfb560a148f5690dfe9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9" [0136.446] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9") returned 100 [0136.446] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43e00a3c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43e00a3c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43e00a3c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.448] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.448] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43e00a3c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43e00a3c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43e00a3c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.448] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.448] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.448] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43e00a3c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43e00a3c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43e00a3c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.448] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.448] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll") returned -1 [0136.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll") returned -1 [0136.448] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll") returned -1 [0136.448] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\*.*") returned="*.*" [0136.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\" [0136.448] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\") returned="" [0136.448] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\HOW TO DECRYPT FILES.txt" [0136.448] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\how to decrypt files.txt")) returned 0xffffffff [0136.449] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.461] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.461] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.461] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.462] CloseHandle (hObject=0x214) returned 1 [0136.462] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll" [0136.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.zip") returned 0 [0136.462] lstrlenA (lpString="*.zip") returned 5 [0136.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.rar") returned 0 [0136.462] lstrlenA (lpString="*.rar") returned 5 [0136.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.7z") returned 0 [0136.462] lstrlenA (lpString="*.7z") returned 4 [0136.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.tar") returned 0 [0136.462] lstrlenA (lpString="*.tar") returned 5 [0136.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.gzip") returned 0 [0136.462] lstrlenA (lpString="*.gzip") returned 6 [0136.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.jpg") returned 0 [0136.462] lstrlenA (lpString="*.jpg") returned 5 [0136.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.jpeg") returned 0 [0136.462] lstrlenA (lpString="*.jpeg") returned 6 [0136.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.psd") returned 0 [0136.462] lstrlenA (lpString="*.psd") returned 5 [0136.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.cdr") returned 0 [0136.462] lstrlenA (lpString="*.cdr") returned 5 [0136.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.dwg") returned 0 [0136.462] lstrlenA (lpString="*.dwg") returned 5 [0136.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.max") returned 0 [0136.462] lstrlenA (lpString="*.max") returned 5 [0136.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.bmp") returned 0 [0136.462] lstrlenA (lpString="*.bmp") returned 5 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.gif") returned 0 [0136.463] lstrlenA (lpString="*.gif") returned 5 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.png") returned 0 [0136.463] lstrlenA (lpString="*.png") returned 5 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.doc") returned 0 [0136.463] lstrlenA (lpString="*.doc") returned 5 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.docx") returned 0 [0136.463] lstrlenA (lpString="*.docx") returned 6 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.xls") returned 0 [0136.463] lstrlenA (lpString="*.xls") returned 5 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.xlsx") returned 0 [0136.463] lstrlenA (lpString="*.xlsx") returned 6 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.ppt") returned 0 [0136.463] lstrlenA (lpString="*.ppt") returned 5 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.pptx") returned 0 [0136.463] lstrlenA (lpString="*.pptx") returned 6 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.txt") returned 0 [0136.463] lstrlenA (lpString="*.txt") returned 5 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.pdf") returned 0 [0136.463] lstrlenA (lpString="*.pdf") returned 5 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.djvu") returned 0 [0136.463] lstrlenA (lpString="*.djvu") returned 6 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.htm") returned 0 [0136.463] lstrlenA (lpString="*.htm") returned 5 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.html") returned 0 [0136.463] lstrlenA (lpString="*.html") returned 6 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mdb") returned 0 [0136.463] lstrlenA (lpString="*.mdb") returned 5 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.cer") returned 0 [0136.463] lstrlenA (lpString="*.cer") returned 5 [0136.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.p12") returned 0 [0136.463] lstrlenA (lpString="*.p12") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.pfx") returned 0 [0136.464] lstrlenA (lpString="*.pfx") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.kwm") returned 0 [0136.464] lstrlenA (lpString="*.kwm") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.pwm") returned 0 [0136.464] lstrlenA (lpString="*.pwm") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.1cd") returned 0 [0136.464] lstrlenA (lpString="*.1cd") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.md") returned 0 [0136.464] lstrlenA (lpString="*.md") returned 4 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mdf") returned 0 [0136.464] lstrlenA (lpString="*.mdf") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.dbf") returned 0 [0136.464] lstrlenA (lpString="*.dbf") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.odt") returned 0 [0136.464] lstrlenA (lpString="*.odt") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.vob") returned 0 [0136.464] lstrlenA (lpString="*.vob") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.ifo") returned 0 [0136.464] lstrlenA (lpString="*.ifo") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.lnk") returned 0 [0136.464] lstrlenA (lpString="*.lnk") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.torrent") returned 0 [0136.464] lstrlenA (lpString="*.torrent") returned 9 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mov") returned 0 [0136.464] lstrlenA (lpString="*.mov") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.m2v") returned 0 [0136.464] lstrlenA (lpString="*.m2v") returned 5 [0136.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.3gp") returned 0 [0136.476] lstrlenA (lpString="*.3gp") returned 5 [0136.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mpeg") returned 0 [0136.476] lstrlenA (lpString="*.mpeg") returned 6 [0136.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mpg") returned 0 [0136.476] lstrlenA (lpString="*.mpg") returned 5 [0136.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.flv") returned 0 [0136.476] lstrlenA (lpString="*.flv") returned 5 [0136.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.avi") returned 0 [0136.476] lstrlenA (lpString="*.avi") returned 5 [0136.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mp4") returned 0 [0136.476] lstrlenA (lpString="*.mp4") returned 5 [0136.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.wmv") returned 0 [0136.477] lstrlenA (lpString="*.wmv") returned 5 [0136.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.divx") returned 0 [0136.477] lstrlenA (lpString="*.divx") returned 6 [0136.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mkv") returned 0 [0136.477] lstrlenA (lpString="*.mkv") returned 5 [0136.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mp3") returned 0 [0136.477] lstrlenA (lpString="*.mp3") returned 5 [0136.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.wav") returned 0 [0136.477] lstrlenA (lpString="*.wav") returned 5 [0136.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.flac") returned 0 [0136.477] lstrlenA (lpString="*.flac") returned 6 [0136.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.ape") returned 0 [0136.477] lstrlenA (lpString="*.ape") returned 5 [0136.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.wma") returned 0 [0136.477] lstrlenA (lpString="*.wma") returned 5 [0136.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.ac3") returned 0 [0136.477] lstrlenA (lpString="*.ac3") returned 5 [0136.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.doc") returned 0 [0136.477] lstrlenA (lpString="*.doc") returned 5 [0136.477] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43e00a3c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43e00a3c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43e00a3c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.477] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.477] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux") returned -1 [0136.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux") returned -1 [0136.477] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux") returned -1 [0136.477] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll") returned="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll" [0136.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\" [0136.477] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\") returned="" [0136.477] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\HOW TO DECRYPT FILES.txt" [0136.477] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\how to decrypt files.txt")) returned 0x20 [0136.478] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux" [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.478] lstrlenA (lpString="*.zip") returned 5 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.478] lstrlenA (lpString="*.rar") returned 5 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.478] lstrlenA (lpString="*.7z") returned 4 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.478] lstrlenA (lpString="*.tar") returned 5 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.478] lstrlenA (lpString="*.gzip") returned 6 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.478] lstrlenA (lpString="*.jpg") returned 5 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.478] lstrlenA (lpString="*.jpeg") returned 6 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.478] lstrlenA (lpString="*.psd") returned 5 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.478] lstrlenA (lpString="*.cdr") returned 5 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.478] lstrlenA (lpString="*.dwg") returned 5 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.max") returned 0 [0136.478] lstrlenA (lpString="*.max") returned 5 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.478] lstrlenA (lpString="*.bmp") returned 5 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.478] lstrlenA (lpString="*.gif") returned 5 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.png") returned 0 [0136.478] lstrlenA (lpString="*.png") returned 5 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.478] lstrlenA (lpString="*.doc") returned 5 [0136.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.479] lstrlenA (lpString="*.docx") returned 6 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.479] lstrlenA (lpString="*.xls") returned 5 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.479] lstrlenA (lpString="*.xlsx") returned 6 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.479] lstrlenA (lpString="*.ppt") returned 5 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.479] lstrlenA (lpString="*.pptx") returned 6 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.479] lstrlenA (lpString="*.txt") returned 5 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.479] lstrlenA (lpString="*.pdf") returned 5 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.479] lstrlenA (lpString="*.djvu") returned 6 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.479] lstrlenA (lpString="*.htm") returned 5 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.html") returned 0 [0136.479] lstrlenA (lpString="*.html") returned 6 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.479] lstrlenA (lpString="*.mdb") returned 5 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.479] lstrlenA (lpString="*.cer") returned 5 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.479] lstrlenA (lpString="*.p12") returned 5 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.479] lstrlenA (lpString="*.pfx") returned 5 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.479] lstrlenA (lpString="*.kwm") returned 5 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.479] lstrlenA (lpString="*.pwm") returned 5 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.479] lstrlenA (lpString="*.1cd") returned 5 [0136.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.md") returned 0 [0136.480] lstrlenA (lpString="*.md") returned 4 [0136.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.480] lstrlenA (lpString="*.mdf") returned 5 [0136.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.480] lstrlenA (lpString="*.dbf") returned 5 [0136.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.480] lstrlenA (lpString="*.odt") returned 5 [0136.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.480] lstrlenA (lpString="*.vob") returned 5 [0136.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.480] lstrlenA (lpString="*.ifo") returned 5 [0136.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.480] lstrlenA (lpString="*.lnk") returned 5 [0136.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.480] lstrlenA (lpString="*.torrent") returned 9 [0136.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.481] lstrlenA (lpString="*.mov") returned 5 [0136.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.481] lstrlenA (lpString="*.m2v") returned 5 [0136.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.481] lstrlenA (lpString="*.3gp") returned 5 [0136.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.481] lstrlenA (lpString="*.mpeg") returned 6 [0136.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.481] lstrlenA (lpString="*.mpg") returned 5 [0136.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.481] lstrlenA (lpString="*.flv") returned 5 [0136.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.481] lstrlenA (lpString="*.avi") returned 5 [0136.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.481] lstrlenA (lpString="*.mp4") returned 5 [0136.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.481] lstrlenA (lpString="*.wmv") returned 5 [0136.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.481] lstrlenA (lpString="*.divx") returned 6 [0136.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.481] lstrlenA (lpString="*.mkv") returned 5 [0136.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.481] lstrlenA (lpString="*.mp3") returned 5 [0136.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.482] lstrlenA (lpString="*.wav") returned 5 [0136.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.482] lstrlenA (lpString="*.flac") returned 6 [0136.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.482] lstrlenA (lpString="*.ape") returned 5 [0136.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.482] lstrlenA (lpString="*.wma") returned 5 [0136.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.482] lstrlenA (lpString="*.ac3") returned 5 [0136.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S356e1ba0#\\cc43b4a23bf60bfb560a148f5690dfe9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.482] lstrlenA (lpString="*.doc") returned 5 [0136.482] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43e00a3c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43e00a3c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43e00a3c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.482] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0136.483] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43e00a3c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43e00a3c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43e00a3c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cc43b4a23bf60bfb560a148f5690dfe9", cAlternateFileName="CC43B4~1")) returned 0 [0136.483] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0136.483] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8b8635e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bcc39c4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bcc39c4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f502e74, dwReserved1=0x7963696c, cFileName="Microsoft.S54faafb0#", cAlternateFileName="MICROS~1.S54")) returned 1 [0136.483] lstrcmpA (lpString1=".", lpString2="Microsoft.S54faafb0#") returned -1 [0136.483] lstrcmpA (lpString1="..", lpString2="Microsoft.S54faafb0#") returned -1 [0136.483] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.483] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.S54faafb0#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#" [0136.483] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#") returned 67 [0136.483] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8b8635e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bcc39c4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bcc39c4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0136.483] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.483] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8b8635e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bcc39c4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bcc39c4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.484] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.484] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.484] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4422c6ad, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4422c6ad, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4422c6ad, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6a909c260c6ab24d3b60051479f939a1", cAlternateFileName="6A909C~1")) returned 1 [0136.484] lstrcmpA (lpString1=".", lpString2="6a909c260c6ab24d3b60051479f939a1") returned -1 [0136.484] lstrcmpA (lpString1="..", lpString2="6a909c260c6ab24d3b60051479f939a1") returned -1 [0136.484] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\*.*") returned="*.*" [0136.484] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\", lpString2="6a909c260c6ab24d3b60051479f939a1" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1" [0136.484] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1") returned 100 [0136.484] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4422c6ad, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4422c6ad, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4422c6ad, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0136.486] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.486] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4422c6ad, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4422c6ad, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4422c6ad, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.486] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.486] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.486] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4422c6ad, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4422c6ad, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4422c6ad, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4f600, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.486] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.486] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll") returned -1 [0136.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll") returned -1 [0136.486] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll") returned -1 [0136.486] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\*.*") returned="*.*" [0136.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\" [0136.486] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\") returned="" [0136.486] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\HOW TO DECRYPT FILES.txt" [0136.486] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\how to decrypt files.txt")) returned 0xffffffff [0136.486] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.487] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.487] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.488] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.488] CloseHandle (hObject=0x214) returned 1 [0136.488] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll" [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.zip") returned 0 [0136.489] lstrlenA (lpString="*.zip") returned 5 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.rar") returned 0 [0136.489] lstrlenA (lpString="*.rar") returned 5 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.7z") returned 0 [0136.489] lstrlenA (lpString="*.7z") returned 4 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.tar") returned 0 [0136.489] lstrlenA (lpString="*.tar") returned 5 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.gzip") returned 0 [0136.489] lstrlenA (lpString="*.gzip") returned 6 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.jpg") returned 0 [0136.489] lstrlenA (lpString="*.jpg") returned 5 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.jpeg") returned 0 [0136.489] lstrlenA (lpString="*.jpeg") returned 6 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.psd") returned 0 [0136.489] lstrlenA (lpString="*.psd") returned 5 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.cdr") returned 0 [0136.489] lstrlenA (lpString="*.cdr") returned 5 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.dwg") returned 0 [0136.489] lstrlenA (lpString="*.dwg") returned 5 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.max") returned 0 [0136.489] lstrlenA (lpString="*.max") returned 5 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.bmp") returned 0 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.gif") returned 0 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.png") returned 0 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.doc") returned 0 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.docx") returned 0 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.xls") returned 0 [0136.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.xlsx") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.ppt") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.pptx") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.txt") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.pdf") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.djvu") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.htm") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.html") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mdb") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.cer") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.p12") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.pfx") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.kwm") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.pwm") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.1cd") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.md") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mdf") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.dbf") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.odt") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.vob") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.ifo") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.lnk") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.torrent") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mov") returned 0 [0136.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.m2v") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.3gp") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mpeg") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mpg") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.flv") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.avi") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mp4") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.wmv") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.divx") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mkv") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mp3") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.wav") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.flac") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.ape") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.wma") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.ac3") returned 0 [0136.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.doc") returned 0 [0136.491] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4422c6ad, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4422c6ad, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4422c6ad, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.491] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux") returned -1 [0136.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux") returned -1 [0136.491] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux") returned -1 [0136.491] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll") returned="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll" [0136.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\" [0136.491] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\") returned="" [0136.491] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\HOW TO DECRYPT FILES.txt" [0136.492] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\how to decrypt files.txt")) returned 0x20 [0136.492] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux" [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.max") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.png") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.html") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.md") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S54faafb0#\\6a909c260c6ab24d3b60051479f939a1\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.494] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4422c6ad, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4422c6ad, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4422c6ad, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.494] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0136.495] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4422c6ad, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4422c6ad, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4422c6ad, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6a909c260c6ab24d3b60051479f939a1", cAlternateFileName="6A909C~1")) returned 0 [0136.495] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0136.495] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba193ff1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bb92869, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bb92869, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f502e74, dwReserved1=0x7963696c, cFileName="Microsoft.S88747207#", cAlternateFileName="MICROS~1.S88")) returned 1 [0136.495] lstrcmpA (lpString1=".", lpString2="Microsoft.S88747207#") returned -1 [0136.495] lstrcmpA (lpString1="..", lpString2="Microsoft.S88747207#") returned -1 [0136.495] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.495] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.S88747207#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#" [0136.495] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba193ff1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bb92869, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bb92869, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.496] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.496] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba193ff1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bb92869, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bb92869, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.496] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.496] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.496] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43c5d210, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43c5d210, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43c5d210, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="283c689012ed31d8d4ece8be8826d5d7", cAlternateFileName="283C68~1")) returned 1 [0136.496] lstrcmpA (lpString1=".", lpString2="283c689012ed31d8d4ece8be8826d5d7") returned -1 [0136.497] lstrcmpA (lpString1="..", lpString2="283c689012ed31d8d4ece8be8826d5d7") returned -1 [0136.497] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\*.*") returned="*.*" [0136.497] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\", lpString2="283c689012ed31d8d4ece8be8826d5d7" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7" [0136.497] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43c5d210, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43c5d210, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43c5d210, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0136.498] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.498] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43c5d210, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43c5d210, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43c5d210, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.498] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.498] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.498] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c36fee, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43c36fee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43c5d210, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x49e00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.499] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.499] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll") returned -1 [0136.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll") returned -1 [0136.499] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll") returned -1 [0136.499] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\*.*") returned="*.*" [0136.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\" [0136.499] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\") returned="" [0136.499] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\HOW TO DECRYPT FILES.txt" [0136.499] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s88747207#\\283c689012ed31d8d4ece8be8826d5d7\\how to decrypt files.txt")) returned 0xffffffff [0136.499] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s88747207#\\283c689012ed31d8d4ece8be8826d5d7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.503] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.504] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.504] CloseHandle (hObject=0x214) returned 1 [0136.504] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll" [0136.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.zip") returned 0 [0136.504] lstrlenA (lpString="*.zip") returned 5 [0136.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.rar") returned 0 [0136.504] lstrlenA (lpString="*.rar") returned 5 [0136.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.7z") returned 0 [0136.504] lstrlenA (lpString="*.7z") returned 4 [0136.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.tar") returned 0 [0136.505] lstrlenA (lpString="*.tar") returned 5 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.gzip") returned 0 [0136.505] lstrlenA (lpString="*.gzip") returned 6 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.jpg") returned 0 [0136.505] lstrlenA (lpString="*.jpg") returned 5 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.jpeg") returned 0 [0136.505] lstrlenA (lpString="*.jpeg") returned 6 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.psd") returned 0 [0136.505] lstrlenA (lpString="*.psd") returned 5 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.cdr") returned 0 [0136.505] lstrlenA (lpString="*.cdr") returned 5 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.dwg") returned 0 [0136.505] lstrlenA (lpString="*.dwg") returned 5 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.max") returned 0 [0136.505] lstrlenA (lpString="*.max") returned 5 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.bmp") returned 0 [0136.505] lstrlenA (lpString="*.bmp") returned 5 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.gif") returned 0 [0136.505] lstrlenA (lpString="*.gif") returned 5 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.png") returned 0 [0136.505] lstrlenA (lpString="*.png") returned 5 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.doc") returned 0 [0136.505] lstrlenA (lpString="*.doc") returned 5 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.docx") returned 0 [0136.505] lstrlenA (lpString="*.docx") returned 6 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.xls") returned 0 [0136.505] lstrlenA (lpString="*.xls") returned 5 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.xlsx") returned 0 [0136.505] lstrlenA (lpString="*.xlsx") returned 6 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.ppt") returned 0 [0136.505] lstrlenA (lpString="*.ppt") returned 5 [0136.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.pptx") returned 0 [0136.506] lstrlenA (lpString="*.pptx") returned 6 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.txt") returned 0 [0136.506] lstrlenA (lpString="*.txt") returned 5 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.pdf") returned 0 [0136.506] lstrlenA (lpString="*.pdf") returned 5 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.djvu") returned 0 [0136.506] lstrlenA (lpString="*.djvu") returned 6 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.htm") returned 0 [0136.506] lstrlenA (lpString="*.htm") returned 5 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.html") returned 0 [0136.506] lstrlenA (lpString="*.html") returned 6 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mdb") returned 0 [0136.506] lstrlenA (lpString="*.mdb") returned 5 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.cer") returned 0 [0136.506] lstrlenA (lpString="*.cer") returned 5 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.p12") returned 0 [0136.506] lstrlenA (lpString="*.p12") returned 5 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.pfx") returned 0 [0136.506] lstrlenA (lpString="*.pfx") returned 5 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.kwm") returned 0 [0136.506] lstrlenA (lpString="*.kwm") returned 5 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.pwm") returned 0 [0136.506] lstrlenA (lpString="*.pwm") returned 5 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.1cd") returned 0 [0136.506] lstrlenA (lpString="*.1cd") returned 5 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.md") returned 0 [0136.506] lstrlenA (lpString="*.md") returned 4 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mdf") returned 0 [0136.506] lstrlenA (lpString="*.mdf") returned 5 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.dbf") returned 0 [0136.506] lstrlenA (lpString="*.dbf") returned 5 [0136.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.odt") returned 0 [0136.506] lstrlenA (lpString="*.odt") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.vob") returned 0 [0136.507] lstrlenA (lpString="*.vob") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.ifo") returned 0 [0136.507] lstrlenA (lpString="*.ifo") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.lnk") returned 0 [0136.507] lstrlenA (lpString="*.lnk") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.torrent") returned 0 [0136.507] lstrlenA (lpString="*.torrent") returned 9 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mov") returned 0 [0136.507] lstrlenA (lpString="*.mov") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.m2v") returned 0 [0136.507] lstrlenA (lpString="*.m2v") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.3gp") returned 0 [0136.507] lstrlenA (lpString="*.3gp") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mpeg") returned 0 [0136.507] lstrlenA (lpString="*.mpeg") returned 6 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mpg") returned 0 [0136.507] lstrlenA (lpString="*.mpg") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.flv") returned 0 [0136.507] lstrlenA (lpString="*.flv") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.avi") returned 0 [0136.507] lstrlenA (lpString="*.avi") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mp4") returned 0 [0136.507] lstrlenA (lpString="*.mp4") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.wmv") returned 0 [0136.507] lstrlenA (lpString="*.wmv") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.divx") returned 0 [0136.507] lstrlenA (lpString="*.divx") returned 6 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mkv") returned 0 [0136.507] lstrlenA (lpString="*.mkv") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mp3") returned 0 [0136.507] lstrlenA (lpString="*.mp3") returned 5 [0136.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.wav") returned 0 [0136.508] lstrlenA (lpString="*.wav") returned 5 [0136.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.flac") returned 0 [0136.508] lstrlenA (lpString="*.flac") returned 6 [0136.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.ape") returned 0 [0136.508] lstrlenA (lpString="*.ape") returned 5 [0136.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.wma") returned 0 [0136.508] lstrlenA (lpString="*.wma") returned 5 [0136.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.ac3") returned 0 [0136.508] lstrlenA (lpString="*.ac3") returned 5 [0136.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.doc") returned 0 [0136.508] lstrlenA (lpString="*.doc") returned 5 [0136.508] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5d210, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43c5d210, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43c5d210, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xb18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.508] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.508] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux") returned -1 [0136.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux") returned -1 [0136.508] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux") returned -1 [0136.508] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll") returned="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll" [0136.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\" [0136.508] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\") returned="" [0136.508] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\HOW TO DECRYPT FILES.txt" [0136.508] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.s88747207#\\283c689012ed31d8d4ece8be8826d5d7\\how to decrypt files.txt")) returned 0x20 [0136.508] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux" [0136.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.508] lstrlenA (lpString="*.zip") returned 5 [0136.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.508] lstrlenA (lpString="*.rar") returned 5 [0136.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.508] lstrlenA (lpString="*.7z") returned 4 [0136.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.509] lstrlenA (lpString="*.tar") returned 5 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.509] lstrlenA (lpString="*.gzip") returned 6 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.509] lstrlenA (lpString="*.jpg") returned 5 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.509] lstrlenA (lpString="*.jpeg") returned 6 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.509] lstrlenA (lpString="*.psd") returned 5 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.509] lstrlenA (lpString="*.cdr") returned 5 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.509] lstrlenA (lpString="*.dwg") returned 5 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.max") returned 0 [0136.509] lstrlenA (lpString="*.max") returned 5 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.509] lstrlenA (lpString="*.bmp") returned 5 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.509] lstrlenA (lpString="*.gif") returned 5 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.png") returned 0 [0136.509] lstrlenA (lpString="*.png") returned 5 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.509] lstrlenA (lpString="*.doc") returned 5 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.509] lstrlenA (lpString="*.docx") returned 6 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.509] lstrlenA (lpString="*.xls") returned 5 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.509] lstrlenA (lpString="*.xlsx") returned 6 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.509] lstrlenA (lpString="*.ppt") returned 5 [0136.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.509] lstrlenA (lpString="*.pptx") returned 6 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.510] lstrlenA (lpString="*.txt") returned 5 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.510] lstrlenA (lpString="*.pdf") returned 5 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.510] lstrlenA (lpString="*.djvu") returned 6 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.510] lstrlenA (lpString="*.htm") returned 5 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.html") returned 0 [0136.510] lstrlenA (lpString="*.html") returned 6 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.510] lstrlenA (lpString="*.mdb") returned 5 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.510] lstrlenA (lpString="*.cer") returned 5 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.510] lstrlenA (lpString="*.p12") returned 5 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.510] lstrlenA (lpString="*.pfx") returned 5 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.510] lstrlenA (lpString="*.kwm") returned 5 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.510] lstrlenA (lpString="*.pwm") returned 5 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.510] lstrlenA (lpString="*.1cd") returned 5 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.md") returned 0 [0136.510] lstrlenA (lpString="*.md") returned 4 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.510] lstrlenA (lpString="*.mdf") returned 5 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.510] lstrlenA (lpString="*.dbf") returned 5 [0136.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.510] lstrlenA (lpString="*.odt") returned 5 [0136.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.511] lstrlenA (lpString="*.vob") returned 5 [0136.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.511] lstrlenA (lpString="*.ifo") returned 5 [0136.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.511] lstrlenA (lpString="*.lnk") returned 5 [0136.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.511] lstrlenA (lpString="*.torrent") returned 9 [0136.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.511] lstrlenA (lpString="*.mov") returned 5 [0136.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.511] lstrlenA (lpString="*.m2v") returned 5 [0136.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.511] lstrlenA (lpString="*.3gp") returned 5 [0136.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.511] lstrlenA (lpString="*.mpeg") returned 6 [0136.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.511] lstrlenA (lpString="*.mpg") returned 5 [0136.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.511] lstrlenA (lpString="*.flv") returned 5 [0136.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.511] lstrlenA (lpString="*.avi") returned 5 [0136.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.511] lstrlenA (lpString="*.mp4") returned 5 [0136.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.516] lstrlenA (lpString="*.wmv") returned 5 [0136.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.516] lstrlenA (lpString="*.divx") returned 6 [0136.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.516] lstrlenA (lpString="*.mkv") returned 5 [0136.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.516] lstrlenA (lpString="*.mp3") returned 5 [0136.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.516] lstrlenA (lpString="*.wav") returned 5 [0136.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.516] lstrlenA (lpString="*.flac") returned 6 [0136.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.516] lstrlenA (lpString="*.ape") returned 5 [0136.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.516] lstrlenA (lpString="*.wma") returned 5 [0136.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.516] lstrlenA (lpString="*.ac3") returned 5 [0136.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.S88747207#\\283c689012ed31d8d4ece8be8826d5d7\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.516] lstrlenA (lpString="*.doc") returned 5 [0136.517] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5d210, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43c5d210, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43c5d210, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xb18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.517] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0136.517] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43c5d210, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43c5d210, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43c5d210, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="283c689012ed31d8d4ece8be8826d5d7", cAlternateFileName="283C68~1")) returned 0 [0136.517] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0136.517] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb89964ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7aa4ae38, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7aa4ae38, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d432e74, dwReserved1=0x74656c64, cFileName="Microsoft.Sa56e3556#", cAlternateFileName="MICROS~1.SA5")) returned 1 [0136.517] lstrcmpA (lpString1=".", lpString2="Microsoft.Sa56e3556#") returned -1 [0136.517] lstrcmpA (lpString1="..", lpString2="Microsoft.Sa56e3556#") returned -1 [0136.517] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.517] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Sa56e3556#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#" [0136.518] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#") returned 67 [0136.518] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb89964ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7aa4ae38, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7aa4ae38, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0136.518] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.518] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb89964ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7aa4ae38, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7aa4ae38, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.518] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.518] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.518] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e359178, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3e359178, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3e359178, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fcfa6907e3c99f563a1abf2fad6495a4", cAlternateFileName="FCFA69~1")) returned 1 [0136.518] lstrcmpA (lpString1=".", lpString2="fcfa6907e3c99f563a1abf2fad6495a4") returned -1 [0136.518] lstrcmpA (lpString1="..", lpString2="fcfa6907e3c99f563a1abf2fad6495a4") returned -1 [0136.518] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\*.*") returned="*.*" [0136.518] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\", lpString2="fcfa6907e3c99f563a1abf2fad6495a4" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4" [0136.518] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4") returned 100 [0136.518] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e359178, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3e359178, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3e359178, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.520] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.520] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e359178, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3e359178, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3e359178, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.520] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.520] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.520] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e332f4e, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3e332f4e, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3e359178, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0xe5e00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.520] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.520] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll") returned -1 [0136.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll") returned -1 [0136.520] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll") returned -1 [0136.520] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\*.*") returned="*.*" [0136.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\" [0136.521] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\") returned="" [0136.521] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\HOW TO DECRYPT FILES.txt" [0136.521] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\how to decrypt files.txt")) returned 0xffffffff [0136.521] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.522] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.522] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.523] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.523] CloseHandle (hObject=0x214) returned 1 [0136.524] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\", lpString2="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll" [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.zip") returned 0 [0136.524] lstrlenA (lpString="*.zip") returned 5 [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.rar") returned 0 [0136.524] lstrlenA (lpString="*.rar") returned 5 [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.7z") returned 0 [0136.524] lstrlenA (lpString="*.7z") returned 4 [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.tar") returned 0 [0136.524] lstrlenA (lpString="*.tar") returned 5 [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.gzip") returned 0 [0136.524] lstrlenA (lpString="*.gzip") returned 6 [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.jpg") returned 0 [0136.524] lstrlenA (lpString="*.jpg") returned 5 [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.jpeg") returned 0 [0136.524] lstrlenA (lpString="*.jpeg") returned 6 [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.psd") returned 0 [0136.524] lstrlenA (lpString="*.psd") returned 5 [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.cdr") returned 0 [0136.524] lstrlenA (lpString="*.cdr") returned 5 [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.dwg") returned 0 [0136.524] lstrlenA (lpString="*.dwg") returned 5 [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.max") returned 0 [0136.524] lstrlenA (lpString="*.max") returned 5 [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.bmp") returned 0 [0136.524] lstrlenA (lpString="*.bmp") returned 5 [0136.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.gif") returned 0 [0136.525] lstrlenA (lpString="*.gif") returned 5 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.png") returned 0 [0136.525] lstrlenA (lpString="*.png") returned 5 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.doc") returned 0 [0136.525] lstrlenA (lpString="*.doc") returned 5 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.docx") returned 0 [0136.525] lstrlenA (lpString="*.docx") returned 6 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.xls") returned 0 [0136.525] lstrlenA (lpString="*.xls") returned 5 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.xlsx") returned 0 [0136.525] lstrlenA (lpString="*.xlsx") returned 6 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.ppt") returned 0 [0136.525] lstrlenA (lpString="*.ppt") returned 5 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.pptx") returned 0 [0136.525] lstrlenA (lpString="*.pptx") returned 6 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.txt") returned 0 [0136.525] lstrlenA (lpString="*.txt") returned 5 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.pdf") returned 0 [0136.525] lstrlenA (lpString="*.pdf") returned 5 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.djvu") returned 0 [0136.525] lstrlenA (lpString="*.djvu") returned 6 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.htm") returned 0 [0136.525] lstrlenA (lpString="*.htm") returned 5 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.html") returned 0 [0136.525] lstrlenA (lpString="*.html") returned 6 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mdb") returned 0 [0136.525] lstrlenA (lpString="*.mdb") returned 5 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.cer") returned 0 [0136.525] lstrlenA (lpString="*.cer") returned 5 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.p12") returned 0 [0136.525] lstrlenA (lpString="*.p12") returned 5 [0136.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.pfx") returned 0 [0136.526] lstrlenA (lpString="*.pfx") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.kwm") returned 0 [0136.526] lstrlenA (lpString="*.kwm") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.pwm") returned 0 [0136.526] lstrlenA (lpString="*.pwm") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.1cd") returned 0 [0136.526] lstrlenA (lpString="*.1cd") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.md") returned 0 [0136.526] lstrlenA (lpString="*.md") returned 4 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mdf") returned 0 [0136.526] lstrlenA (lpString="*.mdf") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.dbf") returned 0 [0136.526] lstrlenA (lpString="*.dbf") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.odt") returned 0 [0136.526] lstrlenA (lpString="*.odt") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.vob") returned 0 [0136.526] lstrlenA (lpString="*.vob") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.ifo") returned 0 [0136.526] lstrlenA (lpString="*.ifo") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.lnk") returned 0 [0136.526] lstrlenA (lpString="*.lnk") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.torrent") returned 0 [0136.526] lstrlenA (lpString="*.torrent") returned 9 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mov") returned 0 [0136.526] lstrlenA (lpString="*.mov") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.m2v") returned 0 [0136.526] lstrlenA (lpString="*.m2v") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.3gp") returned 0 [0136.526] lstrlenA (lpString="*.3gp") returned 5 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mpeg") returned 0 [0136.526] lstrlenA (lpString="*.mpeg") returned 6 [0136.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mpg") returned 0 [0136.527] lstrlenA (lpString="*.mpg") returned 5 [0136.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.flv") returned 0 [0136.527] lstrlenA (lpString="*.flv") returned 5 [0136.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.avi") returned 0 [0136.527] lstrlenA (lpString="*.avi") returned 5 [0136.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mp4") returned 0 [0136.527] lstrlenA (lpString="*.mp4") returned 5 [0136.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.wmv") returned 0 [0136.527] lstrlenA (lpString="*.wmv") returned 5 [0136.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.divx") returned 0 [0136.527] lstrlenA (lpString="*.divx") returned 6 [0136.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mkv") returned 0 [0136.527] lstrlenA (lpString="*.mkv") returned 5 [0136.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mp3") returned 0 [0136.527] lstrlenA (lpString="*.mp3") returned 5 [0136.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.wav") returned 0 [0136.528] lstrlenA (lpString="*.wav") returned 5 [0136.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.flac") returned 0 [0136.528] lstrlenA (lpString="*.flac") returned 6 [0136.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.ape") returned 0 [0136.528] lstrlenA (lpString="*.ape") returned 5 [0136.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.wma") returned 0 [0136.528] lstrlenA (lpString="*.wma") returned 5 [0136.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.ac3") returned 0 [0136.528] lstrlenA (lpString="*.ac3") returned 5 [0136.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.doc") returned 0 [0136.528] lstrlenA (lpString="*.doc") returned 5 [0136.528] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e359178, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3e359178, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3e359178, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x664, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.528] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.528] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux") returned -1 [0136.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux") returned -1 [0136.528] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux") returned -1 [0136.528] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll") returned="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll" [0136.528] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\" [0136.528] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\") returned="" [0136.528] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\HOW TO DECRYPT FILES.txt" [0136.528] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\how to decrypt files.txt")) returned 0x20 [0136.528] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\", lpString2="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux" [0136.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.528] lstrlenA (lpString="*.zip") returned 5 [0136.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.528] lstrlenA (lpString="*.rar") returned 5 [0136.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.528] lstrlenA (lpString="*.7z") returned 4 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.529] lstrlenA (lpString="*.tar") returned 5 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.529] lstrlenA (lpString="*.gzip") returned 6 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.529] lstrlenA (lpString="*.jpg") returned 5 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.529] lstrlenA (lpString="*.jpeg") returned 6 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.529] lstrlenA (lpString="*.psd") returned 5 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.529] lstrlenA (lpString="*.cdr") returned 5 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.529] lstrlenA (lpString="*.dwg") returned 5 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.max") returned 0 [0136.529] lstrlenA (lpString="*.max") returned 5 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.529] lstrlenA (lpString="*.bmp") returned 5 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.529] lstrlenA (lpString="*.gif") returned 5 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.png") returned 0 [0136.529] lstrlenA (lpString="*.png") returned 5 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.529] lstrlenA (lpString="*.doc") returned 5 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.529] lstrlenA (lpString="*.docx") returned 6 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.529] lstrlenA (lpString="*.xls") returned 5 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.529] lstrlenA (lpString="*.xlsx") returned 6 [0136.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.529] lstrlenA (lpString="*.ppt") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.530] lstrlenA (lpString="*.pptx") returned 6 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.530] lstrlenA (lpString="*.txt") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.530] lstrlenA (lpString="*.pdf") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.530] lstrlenA (lpString="*.djvu") returned 6 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.530] lstrlenA (lpString="*.htm") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.html") returned 0 [0136.530] lstrlenA (lpString="*.html") returned 6 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.530] lstrlenA (lpString="*.mdb") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.530] lstrlenA (lpString="*.cer") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.530] lstrlenA (lpString="*.p12") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.530] lstrlenA (lpString="*.pfx") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.530] lstrlenA (lpString="*.kwm") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.530] lstrlenA (lpString="*.pwm") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.530] lstrlenA (lpString="*.1cd") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.md") returned 0 [0136.530] lstrlenA (lpString="*.md") returned 4 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.530] lstrlenA (lpString="*.mdf") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.530] lstrlenA (lpString="*.dbf") returned 5 [0136.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.531] lstrlenA (lpString="*.odt") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.531] lstrlenA (lpString="*.vob") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.531] lstrlenA (lpString="*.ifo") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.531] lstrlenA (lpString="*.lnk") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.531] lstrlenA (lpString="*.torrent") returned 9 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.531] lstrlenA (lpString="*.mov") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.531] lstrlenA (lpString="*.m2v") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.531] lstrlenA (lpString="*.3gp") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.531] lstrlenA (lpString="*.mpeg") returned 6 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.531] lstrlenA (lpString="*.mpg") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.531] lstrlenA (lpString="*.flv") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.531] lstrlenA (lpString="*.avi") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.531] lstrlenA (lpString="*.mp4") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.531] lstrlenA (lpString="*.wmv") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.531] lstrlenA (lpString="*.divx") returned 6 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.531] lstrlenA (lpString="*.mkv") returned 5 [0136.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.532] lstrlenA (lpString="*.mp3") returned 5 [0136.532] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.532] lstrlenA (lpString="*.wav") returned 5 [0136.532] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.532] lstrlenA (lpString="*.flac") returned 6 [0136.532] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.532] lstrlenA (lpString="*.ape") returned 5 [0136.532] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.532] lstrlenA (lpString="*.wma") returned 5 [0136.532] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.532] lstrlenA (lpString="*.ac3") returned 5 [0136.532] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sa56e3556#\\fcfa6907e3c99f563a1abf2fad6495a4\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.532] lstrlenA (lpString="*.doc") returned 5 [0136.532] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e359178, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3e359178, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3e359178, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x664, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.532] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.532] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e359178, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3e359178, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3e359178, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fcfa6907e3c99f563a1abf2fad6495a4", cAlternateFileName="FCFA69~1")) returned 0 [0136.532] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0136.533] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb87cc881, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bd8248e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bd8248e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75526369, dwReserved1=0x6547656c, cFileName="Microsoft.Sb6a1f1bc#", cAlternateFileName="MICROS~1.SB6")) returned 1 [0136.533] lstrcmpA (lpString1=".", lpString2="Microsoft.Sb6a1f1bc#") returned -1 [0136.533] lstrcmpA (lpString1="..", lpString2="Microsoft.Sb6a1f1bc#") returned -1 [0136.533] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.533] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Sb6a1f1bc#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#" [0136.533] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#") returned 67 [0136.533] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb87cc881, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bd8248e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bd8248e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0136.534] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.534] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb87cc881, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bd8248e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bd8248e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.534] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.534] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.534] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447d59ab, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x44821d73, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44821d73, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5a881edf7abced455e39ddfa93d0f415", cAlternateFileName="5A881E~1")) returned 1 [0136.534] lstrcmpA (lpString1=".", lpString2="5a881edf7abced455e39ddfa93d0f415") returned -1 [0136.534] lstrcmpA (lpString1="..", lpString2="5a881edf7abced455e39ddfa93d0f415") returned -1 [0136.534] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\*.*") returned="*.*" [0136.534] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\", lpString2="5a881edf7abced455e39ddfa93d0f415" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415" [0136.534] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415") returned 100 [0136.534] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447d59ab, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x44821d73, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44821d73, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.536] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.536] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447d59ab, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x44821d73, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44821d73, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.536] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.536] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.536] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447d59ab, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x447d59ab, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44821d73, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.536] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.536] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll") returned -1 [0136.536] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll") returned -1 [0136.536] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll") returned -1 [0136.536] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\*.*") returned="*.*" [0136.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\" [0136.536] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\") returned="" [0136.536] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\HOW TO DECRYPT FILES.txt" [0136.536] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\how to decrypt files.txt")) returned 0xffffffff [0136.536] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.537] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.537] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.538] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.538] CloseHandle (hObject=0x214) returned 1 [0136.538] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll" [0136.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.zip") returned 0 [0136.538] lstrlenA (lpString="*.zip") returned 5 [0136.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.rar") returned 0 [0136.538] lstrlenA (lpString="*.rar") returned 5 [0136.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.7z") returned 0 [0136.538] lstrlenA (lpString="*.7z") returned 4 [0136.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.tar") returned 0 [0136.539] lstrlenA (lpString="*.tar") returned 5 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.gzip") returned 0 [0136.539] lstrlenA (lpString="*.gzip") returned 6 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.jpg") returned 0 [0136.539] lstrlenA (lpString="*.jpg") returned 5 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.jpeg") returned 0 [0136.539] lstrlenA (lpString="*.jpeg") returned 6 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.psd") returned 0 [0136.539] lstrlenA (lpString="*.psd") returned 5 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.cdr") returned 0 [0136.539] lstrlenA (lpString="*.cdr") returned 5 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.dwg") returned 0 [0136.539] lstrlenA (lpString="*.dwg") returned 5 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.max") returned 0 [0136.539] lstrlenA (lpString="*.max") returned 5 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.bmp") returned 0 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.gif") returned 0 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.png") returned 0 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.doc") returned 0 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.docx") returned 0 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.xls") returned 0 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.xlsx") returned 0 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.ppt") returned 0 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.pptx") returned 0 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.txt") returned 0 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.pdf") returned 0 [0136.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.djvu") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.htm") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.html") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mdb") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.cer") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.p12") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.pfx") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.kwm") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.pwm") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.1cd") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.md") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mdf") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.dbf") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.odt") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.vob") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.ifo") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.lnk") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.torrent") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mov") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.m2v") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.3gp") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mpeg") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mpg") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.flv") returned 0 [0136.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.avi") returned 0 [0136.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mp4") returned 0 [0136.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.wmv") returned 0 [0136.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.divx") returned 0 [0136.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mkv") returned 0 [0136.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mp3") returned 0 [0136.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.wav") returned 0 [0136.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.flac") returned 0 [0136.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.ape") returned 0 [0136.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.wma") returned 0 [0136.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.ac3") returned 0 [0136.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.doc") returned 0 [0136.541] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447d59ab, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x447d59ab, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44821d73, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.541] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.541] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux") returned -1 [0136.541] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux") returned -1 [0136.541] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux") returned -1 [0136.541] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll") returned="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll" [0136.541] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\" [0136.541] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\") returned="" [0136.541] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\HOW TO DECRYPT FILES.txt" [0136.541] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\how to decrypt files.txt")) returned 0x20 [0136.541] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux" [0136.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.max") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.png") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.html") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.md") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Sb6a1f1bc#\\5a881edf7abced455e39ddfa93d0f415\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.544] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447d59ab, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x447d59ab, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44821d73, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.544] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0136.545] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447d59ab, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x44821d73, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44821d73, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5a881edf7abced455e39ddfa93d0f415", cAlternateFileName="5A881E~1")) returned 0 [0136.545] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0136.545] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9e72e9a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bdce90e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bdce90e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d582e74, dwReserved1=0x6c65486c, cFileName="Microsoft.T9d753d8c#", cAlternateFileName="MICROS~1.T9D")) returned 1 [0136.545] lstrcmpA (lpString1=".", lpString2="Microsoft.T9d753d8c#") returned -1 [0136.545] lstrcmpA (lpString1="..", lpString2="Microsoft.T9d753d8c#") returned -1 [0136.545] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.545] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.T9d753d8c#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#" [0136.545] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9e72e9a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bdce90e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bdce90e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.546] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.546] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9e72e9a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5bdce90e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5bdce90e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.546] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.546] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.546] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44c44296, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x44c4b7cb, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44c4b7cb, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="df6972e4c151c23c0e3ba15cd3f9670b", cAlternateFileName="DF6972~1")) returned 1 [0136.546] lstrcmpA (lpString1=".", lpString2="df6972e4c151c23c0e3ba15cd3f9670b") returned -1 [0136.546] lstrcmpA (lpString1="..", lpString2="df6972e4c151c23c0e3ba15cd3f9670b") returned -1 [0136.546] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\*.*") returned="*.*" [0136.546] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\", lpString2="df6972e4c151c23c0e3ba15cd3f9670b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b" [0136.546] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44c44296, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x44c4b7cb, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44c4b7cb, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.548] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.548] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44c44296, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x44c4b7cb, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44c4b7cb, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.548] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.548] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.548] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44c14c75, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x44c14c75, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44c4ded9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Tpm.Commands.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.548] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.548] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Tpm.Commands.ni.dll") returned -1 [0136.548] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Tpm.Commands.ni.dll") returned -1 [0136.548] lstrcmpiA (lpString1="", lpString2="Microsoft.Tpm.Commands.ni.dll") returned -1 [0136.548] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\*.*") returned="*.*" [0136.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\" [0136.548] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\") returned="" [0136.548] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\HOW TO DECRYPT FILES.txt" [0136.548] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.t9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\how to decrypt files.txt")) returned 0xffffffff [0136.548] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.t9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.549] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.550] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.550] CloseHandle (hObject=0x214) returned 1 [0136.550] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\", lpString2="Microsoft.Tpm.Commands.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll" [0136.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.zip") returned 0 [0136.550] lstrlenA (lpString="*.zip") returned 5 [0136.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.rar") returned 0 [0136.550] lstrlenA (lpString="*.rar") returned 5 [0136.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.7z") returned 0 [0136.550] lstrlenA (lpString="*.7z") returned 4 [0136.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.tar") returned 0 [0136.550] lstrlenA (lpString="*.tar") returned 5 [0136.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.gzip") returned 0 [0136.551] lstrlenA (lpString="*.gzip") returned 6 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.jpg") returned 0 [0136.551] lstrlenA (lpString="*.jpg") returned 5 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.jpeg") returned 0 [0136.551] lstrlenA (lpString="*.jpeg") returned 6 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.psd") returned 0 [0136.551] lstrlenA (lpString="*.psd") returned 5 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.cdr") returned 0 [0136.551] lstrlenA (lpString="*.cdr") returned 5 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.dwg") returned 0 [0136.551] lstrlenA (lpString="*.dwg") returned 5 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.max") returned 0 [0136.551] lstrlenA (lpString="*.max") returned 5 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.bmp") returned 0 [0136.551] lstrlenA (lpString="*.bmp") returned 5 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.gif") returned 0 [0136.551] lstrlenA (lpString="*.gif") returned 5 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.png") returned 0 [0136.551] lstrlenA (lpString="*.png") returned 5 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.doc") returned 0 [0136.551] lstrlenA (lpString="*.doc") returned 5 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.docx") returned 0 [0136.551] lstrlenA (lpString="*.docx") returned 6 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.xls") returned 0 [0136.551] lstrlenA (lpString="*.xls") returned 5 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.xlsx") returned 0 [0136.551] lstrlenA (lpString="*.xlsx") returned 6 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.ppt") returned 0 [0136.551] lstrlenA (lpString="*.ppt") returned 5 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.pptx") returned 0 [0136.551] lstrlenA (lpString="*.pptx") returned 6 [0136.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.txt") returned 0 [0136.552] lstrlenA (lpString="*.txt") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.pdf") returned 0 [0136.552] lstrlenA (lpString="*.pdf") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.djvu") returned 0 [0136.552] lstrlenA (lpString="*.djvu") returned 6 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.htm") returned 0 [0136.552] lstrlenA (lpString="*.htm") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.html") returned 0 [0136.552] lstrlenA (lpString="*.html") returned 6 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.mdb") returned 0 [0136.552] lstrlenA (lpString="*.mdb") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.cer") returned 0 [0136.552] lstrlenA (lpString="*.cer") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.p12") returned 0 [0136.552] lstrlenA (lpString="*.p12") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.pfx") returned 0 [0136.552] lstrlenA (lpString="*.pfx") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.kwm") returned 0 [0136.552] lstrlenA (lpString="*.kwm") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.pwm") returned 0 [0136.552] lstrlenA (lpString="*.pwm") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.1cd") returned 0 [0136.552] lstrlenA (lpString="*.1cd") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.md") returned 0 [0136.552] lstrlenA (lpString="*.md") returned 4 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.mdf") returned 0 [0136.552] lstrlenA (lpString="*.mdf") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.dbf") returned 0 [0136.552] lstrlenA (lpString="*.dbf") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.odt") returned 0 [0136.552] lstrlenA (lpString="*.odt") returned 5 [0136.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.vob") returned 0 [0136.552] lstrlenA (lpString="*.vob") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.ifo") returned 0 [0136.553] lstrlenA (lpString="*.ifo") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.lnk") returned 0 [0136.553] lstrlenA (lpString="*.lnk") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.torrent") returned 0 [0136.553] lstrlenA (lpString="*.torrent") returned 9 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.mov") returned 0 [0136.553] lstrlenA (lpString="*.mov") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.m2v") returned 0 [0136.553] lstrlenA (lpString="*.m2v") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.3gp") returned 0 [0136.553] lstrlenA (lpString="*.3gp") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.mpeg") returned 0 [0136.553] lstrlenA (lpString="*.mpeg") returned 6 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.mpg") returned 0 [0136.553] lstrlenA (lpString="*.mpg") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.flv") returned 0 [0136.553] lstrlenA (lpString="*.flv") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.avi") returned 0 [0136.553] lstrlenA (lpString="*.avi") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.mp4") returned 0 [0136.553] lstrlenA (lpString="*.mp4") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.wmv") returned 0 [0136.553] lstrlenA (lpString="*.wmv") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.divx") returned 0 [0136.553] lstrlenA (lpString="*.divx") returned 6 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.mkv") returned 0 [0136.553] lstrlenA (lpString="*.mkv") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.mp3") returned 0 [0136.553] lstrlenA (lpString="*.mp3") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.wav") returned 0 [0136.553] lstrlenA (lpString="*.wav") returned 5 [0136.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.flac") returned 0 [0136.554] lstrlenA (lpString="*.flac") returned 6 [0136.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.ape") returned 0 [0136.554] lstrlenA (lpString="*.ape") returned 5 [0136.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.wma") returned 0 [0136.554] lstrlenA (lpString="*.wma") returned 5 [0136.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.ac3") returned 0 [0136.554] lstrlenA (lpString="*.ac3") returned 5 [0136.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll", pszSpec="*.doc") returned 0 [0136.554] lstrlenA (lpString="*.doc") returned 5 [0136.554] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44c47d36, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x44c47d36, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44c4a444, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x2f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Tpm.Commands.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.554] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.554] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Tpm.Commands.ni.dll.aux") returned -1 [0136.554] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Tpm.Commands.ni.dll.aux") returned -1 [0136.554] lstrcmpiA (lpString1="", lpString2="Microsoft.Tpm.Commands.ni.dll.aux") returned -1 [0136.554] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll") returned="Microsoft.Tpm.Commands.ni.dll" [0136.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\" [0136.554] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\") returned="" [0136.554] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\HOW TO DECRYPT FILES.txt" [0136.554] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.t9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\how to decrypt files.txt")) returned 0x20 [0136.554] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\", lpString2="Microsoft.Tpm.Commands.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux" [0136.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.554] lstrlenA (lpString="*.zip") returned 5 [0136.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.554] lstrlenA (lpString="*.rar") returned 5 [0136.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.554] lstrlenA (lpString="*.7z") returned 4 [0136.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.554] lstrlenA (lpString="*.tar") returned 5 [0136.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.554] lstrlenA (lpString="*.gzip") returned 6 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.555] lstrlenA (lpString="*.jpg") returned 5 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.555] lstrlenA (lpString="*.jpeg") returned 6 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.555] lstrlenA (lpString="*.psd") returned 5 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.555] lstrlenA (lpString="*.cdr") returned 5 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.555] lstrlenA (lpString="*.dwg") returned 5 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.max") returned 0 [0136.555] lstrlenA (lpString="*.max") returned 5 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.555] lstrlenA (lpString="*.bmp") returned 5 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.555] lstrlenA (lpString="*.gif") returned 5 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.png") returned 0 [0136.555] lstrlenA (lpString="*.png") returned 5 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.555] lstrlenA (lpString="*.doc") returned 5 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.555] lstrlenA (lpString="*.docx") returned 6 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.555] lstrlenA (lpString="*.xls") returned 5 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.555] lstrlenA (lpString="*.xlsx") returned 6 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.555] lstrlenA (lpString="*.ppt") returned 5 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.555] lstrlenA (lpString="*.pptx") returned 6 [0136.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.555] lstrlenA (lpString="*.txt") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.556] lstrlenA (lpString="*.pdf") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.556] lstrlenA (lpString="*.djvu") returned 6 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.556] lstrlenA (lpString="*.htm") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.html") returned 0 [0136.556] lstrlenA (lpString="*.html") returned 6 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.556] lstrlenA (lpString="*.mdb") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.556] lstrlenA (lpString="*.cer") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.556] lstrlenA (lpString="*.p12") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.556] lstrlenA (lpString="*.pfx") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.556] lstrlenA (lpString="*.kwm") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.556] lstrlenA (lpString="*.pwm") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.556] lstrlenA (lpString="*.1cd") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.md") returned 0 [0136.556] lstrlenA (lpString="*.md") returned 4 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.556] lstrlenA (lpString="*.mdf") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.556] lstrlenA (lpString="*.dbf") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.556] lstrlenA (lpString="*.odt") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.556] lstrlenA (lpString="*.vob") returned 5 [0136.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.557] lstrlenA (lpString="*.ifo") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.557] lstrlenA (lpString="*.lnk") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.557] lstrlenA (lpString="*.torrent") returned 9 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.557] lstrlenA (lpString="*.mov") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.557] lstrlenA (lpString="*.m2v") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.557] lstrlenA (lpString="*.3gp") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.557] lstrlenA (lpString="*.mpeg") returned 6 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.557] lstrlenA (lpString="*.mpg") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.557] lstrlenA (lpString="*.flv") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.557] lstrlenA (lpString="*.avi") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.557] lstrlenA (lpString="*.mp4") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.557] lstrlenA (lpString="*.wmv") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.557] lstrlenA (lpString="*.divx") returned 6 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.557] lstrlenA (lpString="*.mkv") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.557] lstrlenA (lpString="*.mp3") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.557] lstrlenA (lpString="*.wav") returned 5 [0136.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.558] lstrlenA (lpString="*.flac") returned 6 [0136.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.558] lstrlenA (lpString="*.ape") returned 5 [0136.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.558] lstrlenA (lpString="*.wma") returned 5 [0136.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.558] lstrlenA (lpString="*.ac3") returned 5 [0136.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.T9d753d8c#\\df6972e4c151c23c0e3ba15cd3f9670b\\Microsoft.Tpm.Commands.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.558] lstrlenA (lpString="*.doc") returned 5 [0136.558] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44c47d36, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x44c47d36, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44c4a444, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x2f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Tpm.Commands.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.558] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0136.584] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44c44296, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x44c4b7cb, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x44c4b7cb, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="df6972e4c151c23c0e3ba15cd3f9670b", cAlternateFileName="DF6972~1")) returned 0 [0136.584] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.585] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8da00d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1b8da00d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1b8da00d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d582e74, dwReserved1=0x6c65486c, cFileName="Microsoft.Te49ad7d9#", cAlternateFileName="MICROS~1.TE4")) returned 1 [0136.585] lstrcmpA (lpString1=".", lpString2="Microsoft.Te49ad7d9#") returned -1 [0136.585] lstrcmpA (lpString1="..", lpString2="Microsoft.Te49ad7d9#") returned -1 [0136.585] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.585] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Te49ad7d9#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#" [0136.585] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#") returned 67 [0136.585] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8da00d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1b8da00d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1b8da00d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.586] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.586] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8da00d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1b8da00d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1b8da00d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.586] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.586] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.586] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8da00d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1b8da00d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1b8da00d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8678b6da7e4b13c34817d3ca1e7ea751", cAlternateFileName="8678B6~1")) returned 1 [0136.586] lstrcmpA (lpString1=".", lpString2="8678b6da7e4b13c34817d3ca1e7ea751") returned -1 [0136.586] lstrcmpA (lpString1="..", lpString2="8678b6da7e4b13c34817d3ca1e7ea751") returned -1 [0136.586] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\*.*") returned="*.*" [0136.586] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\", lpString2="8678b6da7e4b13c34817d3ca1e7ea751" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751" [0136.586] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751") returned 100 [0136.586] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8da00d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1b8da00d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1b8da00d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.588] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.588] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8da00d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1b8da00d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1b8da00d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.588] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.588] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.589] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b8b3d91, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1b8b3d91, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1b900270, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x142e00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Transactions.Bridge.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.589] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.589] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Transactions.Bridge.ni.dll") returned -1 [0136.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Transactions.Bridge.ni.dll") returned -1 [0136.589] lstrcmpiA (lpString1="", lpString2="Microsoft.Transactions.Bridge.ni.dll") returned -1 [0136.589] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\*.*") returned="*.*" [0136.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\" [0136.589] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\") returned="" [0136.589] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\HOW TO DECRYPT FILES.txt" [0136.589] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\how to decrypt files.txt")) returned 0xffffffff [0136.589] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.591] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.591] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.592] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.592] CloseHandle (hObject=0x214) returned 1 [0136.592] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\", lpString2="Microsoft.Transactions.Bridge.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll" [0136.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.zip") returned 0 [0136.592] lstrlenA (lpString="*.zip") returned 5 [0136.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.rar") returned 0 [0136.592] lstrlenA (lpString="*.rar") returned 5 [0136.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.7z") returned 0 [0136.592] lstrlenA (lpString="*.7z") returned 4 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.tar") returned 0 [0136.593] lstrlenA (lpString="*.tar") returned 5 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.gzip") returned 0 [0136.593] lstrlenA (lpString="*.gzip") returned 6 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.jpg") returned 0 [0136.593] lstrlenA (lpString="*.jpg") returned 5 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.jpeg") returned 0 [0136.593] lstrlenA (lpString="*.jpeg") returned 6 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.psd") returned 0 [0136.593] lstrlenA (lpString="*.psd") returned 5 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.cdr") returned 0 [0136.593] lstrlenA (lpString="*.cdr") returned 5 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.dwg") returned 0 [0136.593] lstrlenA (lpString="*.dwg") returned 5 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.max") returned 0 [0136.593] lstrlenA (lpString="*.max") returned 5 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.bmp") returned 0 [0136.593] lstrlenA (lpString="*.bmp") returned 5 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.gif") returned 0 [0136.593] lstrlenA (lpString="*.gif") returned 5 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.png") returned 0 [0136.593] lstrlenA (lpString="*.png") returned 5 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.doc") returned 0 [0136.593] lstrlenA (lpString="*.doc") returned 5 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.docx") returned 0 [0136.593] lstrlenA (lpString="*.docx") returned 6 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.xls") returned 0 [0136.593] lstrlenA (lpString="*.xls") returned 5 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.xlsx") returned 0 [0136.593] lstrlenA (lpString="*.xlsx") returned 6 [0136.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.ppt") returned 0 [0136.593] lstrlenA (lpString="*.ppt") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.pptx") returned 0 [0136.594] lstrlenA (lpString="*.pptx") returned 6 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.txt") returned 0 [0136.594] lstrlenA (lpString="*.txt") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.pdf") returned 0 [0136.594] lstrlenA (lpString="*.pdf") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.djvu") returned 0 [0136.594] lstrlenA (lpString="*.djvu") returned 6 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.htm") returned 0 [0136.594] lstrlenA (lpString="*.htm") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.html") returned 0 [0136.594] lstrlenA (lpString="*.html") returned 6 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mdb") returned 0 [0136.594] lstrlenA (lpString="*.mdb") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.cer") returned 0 [0136.594] lstrlenA (lpString="*.cer") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.p12") returned 0 [0136.594] lstrlenA (lpString="*.p12") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.pfx") returned 0 [0136.594] lstrlenA (lpString="*.pfx") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.kwm") returned 0 [0136.594] lstrlenA (lpString="*.kwm") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.pwm") returned 0 [0136.594] lstrlenA (lpString="*.pwm") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.1cd") returned 0 [0136.594] lstrlenA (lpString="*.1cd") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.md") returned 0 [0136.594] lstrlenA (lpString="*.md") returned 4 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mdf") returned 0 [0136.594] lstrlenA (lpString="*.mdf") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.dbf") returned 0 [0136.594] lstrlenA (lpString="*.dbf") returned 5 [0136.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.odt") returned 0 [0136.594] lstrlenA (lpString="*.odt") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.vob") returned 0 [0136.595] lstrlenA (lpString="*.vob") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.ifo") returned 0 [0136.595] lstrlenA (lpString="*.ifo") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.lnk") returned 0 [0136.595] lstrlenA (lpString="*.lnk") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.torrent") returned 0 [0136.595] lstrlenA (lpString="*.torrent") returned 9 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mov") returned 0 [0136.595] lstrlenA (lpString="*.mov") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.m2v") returned 0 [0136.595] lstrlenA (lpString="*.m2v") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.3gp") returned 0 [0136.595] lstrlenA (lpString="*.3gp") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mpeg") returned 0 [0136.595] lstrlenA (lpString="*.mpeg") returned 6 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mpg") returned 0 [0136.595] lstrlenA (lpString="*.mpg") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.flv") returned 0 [0136.595] lstrlenA (lpString="*.flv") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.avi") returned 0 [0136.595] lstrlenA (lpString="*.avi") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mp4") returned 0 [0136.595] lstrlenA (lpString="*.mp4") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.wmv") returned 0 [0136.595] lstrlenA (lpString="*.wmv") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.divx") returned 0 [0136.595] lstrlenA (lpString="*.divx") returned 6 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mkv") returned 0 [0136.595] lstrlenA (lpString="*.mkv") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mp3") returned 0 [0136.595] lstrlenA (lpString="*.mp3") returned 5 [0136.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.wav") returned 0 [0136.596] lstrlenA (lpString="*.wav") returned 5 [0136.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.flac") returned 0 [0136.596] lstrlenA (lpString="*.flac") returned 6 [0136.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.ape") returned 0 [0136.596] lstrlenA (lpString="*.ape") returned 5 [0136.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.wma") returned 0 [0136.596] lstrlenA (lpString="*.wma") returned 5 [0136.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.ac3") returned 0 [0136.596] lstrlenA (lpString="*.ac3") returned 5 [0136.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.doc") returned 0 [0136.596] lstrlenA (lpString="*.doc") returned 5 [0136.596] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b8da00d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1b8da00d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1b8da00d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x6f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Transactions.Bridge.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.596] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.596] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Transactions.Bridge.ni.dll.aux") returned -1 [0136.596] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Transactions.Bridge.ni.dll.aux") returned -1 [0136.596] lstrcmpiA (lpString1="", lpString2="Microsoft.Transactions.Bridge.ni.dll.aux") returned -1 [0136.596] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll") returned="Microsoft.Transactions.Bridge.ni.dll" [0136.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\" [0136.596] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\") returned="" [0136.596] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\HOW TO DECRYPT FILES.txt" [0136.596] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\how to decrypt files.txt")) returned 0x20 [0136.596] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\", lpString2="Microsoft.Transactions.Bridge.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux" [0136.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.596] lstrlenA (lpString="*.zip") returned 5 [0136.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.596] lstrlenA (lpString="*.rar") returned 5 [0136.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.596] lstrlenA (lpString="*.7z") returned 4 [0136.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.597] lstrlenA (lpString="*.tar") returned 5 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.597] lstrlenA (lpString="*.gzip") returned 6 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.597] lstrlenA (lpString="*.jpg") returned 5 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.597] lstrlenA (lpString="*.jpeg") returned 6 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.597] lstrlenA (lpString="*.psd") returned 5 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.597] lstrlenA (lpString="*.cdr") returned 5 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.597] lstrlenA (lpString="*.dwg") returned 5 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.max") returned 0 [0136.597] lstrlenA (lpString="*.max") returned 5 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.597] lstrlenA (lpString="*.bmp") returned 5 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.597] lstrlenA (lpString="*.gif") returned 5 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.png") returned 0 [0136.597] lstrlenA (lpString="*.png") returned 5 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.597] lstrlenA (lpString="*.doc") returned 5 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.597] lstrlenA (lpString="*.docx") returned 6 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.597] lstrlenA (lpString="*.xls") returned 5 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.597] lstrlenA (lpString="*.xlsx") returned 6 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.597] lstrlenA (lpString="*.ppt") returned 5 [0136.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.597] lstrlenA (lpString="*.pptx") returned 6 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.598] lstrlenA (lpString="*.txt") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.598] lstrlenA (lpString="*.pdf") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.598] lstrlenA (lpString="*.djvu") returned 6 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.598] lstrlenA (lpString="*.htm") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.html") returned 0 [0136.598] lstrlenA (lpString="*.html") returned 6 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.598] lstrlenA (lpString="*.mdb") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.598] lstrlenA (lpString="*.cer") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.598] lstrlenA (lpString="*.p12") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.598] lstrlenA (lpString="*.pfx") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.598] lstrlenA (lpString="*.kwm") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.598] lstrlenA (lpString="*.pwm") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.598] lstrlenA (lpString="*.1cd") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.md") returned 0 [0136.598] lstrlenA (lpString="*.md") returned 4 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.598] lstrlenA (lpString="*.mdf") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.598] lstrlenA (lpString="*.dbf") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.598] lstrlenA (lpString="*.odt") returned 5 [0136.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.599] lstrlenA (lpString="*.vob") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.599] lstrlenA (lpString="*.ifo") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.599] lstrlenA (lpString="*.lnk") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.599] lstrlenA (lpString="*.torrent") returned 9 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.599] lstrlenA (lpString="*.mov") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.599] lstrlenA (lpString="*.m2v") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.599] lstrlenA (lpString="*.3gp") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.599] lstrlenA (lpString="*.mpeg") returned 6 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.599] lstrlenA (lpString="*.mpg") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.599] lstrlenA (lpString="*.flv") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.599] lstrlenA (lpString="*.avi") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.599] lstrlenA (lpString="*.mp4") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.599] lstrlenA (lpString="*.wmv") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.599] lstrlenA (lpString="*.divx") returned 6 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.599] lstrlenA (lpString="*.mkv") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.599] lstrlenA (lpString="*.mp3") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.599] lstrlenA (lpString="*.wav") returned 5 [0136.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.600] lstrlenA (lpString="*.flac") returned 6 [0136.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.600] lstrlenA (lpString="*.ape") returned 5 [0136.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.600] lstrlenA (lpString="*.wma") returned 5 [0136.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.600] lstrlenA (lpString="*.ac3") returned 5 [0136.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8678b6da7e4b13c34817d3ca1e7ea751\\Microsoft.Transactions.Bridge.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.600] lstrlenA (lpString="*.doc") returned 5 [0136.600] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b8da00d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1b8da00d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1b8da00d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x6f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Transactions.Bridge.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.600] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.600] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8da00d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1b8da00d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1b8da00d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8678b6da7e4b13c34817d3ca1e7ea751", cAlternateFileName="8678B6~1")) returned 0 [0136.600] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0136.601] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x463fe50f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x463fe50f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x463fe50f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d582e74, dwReserved1=0x6c65486c, cFileName="Microsoft.V1955d7fd#", cAlternateFileName="MICROS~1.V19")) returned 1 [0136.601] lstrcmpA (lpString1=".", lpString2="Microsoft.V1955d7fd#") returned -1 [0136.601] lstrcmpA (lpString1="..", lpString2="Microsoft.V1955d7fd#") returned -1 [0136.601] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.601] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.V1955d7fd#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#" [0136.601] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#") returned 67 [0136.601] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x463fe50f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x463fe50f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x463fe50f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.603] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.603] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x463fe50f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x463fe50f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x463fe50f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.603] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.603] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.603] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x463fe50f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4642473b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4642473b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="627cfda9d3c4ae7fc8d56948e6b50499", cAlternateFileName="627CFD~1")) returned 1 [0136.603] lstrcmpA (lpString1=".", lpString2="627cfda9d3c4ae7fc8d56948e6b50499") returned -1 [0136.603] lstrcmpA (lpString1="..", lpString2="627cfda9d3c4ae7fc8d56948e6b50499") returned -1 [0136.603] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\*.*") returned="*.*" [0136.603] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\", lpString2="627cfda9d3c4ae7fc8d56948e6b50499" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499" [0136.603] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499") returned 100 [0136.603] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x463fe50f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4642473b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4642473b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.610] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.610] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x463fe50f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4642473b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4642473b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.610] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.610] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.610] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463b20be, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x463b20be, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4642473b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xe5000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.610] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.610] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll") returned -1 [0136.610] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll") returned -1 [0136.610] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll") returned -1 [0136.610] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\*.*") returned="*.*" [0136.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\" [0136.610] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\") returned="" [0136.610] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\HOW TO DECRYPT FILES.txt" [0136.610] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\how to decrypt files.txt")) returned 0xffffffff [0136.610] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.611] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.611] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.612] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.612] CloseHandle (hObject=0x214) returned 1 [0136.612] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll" [0136.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.zip") returned 0 [0136.612] lstrlenA (lpString="*.zip") returned 5 [0136.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.rar") returned 0 [0136.612] lstrlenA (lpString="*.rar") returned 5 [0136.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.7z") returned 0 [0136.612] lstrlenA (lpString="*.7z") returned 4 [0136.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.tar") returned 0 [0136.612] lstrlenA (lpString="*.tar") returned 5 [0136.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.gzip") returned 0 [0136.613] lstrlenA (lpString="*.gzip") returned 6 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.jpg") returned 0 [0136.613] lstrlenA (lpString="*.jpg") returned 5 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.jpeg") returned 0 [0136.613] lstrlenA (lpString="*.jpeg") returned 6 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.psd") returned 0 [0136.613] lstrlenA (lpString="*.psd") returned 5 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.cdr") returned 0 [0136.613] lstrlenA (lpString="*.cdr") returned 5 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.dwg") returned 0 [0136.613] lstrlenA (lpString="*.dwg") returned 5 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.max") returned 0 [0136.613] lstrlenA (lpString="*.max") returned 5 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.bmp") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.gif") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.png") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.doc") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.docx") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.xls") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.xlsx") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.ppt") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.pptx") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.txt") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.pdf") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.djvu") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.htm") returned 0 [0136.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.html") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.mdb") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.cer") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.p12") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.pfx") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.kwm") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.pwm") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.1cd") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.md") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.mdf") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.dbf") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.odt") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.vob") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.ifo") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.lnk") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.torrent") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.mov") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.m2v") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.3gp") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.mpeg") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.mpg") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.flv") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.avi") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.mp4") returned 0 [0136.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.wmv") returned 0 [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.divx") returned 0 [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.mkv") returned 0 [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.mp3") returned 0 [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.wav") returned 0 [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.flac") returned 0 [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.ape") returned 0 [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.wma") returned 0 [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.ac3") returned 0 [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll", pszSpec="*.doc") returned 0 [0136.615] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fe50f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x463fe50f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4642473b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.615] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.615] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux") returned -1 [0136.615] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux") returned -1 [0136.615] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux") returned -1 [0136.615] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll") returned="Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll" [0136.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\" [0136.615] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\") returned="" [0136.615] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\HOW TO DECRYPT FILES.txt" [0136.615] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\how to decrypt files.txt")) returned 0x20 [0136.615] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux" [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.max") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.png") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.html") returned 0 [0136.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.md") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\627cfda9d3c4ae7fc8d56948e6b50499\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.618] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fe50f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x463fe50f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4642473b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.618] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.618] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x463fe50f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4642473b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4642473b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="627cfda9d3c4ae7fc8d56948e6b50499", cAlternateFileName="627CFD~1")) returned 0 [0136.618] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0136.619] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b1f6c8c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4b1f6c8c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4b1f6c8c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75636f44, dwReserved1=0x746e656d, cFileName="Microsoft.V28a60cc2#", cAlternateFileName="MICROS~1.V28")) returned 1 [0136.619] lstrcmpA (lpString1=".", lpString2="Microsoft.V28a60cc2#") returned -1 [0136.619] lstrcmpA (lpString1="..", lpString2="Microsoft.V28a60cc2#") returned -1 [0136.619] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.619] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.V28a60cc2#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#" [0136.619] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b1f6c8c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4b1f6c8c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4b1f6c8c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.620] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.620] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b1f6c8c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4b1f6c8c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4b1f6c8c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.620] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.620] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.620] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b1f6c8c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4b1f6c8c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4b1f6c8c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c63b6ff23f7a6b33912bbdfa96d2a956", cAlternateFileName="C63B6F~1")) returned 1 [0136.620] lstrcmpA (lpString1=".", lpString2="c63b6ff23f7a6b33912bbdfa96d2a956") returned -1 [0136.620] lstrcmpA (lpString1="..", lpString2="c63b6ff23f7a6b33912bbdfa96d2a956") returned -1 [0136.620] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\*.*") returned="*.*" [0136.620] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\", lpString2="c63b6ff23f7a6b33912bbdfa96d2a956" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956" [0136.620] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b1f6c8c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4b1f6c8c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4b1f6c8c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759fd0 [0136.622] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.622] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b1f6c8c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4b1f6c8c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4b1f6c8c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.622] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.622] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.622] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1aa82e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4b1aa82e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4b1f6c8c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xc6000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.622] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.622] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll") returned -1 [0136.622] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll") returned -1 [0136.622] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll") returned -1 [0136.622] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\*.*") returned="*.*" [0136.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\" [0136.622] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\") returned="" [0136.622] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\HOW TO DECRYPT FILES.txt" [0136.622] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\how to decrypt files.txt")) returned 0xffffffff [0136.622] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.623] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.624] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.624] CloseHandle (hObject=0x214) returned 1 [0136.624] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll" [0136.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.zip") returned 0 [0136.624] lstrlenA (lpString="*.zip") returned 5 [0136.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.rar") returned 0 [0136.624] lstrlenA (lpString="*.rar") returned 5 [0136.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.7z") returned 0 [0136.624] lstrlenA (lpString="*.7z") returned 4 [0136.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.tar") returned 0 [0136.624] lstrlenA (lpString="*.tar") returned 5 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.gzip") returned 0 [0136.625] lstrlenA (lpString="*.gzip") returned 6 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.jpg") returned 0 [0136.625] lstrlenA (lpString="*.jpg") returned 5 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.jpeg") returned 0 [0136.625] lstrlenA (lpString="*.jpeg") returned 6 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.psd") returned 0 [0136.625] lstrlenA (lpString="*.psd") returned 5 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.cdr") returned 0 [0136.625] lstrlenA (lpString="*.cdr") returned 5 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.dwg") returned 0 [0136.625] lstrlenA (lpString="*.dwg") returned 5 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.max") returned 0 [0136.625] lstrlenA (lpString="*.max") returned 5 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.bmp") returned 0 [0136.625] lstrlenA (lpString="*.bmp") returned 5 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.gif") returned 0 [0136.625] lstrlenA (lpString="*.gif") returned 5 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.png") returned 0 [0136.625] lstrlenA (lpString="*.png") returned 5 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.doc") returned 0 [0136.625] lstrlenA (lpString="*.doc") returned 5 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.docx") returned 0 [0136.625] lstrlenA (lpString="*.docx") returned 6 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.xls") returned 0 [0136.625] lstrlenA (lpString="*.xls") returned 5 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.xlsx") returned 0 [0136.625] lstrlenA (lpString="*.xlsx") returned 6 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.ppt") returned 0 [0136.625] lstrlenA (lpString="*.ppt") returned 5 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.pptx") returned 0 [0136.625] lstrlenA (lpString="*.pptx") returned 6 [0136.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.txt") returned 0 [0136.626] lstrlenA (lpString="*.txt") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.pdf") returned 0 [0136.626] lstrlenA (lpString="*.pdf") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.djvu") returned 0 [0136.626] lstrlenA (lpString="*.djvu") returned 6 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.htm") returned 0 [0136.626] lstrlenA (lpString="*.htm") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.html") returned 0 [0136.626] lstrlenA (lpString="*.html") returned 6 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.mdb") returned 0 [0136.626] lstrlenA (lpString="*.mdb") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.cer") returned 0 [0136.626] lstrlenA (lpString="*.cer") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.p12") returned 0 [0136.626] lstrlenA (lpString="*.p12") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.pfx") returned 0 [0136.626] lstrlenA (lpString="*.pfx") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.kwm") returned 0 [0136.626] lstrlenA (lpString="*.kwm") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.pwm") returned 0 [0136.626] lstrlenA (lpString="*.pwm") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.1cd") returned 0 [0136.626] lstrlenA (lpString="*.1cd") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.md") returned 0 [0136.626] lstrlenA (lpString="*.md") returned 4 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.mdf") returned 0 [0136.626] lstrlenA (lpString="*.mdf") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.dbf") returned 0 [0136.626] lstrlenA (lpString="*.dbf") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.odt") returned 0 [0136.626] lstrlenA (lpString="*.odt") returned 5 [0136.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.vob") returned 0 [0136.626] lstrlenA (lpString="*.vob") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.ifo") returned 0 [0136.627] lstrlenA (lpString="*.ifo") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.lnk") returned 0 [0136.627] lstrlenA (lpString="*.lnk") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.torrent") returned 0 [0136.627] lstrlenA (lpString="*.torrent") returned 9 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.mov") returned 0 [0136.627] lstrlenA (lpString="*.mov") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.m2v") returned 0 [0136.627] lstrlenA (lpString="*.m2v") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.3gp") returned 0 [0136.627] lstrlenA (lpString="*.3gp") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.mpeg") returned 0 [0136.627] lstrlenA (lpString="*.mpeg") returned 6 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.mpg") returned 0 [0136.627] lstrlenA (lpString="*.mpg") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.flv") returned 0 [0136.627] lstrlenA (lpString="*.flv") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.avi") returned 0 [0136.627] lstrlenA (lpString="*.avi") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.mp4") returned 0 [0136.627] lstrlenA (lpString="*.mp4") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.wmv") returned 0 [0136.627] lstrlenA (lpString="*.wmv") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.divx") returned 0 [0136.627] lstrlenA (lpString="*.divx") returned 6 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.mkv") returned 0 [0136.627] lstrlenA (lpString="*.mkv") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.mp3") returned 0 [0136.627] lstrlenA (lpString="*.mp3") returned 5 [0136.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.wav") returned 0 [0136.627] lstrlenA (lpString="*.wav") returned 5 [0136.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.flac") returned 0 [0136.628] lstrlenA (lpString="*.flac") returned 6 [0136.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.ape") returned 0 [0136.628] lstrlenA (lpString="*.ape") returned 5 [0136.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.wma") returned 0 [0136.628] lstrlenA (lpString="*.wma") returned 5 [0136.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.ac3") returned 0 [0136.628] lstrlenA (lpString="*.ac3") returned 5 [0136.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll", pszSpec="*.doc") returned 0 [0136.628] lstrlenA (lpString="*.doc") returned 5 [0136.628] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1f6c8c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4b1f6c8c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4b1f6c8c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.628] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.628] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux") returned -1 [0136.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux") returned -1 [0136.628] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux") returned -1 [0136.628] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll") returned="Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll" [0136.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\" [0136.628] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\") returned="" [0136.628] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\HOW TO DECRYPT FILES.txt" [0136.628] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\how to decrypt files.txt")) returned 0x20 [0136.628] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux" [0136.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.628] lstrlenA (lpString="*.zip") returned 5 [0136.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.628] lstrlenA (lpString="*.rar") returned 5 [0136.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.628] lstrlenA (lpString="*.7z") returned 4 [0136.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.628] lstrlenA (lpString="*.tar") returned 5 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.629] lstrlenA (lpString="*.gzip") returned 6 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.629] lstrlenA (lpString="*.jpg") returned 5 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.629] lstrlenA (lpString="*.jpeg") returned 6 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.629] lstrlenA (lpString="*.psd") returned 5 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.629] lstrlenA (lpString="*.cdr") returned 5 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.629] lstrlenA (lpString="*.dwg") returned 5 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.max") returned 0 [0136.629] lstrlenA (lpString="*.max") returned 5 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.629] lstrlenA (lpString="*.bmp") returned 5 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.629] lstrlenA (lpString="*.gif") returned 5 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.png") returned 0 [0136.629] lstrlenA (lpString="*.png") returned 5 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.629] lstrlenA (lpString="*.doc") returned 5 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.629] lstrlenA (lpString="*.docx") returned 6 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.629] lstrlenA (lpString="*.xls") returned 5 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.629] lstrlenA (lpString="*.xlsx") returned 6 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.629] lstrlenA (lpString="*.ppt") returned 5 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.629] lstrlenA (lpString="*.pptx") returned 6 [0136.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.630] lstrlenA (lpString="*.txt") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.630] lstrlenA (lpString="*.pdf") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.630] lstrlenA (lpString="*.djvu") returned 6 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.630] lstrlenA (lpString="*.htm") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.html") returned 0 [0136.630] lstrlenA (lpString="*.html") returned 6 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.630] lstrlenA (lpString="*.mdb") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.630] lstrlenA (lpString="*.cer") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.630] lstrlenA (lpString="*.p12") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.630] lstrlenA (lpString="*.pfx") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.630] lstrlenA (lpString="*.kwm") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.630] lstrlenA (lpString="*.pwm") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.630] lstrlenA (lpString="*.1cd") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.md") returned 0 [0136.630] lstrlenA (lpString="*.md") returned 4 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.630] lstrlenA (lpString="*.mdf") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.630] lstrlenA (lpString="*.dbf") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.630] lstrlenA (lpString="*.odt") returned 5 [0136.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.630] lstrlenA (lpString="*.vob") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.631] lstrlenA (lpString="*.ifo") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.631] lstrlenA (lpString="*.lnk") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.631] lstrlenA (lpString="*.torrent") returned 9 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.631] lstrlenA (lpString="*.mov") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.631] lstrlenA (lpString="*.m2v") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.631] lstrlenA (lpString="*.3gp") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.631] lstrlenA (lpString="*.mpeg") returned 6 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.631] lstrlenA (lpString="*.mpg") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.631] lstrlenA (lpString="*.flv") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.631] lstrlenA (lpString="*.avi") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.631] lstrlenA (lpString="*.mp4") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.631] lstrlenA (lpString="*.wmv") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.631] lstrlenA (lpString="*.divx") returned 6 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.631] lstrlenA (lpString="*.mkv") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.631] lstrlenA (lpString="*.mp3") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.631] lstrlenA (lpString="*.wav") returned 5 [0136.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.632] lstrlenA (lpString="*.flac") returned 6 [0136.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.632] lstrlenA (lpString="*.ape") returned 5 [0136.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.632] lstrlenA (lpString="*.wma") returned 5 [0136.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.632] lstrlenA (lpString="*.ac3") returned 5 [0136.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\c63b6ff23f7a6b33912bbdfa96d2a956\\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.632] lstrlenA (lpString="*.doc") returned 5 [0136.632] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1f6c8c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4b1f6c8c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4b1f6c8c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.632] FindClose (in: hFindFile=0x759fd0 | out: hFindFile=0x759fd0) returned 1 [0136.632] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b1f6c8c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4b1f6c8c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4b1f6c8c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c63b6ff23f7a6b33912bbdfa96d2a956", cAlternateFileName="C63B6F~1")) returned 0 [0136.632] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.633] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c069eef, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4c069eef, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4c069eef, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x612e6c6c, dwReserved1=0x74007875, cFileName="Microsoft.V5499e76b#", cAlternateFileName="MICROS~1.V54")) returned 1 [0136.633] lstrcmpA (lpString1=".", lpString2="Microsoft.V5499e76b#") returned -1 [0136.633] lstrcmpA (lpString1="..", lpString2="Microsoft.V5499e76b#") returned -1 [0136.633] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.633] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.V5499e76b#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#" [0136.633] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#") returned 67 [0136.633] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c069eef, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4c069eef, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4c069eef, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.636] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.636] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c069eef, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4c069eef, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4c069eef, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.636] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.636] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.636] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c069eef, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4c069eef, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4c069eef, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="82b8b9ebb7d53fad94d93af6a25f7154", cAlternateFileName="82B8B9~1")) returned 1 [0136.636] lstrcmpA (lpString1=".", lpString2="82b8b9ebb7d53fad94d93af6a25f7154") returned -1 [0136.636] lstrcmpA (lpString1="..", lpString2="82b8b9ebb7d53fad94d93af6a25f7154") returned -1 [0136.636] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\*.*") returned="*.*" [0136.636] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\", lpString2="82b8b9ebb7d53fad94d93af6a25f7154" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154" [0136.636] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154") returned 100 [0136.636] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c069eef, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4c069eef, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4c069eef, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.640] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.640] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c069eef, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4c069eef, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4c069eef, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.640] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.641] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.641] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c069eef, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4c069eef, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4c09011e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.641] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.641] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll") returned -1 [0136.641] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll") returned -1 [0136.641] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll") returned -1 [0136.641] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\*.*") returned="*.*" [0136.641] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\" [0136.641] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\") returned="" [0136.641] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\HOW TO DECRYPT FILES.txt" [0136.641] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\how to decrypt files.txt")) returned 0xffffffff [0136.641] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.642] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.642] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.643] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.643] CloseHandle (hObject=0x214) returned 1 [0136.643] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll" [0136.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.zip") returned 0 [0136.643] lstrlenA (lpString="*.zip") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.rar") returned 0 [0136.644] lstrlenA (lpString="*.rar") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.7z") returned 0 [0136.644] lstrlenA (lpString="*.7z") returned 4 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.tar") returned 0 [0136.644] lstrlenA (lpString="*.tar") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.gzip") returned 0 [0136.644] lstrlenA (lpString="*.gzip") returned 6 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.jpg") returned 0 [0136.644] lstrlenA (lpString="*.jpg") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.jpeg") returned 0 [0136.644] lstrlenA (lpString="*.jpeg") returned 6 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.psd") returned 0 [0136.644] lstrlenA (lpString="*.psd") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.cdr") returned 0 [0136.644] lstrlenA (lpString="*.cdr") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.dwg") returned 0 [0136.644] lstrlenA (lpString="*.dwg") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.max") returned 0 [0136.644] lstrlenA (lpString="*.max") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.bmp") returned 0 [0136.644] lstrlenA (lpString="*.bmp") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.gif") returned 0 [0136.644] lstrlenA (lpString="*.gif") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.png") returned 0 [0136.644] lstrlenA (lpString="*.png") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.doc") returned 0 [0136.644] lstrlenA (lpString="*.doc") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.docx") returned 0 [0136.644] lstrlenA (lpString="*.docx") returned 6 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.xls") returned 0 [0136.644] lstrlenA (lpString="*.xls") returned 5 [0136.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.xlsx") returned 0 [0136.645] lstrlenA (lpString="*.xlsx") returned 6 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.ppt") returned 0 [0136.645] lstrlenA (lpString="*.ppt") returned 5 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.pptx") returned 0 [0136.645] lstrlenA (lpString="*.pptx") returned 6 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.txt") returned 0 [0136.645] lstrlenA (lpString="*.txt") returned 5 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.pdf") returned 0 [0136.645] lstrlenA (lpString="*.pdf") returned 5 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.djvu") returned 0 [0136.645] lstrlenA (lpString="*.djvu") returned 6 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.htm") returned 0 [0136.645] lstrlenA (lpString="*.htm") returned 5 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.html") returned 0 [0136.645] lstrlenA (lpString="*.html") returned 6 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.mdb") returned 0 [0136.645] lstrlenA (lpString="*.mdb") returned 5 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.cer") returned 0 [0136.645] lstrlenA (lpString="*.cer") returned 5 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.p12") returned 0 [0136.645] lstrlenA (lpString="*.p12") returned 5 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.pfx") returned 0 [0136.645] lstrlenA (lpString="*.pfx") returned 5 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.kwm") returned 0 [0136.645] lstrlenA (lpString="*.kwm") returned 5 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.pwm") returned 0 [0136.645] lstrlenA (lpString="*.pwm") returned 5 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.1cd") returned 0 [0136.645] lstrlenA (lpString="*.1cd") returned 5 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.md") returned 0 [0136.645] lstrlenA (lpString="*.md") returned 4 [0136.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.mdf") returned 0 [0136.646] lstrlenA (lpString="*.mdf") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.dbf") returned 0 [0136.646] lstrlenA (lpString="*.dbf") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.odt") returned 0 [0136.646] lstrlenA (lpString="*.odt") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.vob") returned 0 [0136.646] lstrlenA (lpString="*.vob") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.ifo") returned 0 [0136.646] lstrlenA (lpString="*.ifo") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.lnk") returned 0 [0136.646] lstrlenA (lpString="*.lnk") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.torrent") returned 0 [0136.646] lstrlenA (lpString="*.torrent") returned 9 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.mov") returned 0 [0136.646] lstrlenA (lpString="*.mov") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.m2v") returned 0 [0136.646] lstrlenA (lpString="*.m2v") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.3gp") returned 0 [0136.646] lstrlenA (lpString="*.3gp") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.mpeg") returned 0 [0136.646] lstrlenA (lpString="*.mpeg") returned 6 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.mpg") returned 0 [0136.646] lstrlenA (lpString="*.mpg") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.flv") returned 0 [0136.646] lstrlenA (lpString="*.flv") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.avi") returned 0 [0136.646] lstrlenA (lpString="*.avi") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.mp4") returned 0 [0136.646] lstrlenA (lpString="*.mp4") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.wmv") returned 0 [0136.646] lstrlenA (lpString="*.wmv") returned 5 [0136.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.divx") returned 0 [0136.647] lstrlenA (lpString="*.divx") returned 6 [0136.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.mkv") returned 0 [0136.647] lstrlenA (lpString="*.mkv") returned 5 [0136.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.mp3") returned 0 [0136.647] lstrlenA (lpString="*.mp3") returned 5 [0136.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.wav") returned 0 [0136.647] lstrlenA (lpString="*.wav") returned 5 [0136.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.flac") returned 0 [0136.647] lstrlenA (lpString="*.flac") returned 6 [0136.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.ape") returned 0 [0136.647] lstrlenA (lpString="*.ape") returned 5 [0136.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.wma") returned 0 [0136.647] lstrlenA (lpString="*.wma") returned 5 [0136.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.ac3") returned 0 [0136.647] lstrlenA (lpString="*.ac3") returned 5 [0136.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll", pszSpec="*.doc") returned 0 [0136.647] lstrlenA (lpString="*.doc") returned 5 [0136.647] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c069eef, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4c069eef, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4c069eef, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.647] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.647] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux") returned -1 [0136.647] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux") returned -1 [0136.647] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux") returned -1 [0136.647] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll") returned="Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll" [0136.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\" [0136.647] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\") returned="" [0136.647] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\HOW TO DECRYPT FILES.txt" [0136.647] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\how to decrypt files.txt")) returned 0x20 [0136.647] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux" [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.648] lstrlenA (lpString="*.zip") returned 5 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.648] lstrlenA (lpString="*.rar") returned 5 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.648] lstrlenA (lpString="*.7z") returned 4 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.648] lstrlenA (lpString="*.tar") returned 5 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.648] lstrlenA (lpString="*.gzip") returned 6 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.648] lstrlenA (lpString="*.jpg") returned 5 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.648] lstrlenA (lpString="*.jpeg") returned 6 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.648] lstrlenA (lpString="*.psd") returned 5 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.648] lstrlenA (lpString="*.cdr") returned 5 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.648] lstrlenA (lpString="*.dwg") returned 5 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.max") returned 0 [0136.648] lstrlenA (lpString="*.max") returned 5 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.648] lstrlenA (lpString="*.bmp") returned 5 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.648] lstrlenA (lpString="*.gif") returned 5 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.png") returned 0 [0136.648] lstrlenA (lpString="*.png") returned 5 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.648] lstrlenA (lpString="*.doc") returned 5 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.648] lstrlenA (lpString="*.docx") returned 6 [0136.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.649] lstrlenA (lpString="*.xls") returned 5 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.649] lstrlenA (lpString="*.xlsx") returned 6 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.649] lstrlenA (lpString="*.ppt") returned 5 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.649] lstrlenA (lpString="*.pptx") returned 6 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.649] lstrlenA (lpString="*.txt") returned 5 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.649] lstrlenA (lpString="*.pdf") returned 5 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.649] lstrlenA (lpString="*.djvu") returned 6 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.649] lstrlenA (lpString="*.htm") returned 5 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.html") returned 0 [0136.649] lstrlenA (lpString="*.html") returned 6 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.649] lstrlenA (lpString="*.mdb") returned 5 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.649] lstrlenA (lpString="*.cer") returned 5 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.649] lstrlenA (lpString="*.p12") returned 5 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.649] lstrlenA (lpString="*.pfx") returned 5 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.649] lstrlenA (lpString="*.kwm") returned 5 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.649] lstrlenA (lpString="*.pwm") returned 5 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.649] lstrlenA (lpString="*.1cd") returned 5 [0136.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.md") returned 0 [0136.649] lstrlenA (lpString="*.md") returned 4 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.650] lstrlenA (lpString="*.mdf") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.650] lstrlenA (lpString="*.dbf") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.650] lstrlenA (lpString="*.odt") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.650] lstrlenA (lpString="*.vob") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.650] lstrlenA (lpString="*.ifo") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.650] lstrlenA (lpString="*.lnk") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.650] lstrlenA (lpString="*.torrent") returned 9 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.650] lstrlenA (lpString="*.mov") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.650] lstrlenA (lpString="*.m2v") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.650] lstrlenA (lpString="*.3gp") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.650] lstrlenA (lpString="*.mpeg") returned 6 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.650] lstrlenA (lpString="*.mpg") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.650] lstrlenA (lpString="*.flv") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.650] lstrlenA (lpString="*.avi") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.650] lstrlenA (lpString="*.mp4") returned 5 [0136.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.650] lstrlenA (lpString="*.wmv") returned 5 [0136.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.651] lstrlenA (lpString="*.divx") returned 6 [0136.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.651] lstrlenA (lpString="*.mkv") returned 5 [0136.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.651] lstrlenA (lpString="*.mp3") returned 5 [0136.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.651] lstrlenA (lpString="*.wav") returned 5 [0136.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.651] lstrlenA (lpString="*.flac") returned 6 [0136.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.651] lstrlenA (lpString="*.ape") returned 5 [0136.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.651] lstrlenA (lpString="*.wma") returned 5 [0136.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.651] lstrlenA (lpString="*.ac3") returned 5 [0136.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\82b8b9ebb7d53fad94d93af6a25f7154\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.651] lstrlenA (lpString="*.doc") returned 5 [0136.651] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c069eef, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4c069eef, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4c069eef, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.651] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0136.652] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c069eef, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4c069eef, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4c069eef, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="82b8b9ebb7d53fad94d93af6a25f7154", cAlternateFileName="82B8B9~1")) returned 0 [0136.652] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.652] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x457ed5e4, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x457ed5e4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x457ed5e4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c616e72, dwReserved1=0x2e696e2e, cFileName="Microsoft.V883708cb#", cAlternateFileName="MICROS~1.V88")) returned 1 [0136.669] lstrcmpA (lpString1=".", lpString2="Microsoft.V883708cb#") returned -1 [0136.669] lstrcmpA (lpString1="..", lpString2="Microsoft.V883708cb#") returned -1 [0136.669] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.669] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.V883708cb#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#" [0136.669] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#") returned 67 [0136.669] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x457ed5e4, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x457ed5e4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x457ed5e4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759fd0 [0136.670] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.670] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x457ed5e4, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x457ed5e4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x457ed5e4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.670] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.670] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.670] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x457ed5e4, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x457ed5e4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x457ed5e4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="f344ea14f412f9ee3239447c62d53181", cAlternateFileName="F344EA~1")) returned 1 [0136.670] lstrcmpA (lpString1=".", lpString2="f344ea14f412f9ee3239447c62d53181") returned -1 [0136.670] lstrcmpA (lpString1="..", lpString2="f344ea14f412f9ee3239447c62d53181") returned -1 [0136.671] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\*.*") returned="*.*" [0136.671] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\", lpString2="f344ea14f412f9ee3239447c62d53181" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181" [0136.671] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181") returned 100 [0136.671] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x457ed5e4, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x457ed5e4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x457ed5e4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0136.672] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.672] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x457ed5e4, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x457ed5e4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x457ed5e4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.672] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.672] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.672] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457c738b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x457c738b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x457ed5e4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x27a00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.672] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.672] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll") returned -1 [0136.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll") returned -1 [0136.672] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll") returned -1 [0136.673] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\*.*") returned="*.*" [0136.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\" [0136.673] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\") returned="" [0136.673] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\HOW TO DECRYPT FILES.txt" [0136.673] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v883708cb#\\f344ea14f412f9ee3239447c62d53181\\how to decrypt files.txt")) returned 0xffffffff [0136.673] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v883708cb#\\f344ea14f412f9ee3239447c62d53181\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.674] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.674] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.675] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.675] CloseHandle (hObject=0x214) returned 1 [0136.675] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll" [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.zip") returned 0 [0136.676] lstrlenA (lpString="*.zip") returned 5 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.rar") returned 0 [0136.676] lstrlenA (lpString="*.rar") returned 5 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.7z") returned 0 [0136.676] lstrlenA (lpString="*.7z") returned 4 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.tar") returned 0 [0136.676] lstrlenA (lpString="*.tar") returned 5 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.gzip") returned 0 [0136.676] lstrlenA (lpString="*.gzip") returned 6 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.jpg") returned 0 [0136.676] lstrlenA (lpString="*.jpg") returned 5 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.jpeg") returned 0 [0136.676] lstrlenA (lpString="*.jpeg") returned 6 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.psd") returned 0 [0136.676] lstrlenA (lpString="*.psd") returned 5 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.cdr") returned 0 [0136.676] lstrlenA (lpString="*.cdr") returned 5 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.dwg") returned 0 [0136.676] lstrlenA (lpString="*.dwg") returned 5 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.max") returned 0 [0136.676] lstrlenA (lpString="*.max") returned 5 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.bmp") returned 0 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.gif") returned 0 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.png") returned 0 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.doc") returned 0 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.docx") returned 0 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.xls") returned 0 [0136.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.xlsx") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.ppt") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.pptx") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.txt") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.pdf") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.djvu") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.htm") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.html") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.mdb") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.cer") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.p12") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.pfx") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.kwm") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.pwm") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.1cd") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.md") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.mdf") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.dbf") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.odt") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.vob") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.ifo") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.lnk") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.torrent") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.mov") returned 0 [0136.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.m2v") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.3gp") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.mpeg") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.mpg") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.flv") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.avi") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.mp4") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.wmv") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.divx") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.mkv") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.mp3") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.wav") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.flac") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.ape") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.wma") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.ac3") returned 0 [0136.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll", pszSpec="*.doc") returned 0 [0136.678] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457ed5e4, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x457ed5e4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x457ed5e4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.678] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.678] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux") returned -1 [0136.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux") returned -1 [0136.678] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux") returned -1 [0136.678] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll") returned="Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll" [0136.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\" [0136.678] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\") returned="" [0136.678] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\HOW TO DECRYPT FILES.txt" [0136.679] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v883708cb#\\f344ea14f412f9ee3239447c62d53181\\how to decrypt files.txt")) returned 0x20 [0136.679] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux" [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.max") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.png") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.html") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.md") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\f344ea14f412f9ee3239447c62d53181\\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.681] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457ed5e4, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x457ed5e4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x457ed5e4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.681] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0136.682] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x457ed5e4, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x457ed5e4, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x457ed5e4, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="f344ea14f412f9ee3239447c62d53181", cAlternateFileName="F344EA~1")) returned 0 [0136.682] FindClose (in: hFindFile=0x759fd0 | out: hFindFile=0x759fd0) returned 1 [0136.682] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb84d194b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7aa972f9, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7aa972f9, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696e2e65, dwReserved1=0x6c6c642e, cFileName="Microsoft.V9921e851#", cAlternateFileName="MICROS~1.V99")) returned 1 [0136.682] lstrcmpA (lpString1=".", lpString2="Microsoft.V9921e851#") returned -1 [0136.682] lstrcmpA (lpString1="..", lpString2="Microsoft.V9921e851#") returned -1 [0136.682] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.682] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.V9921e851#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#" [0136.682] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb84d194b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7aa972f9, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7aa972f9, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.683] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.683] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb84d194b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7aa972f9, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7aa972f9, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.683] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.683] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.683] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41b3a54d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x41b3a54d, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x41b3a54d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10bb07da5742be6a733d85ff7cce1a41", cAlternateFileName="10BB07~1")) returned 1 [0136.685] lstrcmpA (lpString1=".", lpString2="10bb07da5742be6a733d85ff7cce1a41") returned -1 [0136.685] lstrcmpA (lpString1="..", lpString2="10bb07da5742be6a733d85ff7cce1a41") returned -1 [0136.685] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\*.*") returned="*.*" [0136.685] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\", lpString2="10bb07da5742be6a733d85ff7cce1a41" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41" [0136.685] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41b3a54d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x41b3a54d, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x41b3a54d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0136.687] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.687] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41b3a54d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x41b3a54d, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x41b3a54d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.687] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.687] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.687] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b14300, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x41b14300, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x41b607a3, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x214e00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.VisualBasic.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.687] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.687] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.ni.dll") returned -1 [0136.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.ni.dll") returned -1 [0136.688] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.ni.dll") returned -1 [0136.688] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\*.*") returned="*.*" [0136.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\" [0136.688] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\") returned="" [0136.688] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\HOW TO DECRYPT FILES.txt" [0136.688] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\how to decrypt files.txt")) returned 0xffffffff [0136.688] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.689] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.690] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.690] CloseHandle (hObject=0x214) returned 1 [0136.690] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\", lpString2="Microsoft.VisualBasic.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll" [0136.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.zip") returned 0 [0136.690] lstrlenA (lpString="*.zip") returned 5 [0136.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.rar") returned 0 [0136.690] lstrlenA (lpString="*.rar") returned 5 [0136.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.7z") returned 0 [0136.690] lstrlenA (lpString="*.7z") returned 4 [0136.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.tar") returned 0 [0136.690] lstrlenA (lpString="*.tar") returned 5 [0136.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.gzip") returned 0 [0136.690] lstrlenA (lpString="*.gzip") returned 6 [0136.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.jpg") returned 0 [0136.690] lstrlenA (lpString="*.jpg") returned 5 [0136.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.jpeg") returned 0 [0136.690] lstrlenA (lpString="*.jpeg") returned 6 [0136.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.psd") returned 0 [0136.690] lstrlenA (lpString="*.psd") returned 5 [0136.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.cdr") returned 0 [0136.690] lstrlenA (lpString="*.cdr") returned 5 [0136.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.dwg") returned 0 [0136.691] lstrlenA (lpString="*.dwg") returned 5 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.max") returned 0 [0136.691] lstrlenA (lpString="*.max") returned 5 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.bmp") returned 0 [0136.691] lstrlenA (lpString="*.bmp") returned 5 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.gif") returned 0 [0136.691] lstrlenA (lpString="*.gif") returned 5 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.png") returned 0 [0136.691] lstrlenA (lpString="*.png") returned 5 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.doc") returned 0 [0136.691] lstrlenA (lpString="*.doc") returned 5 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.docx") returned 0 [0136.691] lstrlenA (lpString="*.docx") returned 6 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.xls") returned 0 [0136.691] lstrlenA (lpString="*.xls") returned 5 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.xlsx") returned 0 [0136.691] lstrlenA (lpString="*.xlsx") returned 6 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.ppt") returned 0 [0136.691] lstrlenA (lpString="*.ppt") returned 5 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.pptx") returned 0 [0136.691] lstrlenA (lpString="*.pptx") returned 6 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.txt") returned 0 [0136.691] lstrlenA (lpString="*.txt") returned 5 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.pdf") returned 0 [0136.691] lstrlenA (lpString="*.pdf") returned 5 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.djvu") returned 0 [0136.691] lstrlenA (lpString="*.djvu") returned 6 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.htm") returned 0 [0136.691] lstrlenA (lpString="*.htm") returned 5 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.html") returned 0 [0136.691] lstrlenA (lpString="*.html") returned 6 [0136.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mdb") returned 0 [0136.691] lstrlenA (lpString="*.mdb") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.cer") returned 0 [0136.692] lstrlenA (lpString="*.cer") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.p12") returned 0 [0136.692] lstrlenA (lpString="*.p12") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.pfx") returned 0 [0136.692] lstrlenA (lpString="*.pfx") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.kwm") returned 0 [0136.692] lstrlenA (lpString="*.kwm") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.pwm") returned 0 [0136.692] lstrlenA (lpString="*.pwm") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.1cd") returned 0 [0136.692] lstrlenA (lpString="*.1cd") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.md") returned 0 [0136.692] lstrlenA (lpString="*.md") returned 4 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mdf") returned 0 [0136.692] lstrlenA (lpString="*.mdf") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.dbf") returned 0 [0136.692] lstrlenA (lpString="*.dbf") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.odt") returned 0 [0136.692] lstrlenA (lpString="*.odt") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.vob") returned 0 [0136.692] lstrlenA (lpString="*.vob") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.ifo") returned 0 [0136.692] lstrlenA (lpString="*.ifo") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.lnk") returned 0 [0136.692] lstrlenA (lpString="*.lnk") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.torrent") returned 0 [0136.692] lstrlenA (lpString="*.torrent") returned 9 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mov") returned 0 [0136.692] lstrlenA (lpString="*.mov") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.m2v") returned 0 [0136.692] lstrlenA (lpString="*.m2v") returned 5 [0136.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.3gp") returned 0 [0136.692] lstrlenA (lpString="*.3gp") returned 5 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mpeg") returned 0 [0136.693] lstrlenA (lpString="*.mpeg") returned 6 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mpg") returned 0 [0136.693] lstrlenA (lpString="*.mpg") returned 5 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.flv") returned 0 [0136.693] lstrlenA (lpString="*.flv") returned 5 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.avi") returned 0 [0136.693] lstrlenA (lpString="*.avi") returned 5 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mp4") returned 0 [0136.693] lstrlenA (lpString="*.mp4") returned 5 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.wmv") returned 0 [0136.693] lstrlenA (lpString="*.wmv") returned 5 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.divx") returned 0 [0136.693] lstrlenA (lpString="*.divx") returned 6 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mkv") returned 0 [0136.693] lstrlenA (lpString="*.mkv") returned 5 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mp3") returned 0 [0136.693] lstrlenA (lpString="*.mp3") returned 5 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.wav") returned 0 [0136.693] lstrlenA (lpString="*.wav") returned 5 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.flac") returned 0 [0136.693] lstrlenA (lpString="*.flac") returned 6 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.ape") returned 0 [0136.693] lstrlenA (lpString="*.ape") returned 5 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.wma") returned 0 [0136.693] lstrlenA (lpString="*.wma") returned 5 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.ac3") returned 0 [0136.693] lstrlenA (lpString="*.ac3") returned 5 [0136.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll", pszSpec="*.doc") returned 0 [0136.693] lstrlenA (lpString="*.doc") returned 5 [0136.693] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b3a54d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x41b3a54d, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x41b3a54d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x6ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.693] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.693] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.ni.dll.aux") returned -1 [0136.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.ni.dll.aux") returned -1 [0136.694] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.ni.dll.aux") returned -1 [0136.694] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll") returned="Microsoft.VisualBasic.ni.dll" [0136.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\" [0136.694] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\") returned="" [0136.694] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\HOW TO DECRYPT FILES.txt" [0136.694] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.v9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\how to decrypt files.txt")) returned 0x20 [0136.694] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\", lpString2="Microsoft.VisualBasic.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux" [0136.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.694] lstrlenA (lpString="*.zip") returned 5 [0136.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.694] lstrlenA (lpString="*.rar") returned 5 [0136.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.694] lstrlenA (lpString="*.7z") returned 4 [0136.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.694] lstrlenA (lpString="*.tar") returned 5 [0136.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.694] lstrlenA (lpString="*.gzip") returned 6 [0136.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.694] lstrlenA (lpString="*.jpg") returned 5 [0136.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.694] lstrlenA (lpString="*.jpeg") returned 6 [0136.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.694] lstrlenA (lpString="*.psd") returned 5 [0136.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.694] lstrlenA (lpString="*.cdr") returned 5 [0136.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.694] lstrlenA (lpString="*.dwg") returned 5 [0136.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.max") returned 0 [0136.694] lstrlenA (lpString="*.max") returned 5 [0136.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.695] lstrlenA (lpString="*.bmp") returned 5 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.695] lstrlenA (lpString="*.gif") returned 5 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.png") returned 0 [0136.695] lstrlenA (lpString="*.png") returned 5 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.695] lstrlenA (lpString="*.doc") returned 5 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.695] lstrlenA (lpString="*.docx") returned 6 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.695] lstrlenA (lpString="*.xls") returned 5 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.695] lstrlenA (lpString="*.xlsx") returned 6 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.695] lstrlenA (lpString="*.ppt") returned 5 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.695] lstrlenA (lpString="*.pptx") returned 6 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.695] lstrlenA (lpString="*.txt") returned 5 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.695] lstrlenA (lpString="*.pdf") returned 5 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.695] lstrlenA (lpString="*.djvu") returned 6 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.695] lstrlenA (lpString="*.htm") returned 5 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.html") returned 0 [0136.695] lstrlenA (lpString="*.html") returned 6 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.695] lstrlenA (lpString="*.mdb") returned 5 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.695] lstrlenA (lpString="*.cer") returned 5 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.695] lstrlenA (lpString="*.p12") returned 5 [0136.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.696] lstrlenA (lpString="*.pfx") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.696] lstrlenA (lpString="*.kwm") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.696] lstrlenA (lpString="*.pwm") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.696] lstrlenA (lpString="*.1cd") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.md") returned 0 [0136.696] lstrlenA (lpString="*.md") returned 4 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.696] lstrlenA (lpString="*.mdf") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.696] lstrlenA (lpString="*.dbf") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.696] lstrlenA (lpString="*.odt") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.696] lstrlenA (lpString="*.vob") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.696] lstrlenA (lpString="*.ifo") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.696] lstrlenA (lpString="*.lnk") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.696] lstrlenA (lpString="*.torrent") returned 9 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.696] lstrlenA (lpString="*.mov") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.696] lstrlenA (lpString="*.m2v") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.696] lstrlenA (lpString="*.3gp") returned 5 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.696] lstrlenA (lpString="*.mpeg") returned 6 [0136.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.696] lstrlenA (lpString="*.mpg") returned 5 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.697] lstrlenA (lpString="*.flv") returned 5 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.697] lstrlenA (lpString="*.avi") returned 5 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.697] lstrlenA (lpString="*.mp4") returned 5 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.697] lstrlenA (lpString="*.wmv") returned 5 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.697] lstrlenA (lpString="*.divx") returned 6 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.697] lstrlenA (lpString="*.mkv") returned 5 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.697] lstrlenA (lpString="*.mp3") returned 5 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.697] lstrlenA (lpString="*.wav") returned 5 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.697] lstrlenA (lpString="*.flac") returned 6 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.697] lstrlenA (lpString="*.ape") returned 5 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.697] lstrlenA (lpString="*.wma") returned 5 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.697] lstrlenA (lpString="*.ac3") returned 5 [0136.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\10bb07da5742be6a733d85ff7cce1a41\\Microsoft.VisualBasic.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.697] lstrlenA (lpString="*.doc") returned 5 [0136.723] lstrcmpA (lpString1=".", lpString2="Microsoft.Vf4833439#") returned -1 [0136.724] lstrcmpA (lpString1="..", lpString2="Microsoft.Vf4833439#") returned -1 [0136.724] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.724] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Vf4833439#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#" [0136.724] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#") returned 67 [0136.724] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x204e6a9d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x204e6a9d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x204e6a9d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0136.724] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.724] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.724] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.724] lstrcmpA (lpString1=".", lpString2="4e4c1663eb3bd48230a6d4b8d928800d") returned -1 [0136.724] lstrcmpA (lpString1="..", lpString2="4e4c1663eb3bd48230a6d4b8d928800d") returned -1 [0136.724] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\*.*") returned="*.*" [0136.724] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\", lpString2="4e4c1663eb3bd48230a6d4b8d928800d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d" [0136.724] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d") returned 100 [0136.724] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x204e6a9d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x204e6a9d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x204e6a9d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0136.726] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.726] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.726] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.726] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.Activities.Compiler.ni.dll") returned -1 [0136.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.Activities.Compiler.ni.dll") returned -1 [0136.726] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.Activities.Compiler.ni.dll") returned -1 [0136.726] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\*.*") returned="*.*" [0136.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\" [0136.726] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\") returned="" [0136.726] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\HOW TO DECRYPT FILES.txt" [0136.726] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\how to decrypt files.txt")) returned 0xffffffff [0136.726] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.727] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.727] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.728] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.728] CloseHandle (hObject=0x214) returned 1 [0136.729] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\", lpString2="Microsoft.VisualBasic.Activities.Compiler.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll" [0136.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.zip") returned 0 [0136.729] lstrlenA (lpString="*.zip") returned 5 [0136.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.rar") returned 0 [0136.729] lstrlenA (lpString="*.rar") returned 5 [0136.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.7z") returned 0 [0136.729] lstrlenA (lpString="*.7z") returned 4 [0136.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.tar") returned 0 [0136.729] lstrlenA (lpString="*.tar") returned 5 [0136.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.gzip") returned 0 [0136.729] lstrlenA (lpString="*.gzip") returned 6 [0136.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.jpg") returned 0 [0136.729] lstrlenA (lpString="*.jpg") returned 5 [0136.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.jpeg") returned 0 [0136.729] lstrlenA (lpString="*.jpeg") returned 6 [0136.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.psd") returned 0 [0136.729] lstrlenA (lpString="*.psd") returned 5 [0136.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.cdr") returned 0 [0136.729] lstrlenA (lpString="*.cdr") returned 5 [0136.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.dwg") returned 0 [0136.729] lstrlenA (lpString="*.dwg") returned 5 [0136.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.max") returned 0 [0136.730] lstrlenA (lpString="*.max") returned 5 [0136.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.bmp") returned 0 [0136.730] lstrlenA (lpString="*.bmp") returned 5 [0136.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.gif") returned 0 [0136.730] lstrlenA (lpString="*.gif") returned 5 [0136.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.png") returned 0 [0136.730] lstrlenA (lpString="*.png") returned 5 [0136.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.doc") returned 0 [0136.730] lstrlenA (lpString="*.doc") returned 5 [0136.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.docx") returned 0 [0136.730] lstrlenA (lpString="*.docx") returned 6 [0136.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll", pszSpec="*.xls") returned 0 [0136.730] lstrlenA (lpString="*.xls") returned 5 [0136.731] lstrlenA (lpString="*.xlsx") returned 6 [0136.731] lstrlenA (lpString="*.ppt") returned 5 [0136.731] lstrlenA (lpString="*.pptx") returned 6 [0136.731] lstrlenA (lpString="*.txt") returned 5 [0136.731] lstrlenA (lpString="*.pdf") returned 5 [0136.731] lstrlenA (lpString="*.djvu") returned 6 [0136.731] lstrlenA (lpString="*.htm") returned 5 [0136.731] lstrlenA (lpString="*.html") returned 6 [0136.731] lstrlenA (lpString="*.mdb") returned 5 [0136.731] lstrlenA (lpString="*.cer") returned 5 [0136.731] lstrlenA (lpString="*.p12") returned 5 [0136.731] lstrlenA (lpString="*.pfx") returned 5 [0136.731] lstrlenA (lpString="*.kwm") returned 5 [0136.731] lstrlenA (lpString="*.pwm") returned 5 [0136.731] lstrlenA (lpString="*.1cd") returned 5 [0136.731] lstrlenA (lpString="*.md") returned 4 [0136.732] lstrlenA (lpString="*.mdf") returned 5 [0136.732] lstrlenA (lpString="*.dbf") returned 5 [0136.732] lstrlenA (lpString="*.odt") returned 5 [0136.732] lstrlenA (lpString="*.vob") returned 5 [0136.732] lstrlenA (lpString="*.ifo") returned 5 [0136.732] lstrlenA (lpString="*.lnk") returned 5 [0136.732] lstrlenA (lpString="*.torrent") returned 9 [0136.732] lstrlenA (lpString="*.mov") returned 5 [0136.732] lstrlenA (lpString="*.m2v") returned 5 [0136.732] lstrlenA (lpString="*.3gp") returned 5 [0136.732] lstrlenA (lpString="*.mpeg") returned 6 [0136.732] lstrlenA (lpString="*.mpg") returned 5 [0136.732] lstrlenA (lpString="*.flv") returned 5 [0136.732] lstrlenA (lpString="*.avi") returned 5 [0136.732] lstrlenA (lpString="*.mp4") returned 5 [0136.732] lstrlenA (lpString="*.wmv") returned 5 [0136.732] lstrlenA (lpString="*.divx") returned 6 [0136.732] lstrlenA (lpString="*.mkv") returned 5 [0136.732] lstrlenA (lpString="*.mp3") returned 5 [0136.732] lstrlenA (lpString="*.wav") returned 5 [0136.732] lstrlenA (lpString="*.flac") returned 6 [0136.732] lstrlenA (lpString="*.ape") returned 5 [0136.732] lstrlenA (lpString="*.wma") returned 5 [0136.732] lstrlenA (lpString="*.ac3") returned 5 [0136.732] lstrlenA (lpString="*.doc") returned 5 [0136.733] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.Activities.Compiler.ni.dll.aux") returned -1 [0136.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.Activities.Compiler.ni.dll.aux") returned -1 [0136.733] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.Activities.Compiler.ni.dll.aux") returned -1 [0136.733] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll") returned="Microsoft.VisualBasic.Activities.Compiler.ni.dll" [0136.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\" [0136.733] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\") returned="" [0136.733] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\HOW TO DECRYPT FILES.txt" [0136.733] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\how to decrypt files.txt")) returned 0x20 [0136.733] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\", lpString2="Microsoft.VisualBasic.Activities.Compiler.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\4e4c1663eb3bd48230a6d4b8d928800d\\Microsoft.VisualBasic.Activities.Compiler.ni.dll.aux" [0136.733] lstrlenA (lpString="*.zip") returned 5 [0136.733] lstrlenA (lpString="*.rar") returned 5 [0136.733] lstrlenA (lpString="*.7z") returned 4 [0136.733] lstrlenA (lpString="*.tar") returned 5 [0136.733] lstrlenA (lpString="*.gzip") returned 6 [0136.733] lstrlenA (lpString="*.jpg") returned 5 [0136.733] lstrlenA (lpString="*.jpeg") returned 6 [0136.733] lstrlenA (lpString="*.psd") returned 5 [0136.733] lstrlenA (lpString="*.cdr") returned 5 [0136.733] lstrlenA (lpString="*.dwg") returned 5 [0136.733] lstrlenA (lpString="*.max") returned 5 [0136.733] lstrlenA (lpString="*.bmp") returned 5 [0136.733] lstrlenA (lpString="*.gif") returned 5 [0136.734] lstrlenA (lpString="*.png") returned 5 [0136.734] lstrlenA (lpString="*.doc") returned 5 [0136.734] lstrlenA (lpString="*.docx") returned 6 [0136.734] lstrlenA (lpString="*.xls") returned 5 [0136.734] lstrlenA (lpString="*.xlsx") returned 6 [0136.734] lstrlenA (lpString="*.ppt") returned 5 [0136.734] lstrlenA (lpString="*.pptx") returned 6 [0136.734] lstrlenA (lpString="*.txt") returned 5 [0136.734] lstrlenA (lpString="*.pdf") returned 5 [0136.734] lstrlenA (lpString="*.djvu") returned 6 [0136.734] lstrlenA (lpString="*.htm") returned 5 [0136.734] lstrlenA (lpString="*.html") returned 6 [0136.734] lstrlenA (lpString="*.mdb") returned 5 [0136.734] lstrlenA (lpString="*.cer") returned 5 [0136.734] lstrlenA (lpString="*.p12") returned 5 [0136.734] lstrlenA (lpString="*.pfx") returned 5 [0136.734] lstrlenA (lpString="*.kwm") returned 5 [0136.734] lstrlenA (lpString="*.pwm") returned 5 [0136.734] lstrlenA (lpString="*.1cd") returned 5 [0136.734] lstrlenA (lpString="*.md") returned 4 [0136.734] lstrlenA (lpString="*.mdf") returned 5 [0136.734] lstrlenA (lpString="*.dbf") returned 5 [0136.734] lstrlenA (lpString="*.odt") returned 5 [0136.734] lstrlenA (lpString="*.vob") returned 5 [0136.735] lstrlenA (lpString="*.ifo") returned 5 [0136.735] lstrlenA (lpString="*.lnk") returned 5 [0136.735] lstrlenA (lpString="*.torrent") returned 9 [0136.735] lstrlenA (lpString="*.mov") returned 5 [0136.735] lstrlenA (lpString="*.m2v") returned 5 [0136.735] lstrlenA (lpString="*.3gp") returned 5 [0136.735] lstrlenA (lpString="*.mpeg") returned 6 [0136.735] lstrlenA (lpString="*.mpg") returned 5 [0136.735] lstrlenA (lpString="*.flv") returned 5 [0136.735] lstrlenA (lpString="*.avi") returned 5 [0136.735] lstrlenA (lpString="*.mp4") returned 5 [0136.735] lstrlenA (lpString="*.wmv") returned 5 [0136.735] lstrlenA (lpString="*.divx") returned 6 [0136.735] lstrlenA (lpString="*.mkv") returned 5 [0136.735] lstrlenA (lpString="*.mp3") returned 5 [0136.735] lstrlenA (lpString="*.wav") returned 5 [0136.735] lstrlenA (lpString="*.flac") returned 6 [0136.735] lstrlenA (lpString="*.ape") returned 5 [0136.735] lstrlenA (lpString="*.wma") returned 5 [0136.735] lstrlenA (lpString="*.ac3") returned 5 [0136.735] lstrlenA (lpString="*.doc") returned 5 [0136.735] lstrcmpA (lpString1=".", lpString2="Microsoft.Vf9a08577#") returned -1 [0136.735] lstrcmpA (lpString1="..", lpString2="Microsoft.Vf9a08577#") returned -1 [0136.736] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.736] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Vf9a08577#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#" [0136.736] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#") returned 67 [0136.736] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4556dc24, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x45570347, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x45570347, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.737] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.737] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.737] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.737] lstrcmpA (lpString1=".", lpString2="354bd5d57478acdd44e4870e7aedf0a4") returned -1 [0136.737] lstrcmpA (lpString1="..", lpString2="354bd5d57478acdd44e4870e7aedf0a4") returned -1 [0136.737] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\*.*") returned="*.*" [0136.737] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\", lpString2="354bd5d57478acdd44e4870e7aedf0a4" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4" [0136.737] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4") returned 100 [0136.737] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45570347, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x45579f98, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x45579f98, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.738] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.738] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.738] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.738] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll") returned -1 [0136.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll") returned -1 [0136.739] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll") returned -1 [0136.739] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\*.*") returned="*.*" [0136.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\" [0136.739] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\") returned="" [0136.739] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\HOW TO DECRYPT FILES.txt" [0136.739] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\how to decrypt files.txt")) returned 0xffffffff [0136.739] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.740] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.740] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.742] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.742] CloseHandle (hObject=0x214) returned 1 [0136.743] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll" [0136.743] lstrlenA (lpString="*.zip") returned 5 [0136.743] lstrlenA (lpString="*.rar") returned 5 [0136.743] lstrlenA (lpString="*.7z") returned 4 [0136.743] lstrlenA (lpString="*.tar") returned 5 [0136.743] lstrlenA (lpString="*.gzip") returned 6 [0136.743] lstrlenA (lpString="*.jpg") returned 5 [0136.743] lstrlenA (lpString="*.jpeg") returned 6 [0136.743] lstrlenA (lpString="*.psd") returned 5 [0136.743] lstrlenA (lpString="*.cdr") returned 5 [0136.743] lstrlenA (lpString="*.dwg") returned 5 [0136.743] lstrlenA (lpString="*.max") returned 5 [0136.743] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll.aux") returned -1 [0136.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll.aux") returned -1 [0136.743] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll.aux") returned -1 [0136.743] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll") returned="Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll" [0136.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\" [0136.743] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\") returned="" [0136.743] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\HOW TO DECRYPT FILES.txt" [0136.743] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\how to decrypt files.txt")) returned 0x20 [0136.744] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\354bd5d57478acdd44e4870e7aedf0a4\\Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll.aux" [0136.744] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.744] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Vff41975e#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#" [0136.747] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\*.*") returned="*.*" [0136.747] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\", lpString2="c1ca638e2fdfbff66e5ebfdc39f086f6" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6" [0136.750] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.750] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll") returned -1 [0136.750] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll") returned -1 [0136.750] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll") returned -1 [0136.750] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\*.*") returned="*.*" [0136.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\" [0136.750] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\") returned="" [0136.750] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\HOW TO DECRYPT FILES.txt" [0136.750] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\how to decrypt files.txt")) returned 0xffffffff [0136.750] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.752] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.753] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.753] CloseHandle (hObject=0x214) returned 1 [0136.753] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll" [0136.753] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.760] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll.aux") returned -1 [0136.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll.aux") returned -1 [0136.760] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll.aux") returned -1 [0136.760] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll") returned="Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll" [0136.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\" [0136.760] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\") returned="" [0136.760] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\HOW TO DECRYPT FILES.txt" [0136.760] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\how to decrypt files.txt")) returned 0x20 [0136.760] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\c1ca638e2fdfbff66e5ebfdc39f086f6\\Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll.aux" [0136.760] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.760] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.VisualC" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC" [0136.761] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\*.*") returned="*.*" [0136.761] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\", lpString2="b2cc41275b19a1e96f22164d906a4152" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152" [0136.764] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualC.ni.dll") returned -1 [0136.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualC.ni.dll") returned -1 [0136.764] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualC.ni.dll") returned -1 [0136.764] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\*.*") returned="*.*" [0136.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\" [0136.765] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\") returned="" [0136.765] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\HOW TO DECRYPT FILES.txt" [0136.765] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.visualc\\b2cc41275b19a1e96f22164d906a4152\\how to decrypt files.txt")) returned 0xffffffff [0136.765] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.visualc\\b2cc41275b19a1e96f22164d906a4152\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.767] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.768] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.768] CloseHandle (hObject=0x214) returned 1 [0136.768] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\", lpString2="Microsoft.VisualC.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\Microsoft.VisualC.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\Microsoft.VisualC.ni.dll" [0136.769] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.769] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualC.ni.dll.aux") returned -1 [0136.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualC.ni.dll.aux") returned -1 [0136.769] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualC.ni.dll.aux") returned -1 [0136.769] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\Microsoft.VisualC.ni.dll") returned="Microsoft.VisualC.ni.dll" [0136.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\" [0136.769] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\") returned="" [0136.769] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\HOW TO DECRYPT FILES.txt" [0136.769] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.visualc\\b2cc41275b19a1e96f22164d906a4152\\how to decrypt files.txt")) returned 0x20 [0136.769] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\", lpString2="Microsoft.VisualC.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\Microsoft.VisualC.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\b2cc41275b19a1e96f22164d906a4152\\Microsoft.VisualC.ni.dll.aux" [0136.769] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.769] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.W0bb5dac4#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#" [0136.769] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\*.*") returned="*.*" [0136.769] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\", lpString2="96e3580fae66b66d66fc96ff12b2b688" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688" [0136.771] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.771] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned -1 [0136.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned -1 [0136.771] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned -1 [0136.771] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\*.*") returned="*.*" [0136.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\" [0136.771] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\") returned="" [0136.772] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\HOW TO DECRYPT FILES.txt" [0136.772] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\how to decrypt files.txt")) returned 0xffffffff [0136.772] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.773] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.773] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.774] CloseHandle (hObject=0x214) returned 1 [0136.774] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll" [0136.774] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll.aux") returned -1 [0136.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll.aux") returned -1 [0136.774] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll.aux") returned -1 [0136.774] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll" [0136.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\" [0136.774] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\") returned="" [0136.774] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\HOW TO DECRYPT FILES.txt" [0136.774] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\how to decrypt files.txt")) returned 0x20 [0136.774] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W0bb5dac4#\\96e3580fae66b66d66fc96ff12b2b688\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll.aux" [0136.775] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.775] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.W193497eb#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#" [0136.775] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\*.*") returned="*.*" [0136.775] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\", lpString2="0df20c48b8bc327b33f34c6228949e35" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35" [0136.779] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Runtime.ni.dll") returned -1 [0136.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Runtime.ni.dll") returned -1 [0136.779] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Runtime.ni.dll") returned -1 [0136.779] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\*.*") returned="*.*" [0136.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\" [0136.779] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\") returned="" [0136.779] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\HOW TO DECRYPT FILES.txt" [0136.780] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w193497eb#\\0df20c48b8bc327b33f34c6228949e35\\how to decrypt files.txt")) returned 0xffffffff [0136.780] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w193497eb#\\0df20c48b8bc327b33f34c6228949e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.781] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.781] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.782] CloseHandle (hObject=0x214) returned 1 [0136.782] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\", lpString2="Microsoft.WSMan.Runtime.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\Microsoft.WSMan.Runtime.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\Microsoft.WSMan.Runtime.ni.dll" [0136.782] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Runtime.ni.dll.aux") returned -1 [0136.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Runtime.ni.dll.aux") returned -1 [0136.782] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Runtime.ni.dll.aux") returned -1 [0136.782] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\Microsoft.WSMan.Runtime.ni.dll") returned="Microsoft.WSMan.Runtime.ni.dll" [0136.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\" [0136.782] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\") returned="" [0136.782] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\HOW TO DECRYPT FILES.txt" [0136.782] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w193497eb#\\0df20c48b8bc327b33f34c6228949e35\\how to decrypt files.txt")) returned 0x20 [0136.782] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\", lpString2="Microsoft.WSMan.Runtime.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\Microsoft.WSMan.Runtime.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W193497eb#\\0df20c48b8bc327b33f34c6228949e35\\Microsoft.WSMan.Runtime.ni.dll.aux" [0136.783] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.783] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.W2d29a719#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#" [0136.783] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\*.*") returned="*.*" [0136.783] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\", lpString2="e7c8e590b1a558f48e7f8361851b3b88" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88" [0136.785] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.DSC.CoreConfProviders.ni.dll") returned -1 [0136.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.DSC.CoreConfProviders.ni.dll") returned -1 [0136.785] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.DSC.CoreConfProviders.ni.dll") returned -1 [0136.785] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\*.*") returned="*.*" [0136.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\" [0136.785] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\") returned="" [0136.785] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\HOW TO DECRYPT FILES.txt" [0136.785] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\how to decrypt files.txt")) returned 0xffffffff [0136.785] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.786] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.787] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.787] CloseHandle (hObject=0x214) returned 1 [0136.788] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\", lpString2="Microsoft.Windows.DSC.CoreConfProviders.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\Microsoft.Windows.DSC.CoreConfProviders.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\Microsoft.Windows.DSC.CoreConfProviders.ni.dll" [0136.788] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.DSC.CoreConfProviders.ni.dll.aux") returned -1 [0136.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.DSC.CoreConfProviders.ni.dll.aux") returned -1 [0136.788] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.DSC.CoreConfProviders.ni.dll.aux") returned -1 [0136.788] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\Microsoft.Windows.DSC.CoreConfProviders.ni.dll") returned="Microsoft.Windows.DSC.CoreConfProviders.ni.dll" [0136.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\" [0136.788] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\") returned="" [0136.788] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\HOW TO DECRYPT FILES.txt" [0136.788] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\how to decrypt files.txt")) returned 0x20 [0136.788] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\", lpString2="Microsoft.Windows.DSC.CoreConfProviders.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\Microsoft.Windows.DSC.CoreConfProviders.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2d29a719#\\e7c8e590b1a558f48e7f8361851b3b88\\Microsoft.Windows.DSC.CoreConfProviders.ni.dll.aux" [0136.788] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.788] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.W2ded559f#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#" [0136.789] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\*.*") returned="*.*" [0136.789] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\", lpString2="68d06510f22ac19fe89c3dff14b3be85" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85" [0136.791] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.791] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll") returned -1 [0136.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll") returned -1 [0136.791] lstrcmpiA (lpString1="", lpString2="Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll") returned -1 [0136.791] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\*.*") returned="*.*" [0136.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\" [0136.791] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\") returned="" [0136.791] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\HOW TO DECRYPT FILES.txt" [0136.791] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\how to decrypt files.txt")) returned 0xffffffff [0136.791] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.792] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.793] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.793] CloseHandle (hObject=0x214) returned 1 [0136.793] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\", lpString2="Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll" [0136.794] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.794] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll.aux") returned -1 [0136.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll.aux") returned -1 [0136.794] lstrcmpiA (lpString1="", lpString2="Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll.aux") returned -1 [0136.794] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll") returned="Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll" [0136.794] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\" [0136.794] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\") returned="" [0136.794] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\HOW TO DECRYPT FILES.txt" [0136.794] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\how to decrypt files.txt")) returned 0x20 [0136.794] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\", lpString2="Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W2ded559f#\\68d06510f22ac19fe89c3dff14b3be85\\Microsoft.WindowsAuthenticationProtocols.Commands.ni.dll.aux" [0136.794] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.794] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.W3cdb5602#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#" [0136.794] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\*.*") returned="*.*" [0136.794] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\", lpString2="b745154370d5e1107f2d5f903971da53" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53" [0136.796] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.796] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned -1 [0136.796] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned -1 [0136.796] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned -1 [0136.796] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\*.*") returned="*.*" [0136.796] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\" [0136.796] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\") returned="" [0136.796] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\HOW TO DECRYPT FILES.txt" [0136.796] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w3cdb5602#\\b745154370d5e1107f2d5f903971da53\\how to decrypt files.txt")) returned 0xffffffff [0136.796] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w3cdb5602#\\b745154370d5e1107f2d5f903971da53\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.797] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.798] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.798] CloseHandle (hObject=0x214) returned 1 [0136.798] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll" [0136.798] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.798] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll.aux") returned -1 [0136.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll.aux") returned -1 [0136.798] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll.aux") returned -1 [0136.798] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll" [0136.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\" [0136.799] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\") returned="" [0136.799] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\HOW TO DECRYPT FILES.txt" [0136.799] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w3cdb5602#\\b745154370d5e1107f2d5f903971da53\\how to decrypt files.txt")) returned 0x20 [0136.799] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W3cdb5602#\\b745154370d5e1107f2d5f903971da53\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll.aux" [0136.799] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.799] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.W69ef49d2#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#" [0136.800] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\*.*") returned="*.*" [0136.800] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\", lpString2="0ebf00fce74fdd9f57747d9af042784c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c" [0136.828] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.828] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned -1 [0136.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned -1 [0136.828] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned -1 [0136.828] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\*.*") returned="*.*" [0136.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\" [0136.828] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\") returned="" [0136.829] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\HOW TO DECRYPT FILES.txt" [0136.829] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\how to decrypt files.txt")) returned 0xffffffff [0136.829] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.830] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.831] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.831] CloseHandle (hObject=0x214) returned 1 [0136.831] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll" [0136.831] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.831] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll.aux") returned -1 [0136.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll.aux") returned -1 [0136.831] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll.aux") returned -1 [0136.832] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll" [0136.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\" [0136.832] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\") returned="" [0136.832] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\HOW TO DECRYPT FILES.txt" [0136.832] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\how to decrypt files.txt")) returned 0x20 [0136.832] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W69ef49d2#\\0ebf00fce74fdd9f57747d9af042784c\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll.aux" [0136.832] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.832] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.W708fc392#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#" [0136.832] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\*.*") returned="*.*" [0136.832] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\", lpString2="f97ec0aa920c6f85f5ac48d876941d71" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71" [0136.834] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.834] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\*.*") returned="*.*" [0136.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\" [0136.834] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\") returned="" [0136.834] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\HOW TO DECRYPT FILES.txt" [0136.834] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\how to decrypt files.txt")) returned 0xffffffff [0136.835] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.836] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.837] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.837] CloseHandle (hObject=0x214) returned 1 [0136.837] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll" [0136.837] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.837] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll") returned="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll" [0136.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\" [0136.837] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\") returned="" [0136.838] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\HOW TO DECRYPT FILES.txt" [0136.838] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\how to decrypt files.txt")) returned 0x20 [0136.838] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W708fc392#\\f97ec0aa920c6f85f5ac48d876941d71\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll.aux" [0136.838] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.838] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.W79a81d80#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#" [0136.854] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.854] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.854] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.854] lstrcmpA (lpString1=".", lpString2="3eb17ef8c3809ddc7142d56bdcdad58b") returned -1 [0136.854] lstrcmpA (lpString1="..", lpString2="3eb17ef8c3809ddc7142d56bdcdad58b") returned -1 [0136.854] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\*.*") returned="*.*" [0136.854] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\", lpString2="3eb17ef8c3809ddc7142d56bdcdad58b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b" [0136.856] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.856] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\*.*") returned="*.*" [0136.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\" [0136.856] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\") returned="" [0136.856] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\HOW TO DECRYPT FILES.txt" [0136.857] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\how to decrypt files.txt")) returned 0xffffffff [0136.857] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.858] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.859] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.860] CloseHandle (hObject=0x214) returned 1 [0136.860] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll" [0136.860] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.860] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll") returned="Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll" [0136.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\" [0136.860] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\") returned="" [0136.860] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\HOW TO DECRYPT FILES.txt" [0136.860] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\how to decrypt files.txt")) returned 0x20 [0136.860] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W79a81d80#\\3eb17ef8c3809ddc7142d56bdcdad58b\\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll.aux" [0136.861] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.861] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Wad78daf4#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#" [0136.861] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\*.*") returned="*.*" [0136.861] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\", lpString2="d6b25e0539b6066b05f7de22e8cc1a88" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88" [0136.863] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.863] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\*.*") returned="*.*" [0136.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\" [0136.863] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\") returned="" [0136.863] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\HOW TO DECRYPT FILES.txt" [0136.863] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\how to decrypt files.txt")) returned 0xffffffff [0136.863] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.864] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.865] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.865] CloseHandle (hObject=0x214) returned 1 [0136.865] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\", lpString2="Microsoft.Windows.Diagnosis.SDHost.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\Microsoft.Windows.Diagnosis.SDHost.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\Microsoft.Windows.Diagnosis.SDHost.ni.dll" [0136.866] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.866] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\Microsoft.Windows.Diagnosis.SDHost.ni.dll") returned="Microsoft.Windows.Diagnosis.SDHost.ni.dll" [0136.866] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\" [0136.866] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\") returned="" [0136.866] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\HOW TO DECRYPT FILES.txt" [0136.866] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\how to decrypt files.txt")) returned 0x20 [0136.866] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\", lpString2="Microsoft.Windows.Diagnosis.SDHost.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\Microsoft.Windows.Diagnosis.SDHost.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wad78daf4#\\d6b25e0539b6066b05f7de22e8cc1a88\\Microsoft.Windows.Diagnosis.SDHost.ni.dll.aux" [0136.866] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.866] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Wcffedcb4#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#" [0136.899] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\*.*") returned="*.*" [0136.899] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\", lpString2="d0182d3917990550cc0c0d48f6281c56" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56" [0136.901] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.901] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\*.*") returned="*.*" [0136.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\" [0136.901] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\") returned="" [0136.901] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\HOW TO DECRYPT FILES.txt" [0136.901] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\how to decrypt files.txt")) returned 0xffffffff [0136.901] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.903] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.904] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.904] CloseHandle (hObject=0x214) returned 1 [0136.904] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\", lpString2="Microsoft.WindowsSearch.Commands.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\Microsoft.WindowsSearch.Commands.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\Microsoft.WindowsSearch.Commands.ni.dll" [0136.904] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.904] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\Microsoft.WindowsSearch.Commands.ni.dll") returned="Microsoft.WindowsSearch.Commands.ni.dll" [0136.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\" [0136.904] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\") returned="" [0136.904] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\HOW TO DECRYPT FILES.txt" [0136.904] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\how to decrypt files.txt")) returned 0x20 [0136.905] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\", lpString2="Microsoft.WindowsSearch.Commands.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\Microsoft.WindowsSearch.Commands.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wcffedcb4#\\d0182d3917990550cc0c0d48f6281c56\\Microsoft.WindowsSearch.Commands.ni.dll.aux" [0136.905] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.905] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Wd518ee0d#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#" [0136.905] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\*.*") returned="*.*" [0136.905] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\", lpString2="bb3ab25362e6f68c6566c736ba7f4bae" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae" [0136.910] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.910] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\*.*") returned="*.*" [0136.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\" [0136.910] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\") returned="" [0136.910] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\HOW TO DECRYPT FILES.txt" [0136.910] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\how to decrypt files.txt")) returned 0xffffffff [0136.910] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.912] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.913] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.913] CloseHandle (hObject=0x214) returned 1 [0136.913] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll" [0136.913] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.913] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll") returned="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll" [0136.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\" [0136.913] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\") returned="" [0136.913] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\HOW TO DECRYPT FILES.txt" [0136.913] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\how to decrypt files.txt")) returned 0x20 [0136.913] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd518ee0d#\\bb3ab25362e6f68c6566c736ba7f4bae\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll.aux" [0136.914] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.914] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Wd75d181a#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#" [0136.914] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\*.*") returned="*.*" [0136.915] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\", lpString2="39f32bcca6ab7b15e5756b4477bb1ade" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade" [0136.916] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.916] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\*.*") returned="*.*" [0136.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\" [0136.916] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\") returned="" [0136.916] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\HOW TO DECRYPT FILES.txt" [0136.916] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\how to decrypt files.txt")) returned 0xffffffff [0136.917] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.919] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.920] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.921] CloseHandle (hObject=0x214) returned 1 [0136.921] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\", lpString2="Microsoft.Windows.Diagnosis.SDEngine.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll" [0136.921] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dcb7b3c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4dcb7b3c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4dcb7b3c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.921] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.921] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll") returned="Microsoft.Windows.Diagnosis.SDEngine.ni.dll" [0136.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\" [0136.921] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\") returned="" [0136.921] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\HOW TO DECRYPT FILES.txt" [0136.921] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\how to decrypt files.txt")) returned 0x20 [0136.921] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\", lpString2="Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux" [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.max") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.png") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.html") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.md") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wd75d181a#\\39f32bcca6ab7b15e5756b4477bb1ade\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.924] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dcb7b3c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4dcb7b3c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4dcb7b3c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDEngine.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.924] FindClose (in: hFindFile=0x759fd0 | out: hFindFile=0x759fd0) returned 1 [0136.925] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4dc91996, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4dcb7b3c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4dcb7b3c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="39f32bcca6ab7b15e5756b4477bb1ade", cAlternateFileName="39F32B~1")) returned 0 [0136.925] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.925] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9f57cc0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c2b90a5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c2b90a5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f7065, dwReserved1=0x696e2e74, cFileName="Microsoft.We0722664#", cAlternateFileName="MICROS~1.WE0")) returned 1 [0136.925] lstrcmpA (lpString1=".", lpString2="Microsoft.We0722664#") returned -1 [0136.925] lstrcmpA (lpString1="..", lpString2="Microsoft.We0722664#") returned -1 [0136.925] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.925] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.We0722664#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#" [0136.925] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#") returned 67 [0136.925] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9f57cc0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c2b90a5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c2b90a5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0136.925] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.925] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9f57cc0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c2b90a5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c2b90a5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.925] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.925] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.925] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb006f21f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xb00e1a6a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xb00e1a6a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9d3206163be78b9e048c427e5b31b1b1", cAlternateFileName="9D3206~1")) returned 1 [0136.926] lstrcmpA (lpString1=".", lpString2="9d3206163be78b9e048c427e5b31b1b1") returned -1 [0136.926] lstrcmpA (lpString1="..", lpString2="9d3206163be78b9e048c427e5b31b1b1") returned -1 [0136.926] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\*.*") returned="*.*" [0136.926] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\", lpString2="9d3206163be78b9e048c427e5b31b1b1" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1" [0136.926] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1") returned 100 [0136.926] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb006f21f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xb00e1a6a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xb00e1a6a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.927] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.928] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb006f21f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xb00e1a6a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xb00e1a6a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.928] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.928] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.928] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0048fb3, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xb0048fb3, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xb00e1a6a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x95400, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.WSMan.Management.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.928] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.928] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Management.ni.dll") returned -1 [0136.928] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Management.ni.dll") returned -1 [0136.928] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Management.ni.dll") returned -1 [0136.928] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\*.*") returned="*.*" [0136.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\" [0136.928] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\") returned="" [0136.928] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\HOW TO DECRYPT FILES.txt" [0136.928] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.we0722664#\\9d3206163be78b9e048c427e5b31b1b1\\how to decrypt files.txt")) returned 0xffffffff [0136.928] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.we0722664#\\9d3206163be78b9e048c427e5b31b1b1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.929] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.929] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.930] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.930] CloseHandle (hObject=0x214) returned 1 [0136.930] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\", lpString2="Microsoft.WSMan.Management.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll" [0136.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.zip") returned 0 [0136.930] lstrlenA (lpString="*.zip") returned 5 [0136.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.rar") returned 0 [0136.930] lstrlenA (lpString="*.rar") returned 5 [0136.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.7z") returned 0 [0136.930] lstrlenA (lpString="*.7z") returned 4 [0136.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.tar") returned 0 [0136.930] lstrlenA (lpString="*.tar") returned 5 [0136.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.gzip") returned 0 [0136.931] lstrlenA (lpString="*.gzip") returned 6 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.jpg") returned 0 [0136.931] lstrlenA (lpString="*.jpg") returned 5 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.jpeg") returned 0 [0136.931] lstrlenA (lpString="*.jpeg") returned 6 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.psd") returned 0 [0136.931] lstrlenA (lpString="*.psd") returned 5 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.cdr") returned 0 [0136.931] lstrlenA (lpString="*.cdr") returned 5 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.dwg") returned 0 [0136.931] lstrlenA (lpString="*.dwg") returned 5 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.max") returned 0 [0136.931] lstrlenA (lpString="*.max") returned 5 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.bmp") returned 0 [0136.931] lstrlenA (lpString="*.bmp") returned 5 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.gif") returned 0 [0136.931] lstrlenA (lpString="*.gif") returned 5 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.png") returned 0 [0136.931] lstrlenA (lpString="*.png") returned 5 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.doc") returned 0 [0136.931] lstrlenA (lpString="*.doc") returned 5 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.docx") returned 0 [0136.931] lstrlenA (lpString="*.docx") returned 6 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.xls") returned 0 [0136.931] lstrlenA (lpString="*.xls") returned 5 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.xlsx") returned 0 [0136.931] lstrlenA (lpString="*.xlsx") returned 6 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ppt") returned 0 [0136.931] lstrlenA (lpString="*.ppt") returned 5 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pptx") returned 0 [0136.931] lstrlenA (lpString="*.pptx") returned 6 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.txt") returned 0 [0136.931] lstrlenA (lpString="*.txt") returned 5 [0136.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pdf") returned 0 [0136.932] lstrlenA (lpString="*.pdf") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.djvu") returned 0 [0136.932] lstrlenA (lpString="*.djvu") returned 6 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.htm") returned 0 [0136.932] lstrlenA (lpString="*.htm") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.html") returned 0 [0136.932] lstrlenA (lpString="*.html") returned 6 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mdb") returned 0 [0136.932] lstrlenA (lpString="*.mdb") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.cer") returned 0 [0136.932] lstrlenA (lpString="*.cer") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.p12") returned 0 [0136.932] lstrlenA (lpString="*.p12") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pfx") returned 0 [0136.932] lstrlenA (lpString="*.pfx") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.kwm") returned 0 [0136.932] lstrlenA (lpString="*.kwm") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pwm") returned 0 [0136.932] lstrlenA (lpString="*.pwm") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.1cd") returned 0 [0136.932] lstrlenA (lpString="*.1cd") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.md") returned 0 [0136.932] lstrlenA (lpString="*.md") returned 4 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mdf") returned 0 [0136.932] lstrlenA (lpString="*.mdf") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.dbf") returned 0 [0136.932] lstrlenA (lpString="*.dbf") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.odt") returned 0 [0136.932] lstrlenA (lpString="*.odt") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.vob") returned 0 [0136.932] lstrlenA (lpString="*.vob") returned 5 [0136.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ifo") returned 0 [0136.933] lstrlenA (lpString="*.ifo") returned 5 [0136.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.lnk") returned 0 [0136.933] lstrlenA (lpString="*.lnk") returned 5 [0136.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.torrent") returned 0 [0136.933] lstrlenA (lpString="*.torrent") returned 9 [0136.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mov") returned 0 [0136.933] lstrlenA (lpString="*.mov") returned 5 [0136.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.m2v") returned 0 [0136.933] lstrlenA (lpString="*.m2v") returned 5 [0136.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.3gp") returned 0 [0136.933] lstrlenA (lpString="*.3gp") returned 5 [0136.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mpeg") returned 0 [0136.933] lstrlenA (lpString="*.mpeg") returned 6 [0136.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mpg") returned 0 [0136.933] lstrlenA (lpString="*.mpg") returned 5 [0136.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.flv") returned 0 [0136.933] lstrlenA (lpString="*.flv") returned 5 [0136.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.avi") returned 0 [0136.933] lstrlenA (lpString="*.avi") returned 5 [0136.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mp4") returned 0 [0136.934] lstrlenA (lpString="*.mp4") returned 5 [0136.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.wmv") returned 0 [0136.934] lstrlenA (lpString="*.wmv") returned 5 [0136.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.divx") returned 0 [0136.934] lstrlenA (lpString="*.divx") returned 6 [0136.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mkv") returned 0 [0136.934] lstrlenA (lpString="*.mkv") returned 5 [0136.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mp3") returned 0 [0136.934] lstrlenA (lpString="*.mp3") returned 5 [0136.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.wav") returned 0 [0136.934] lstrlenA (lpString="*.wav") returned 5 [0136.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.flac") returned 0 [0136.934] lstrlenA (lpString="*.flac") returned 6 [0136.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ape") returned 0 [0136.934] lstrlenA (lpString="*.ape") returned 5 [0136.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.wma") returned 0 [0136.934] lstrlenA (lpString="*.wma") returned 5 [0136.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ac3") returned 0 [0136.934] lstrlenA (lpString="*.ac3") returned 5 [0136.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.doc") returned 0 [0136.934] lstrlenA (lpString="*.doc") returned 5 [0136.934] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb006f21f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xb00e1a6a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.934] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.934] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Management.ni.dll.aux") returned -1 [0136.934] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Management.ni.dll.aux") returned -1 [0136.934] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Management.ni.dll.aux") returned -1 [0136.934] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll") returned="Microsoft.WSMan.Management.ni.dll" [0136.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\" [0136.934] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\") returned="" [0136.935] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\HOW TO DECRYPT FILES.txt" [0136.935] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.we0722664#\\9d3206163be78b9e048c427e5b31b1b1\\how to decrypt files.txt")) returned 0x20 [0136.935] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\", lpString2="Microsoft.WSMan.Management.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux" [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.935] lstrlenA (lpString="*.zip") returned 5 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.935] lstrlenA (lpString="*.rar") returned 5 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.935] lstrlenA (lpString="*.7z") returned 4 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.935] lstrlenA (lpString="*.tar") returned 5 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.935] lstrlenA (lpString="*.gzip") returned 6 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.935] lstrlenA (lpString="*.jpg") returned 5 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.935] lstrlenA (lpString="*.jpeg") returned 6 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.935] lstrlenA (lpString="*.psd") returned 5 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.935] lstrlenA (lpString="*.cdr") returned 5 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.935] lstrlenA (lpString="*.dwg") returned 5 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.max") returned 0 [0136.935] lstrlenA (lpString="*.max") returned 5 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.935] lstrlenA (lpString="*.bmp") returned 5 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.935] lstrlenA (lpString="*.gif") returned 5 [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.png") returned 0 [0136.936] lstrlenA (lpString="*.png") returned 5 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.936] lstrlenA (lpString="*.doc") returned 5 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.936] lstrlenA (lpString="*.docx") returned 6 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.936] lstrlenA (lpString="*.xls") returned 5 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.936] lstrlenA (lpString="*.xlsx") returned 6 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.936] lstrlenA (lpString="*.ppt") returned 5 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.936] lstrlenA (lpString="*.pptx") returned 6 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.936] lstrlenA (lpString="*.txt") returned 5 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.936] lstrlenA (lpString="*.pdf") returned 5 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.936] lstrlenA (lpString="*.djvu") returned 6 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.936] lstrlenA (lpString="*.htm") returned 5 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.html") returned 0 [0136.936] lstrlenA (lpString="*.html") returned 6 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.936] lstrlenA (lpString="*.mdb") returned 5 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.936] lstrlenA (lpString="*.cer") returned 5 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.936] lstrlenA (lpString="*.p12") returned 5 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.936] lstrlenA (lpString="*.pfx") returned 5 [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.936] lstrlenA (lpString="*.kwm") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.937] lstrlenA (lpString="*.pwm") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.937] lstrlenA (lpString="*.1cd") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.md") returned 0 [0136.937] lstrlenA (lpString="*.md") returned 4 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.937] lstrlenA (lpString="*.mdf") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.937] lstrlenA (lpString="*.dbf") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.937] lstrlenA (lpString="*.odt") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.937] lstrlenA (lpString="*.vob") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.937] lstrlenA (lpString="*.ifo") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.937] lstrlenA (lpString="*.lnk") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.937] lstrlenA (lpString="*.torrent") returned 9 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.937] lstrlenA (lpString="*.mov") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.937] lstrlenA (lpString="*.m2v") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.937] lstrlenA (lpString="*.3gp") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.937] lstrlenA (lpString="*.mpeg") returned 6 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.937] lstrlenA (lpString="*.mpg") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.937] lstrlenA (lpString="*.flv") returned 5 [0136.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.938] lstrlenA (lpString="*.avi") returned 5 [0136.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.938] lstrlenA (lpString="*.mp4") returned 5 [0136.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.938] lstrlenA (lpString="*.wmv") returned 5 [0136.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.938] lstrlenA (lpString="*.divx") returned 6 [0136.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.938] lstrlenA (lpString="*.mkv") returned 5 [0136.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.938] lstrlenA (lpString="*.mp3") returned 5 [0136.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.938] lstrlenA (lpString="*.wav") returned 5 [0136.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.938] lstrlenA (lpString="*.flac") returned 6 [0136.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.938] lstrlenA (lpString="*.ape") returned 5 [0136.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.938] lstrlenA (lpString="*.wma") returned 5 [0136.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.938] lstrlenA (lpString="*.ac3") returned 5 [0136.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\9d3206163be78b9e048c427e5b31b1b1\\Microsoft.WSMan.Management.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.938] lstrlenA (lpString="*.doc") returned 5 [0136.938] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb006f21f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xb00e1a6a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.938] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.939] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb006f21f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xb00e1a6a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xb00e1a6a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9d3206163be78b9e048c427e5b31b1b1", cAlternateFileName="9D3206~1")) returned 0 [0136.939] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0136.939] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f09d543, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8f09d543, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8f09d543, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f7065, dwReserved1=0x696e2e74, cFileName="Microsoft.We5b77bca#", cAlternateFileName="MICROS~1.WE5")) returned 1 [0136.939] lstrcmpA (lpString1=".", lpString2="Microsoft.We5b77bca#") returned -1 [0136.939] lstrcmpA (lpString1="..", lpString2="Microsoft.We5b77bca#") returned -1 [0136.939] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.939] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.We5b77bca#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#" [0136.939] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#") returned 67 [0136.939] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f09d543, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8f09d543, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8f09d543, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759f50 [0136.948] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.948] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f09d543, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8f09d543, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8f09d543, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.948] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.948] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.948] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f09d543, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8f0e998a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8f0e998a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7f45ab655951f8b15493b9f5a274272e", cAlternateFileName="7F45AB~1")) returned 1 [0136.948] lstrcmpA (lpString1=".", lpString2="7f45ab655951f8b15493b9f5a274272e") returned -1 [0136.948] lstrcmpA (lpString1="..", lpString2="7f45ab655951f8b15493b9f5a274272e") returned -1 [0136.948] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\*.*") returned="*.*" [0136.948] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\", lpString2="7f45ab655951f8b15493b9f5a274272e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e" [0136.949] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e") returned 100 [0136.949] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f09d543, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8f0e998a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8f0e998a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0136.954] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.954] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f09d543, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8f0e998a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8f0e998a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.954] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.954] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.954] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f09d543, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8f09d543, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8f0e998a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.954] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.954] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Appx.PackageManager.Commands.ni.dll") returned -1 [0136.954] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Appx.PackageManager.Commands.ni.dll") returned -1 [0136.954] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Appx.PackageManager.Commands.ni.dll") returned -1 [0136.954] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\*.*") returned="*.*" [0136.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\" [0136.954] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\") returned="" [0136.954] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\HOW TO DECRYPT FILES.txt" [0136.954] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.we5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\how to decrypt files.txt")) returned 0xffffffff [0136.954] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.we5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.956] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.956] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.957] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.957] CloseHandle (hObject=0x214) returned 1 [0136.957] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\", lpString2="Microsoft.Windows.Appx.PackageManager.Commands.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll" [0136.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.zip") returned 0 [0136.957] lstrlenA (lpString="*.zip") returned 5 [0136.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.rar") returned 0 [0136.957] lstrlenA (lpString="*.rar") returned 5 [0136.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.7z") returned 0 [0136.957] lstrlenA (lpString="*.7z") returned 4 [0136.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.tar") returned 0 [0136.958] lstrlenA (lpString="*.tar") returned 5 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.gzip") returned 0 [0136.958] lstrlenA (lpString="*.gzip") returned 6 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.jpg") returned 0 [0136.958] lstrlenA (lpString="*.jpg") returned 5 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.jpeg") returned 0 [0136.958] lstrlenA (lpString="*.jpeg") returned 6 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.psd") returned 0 [0136.958] lstrlenA (lpString="*.psd") returned 5 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.cdr") returned 0 [0136.958] lstrlenA (lpString="*.cdr") returned 5 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.dwg") returned 0 [0136.958] lstrlenA (lpString="*.dwg") returned 5 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.max") returned 0 [0136.958] lstrlenA (lpString="*.max") returned 5 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.bmp") returned 0 [0136.958] lstrlenA (lpString="*.bmp") returned 5 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.gif") returned 0 [0136.958] lstrlenA (lpString="*.gif") returned 5 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.png") returned 0 [0136.958] lstrlenA (lpString="*.png") returned 5 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.doc") returned 0 [0136.958] lstrlenA (lpString="*.doc") returned 5 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.docx") returned 0 [0136.958] lstrlenA (lpString="*.docx") returned 6 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.xls") returned 0 [0136.958] lstrlenA (lpString="*.xls") returned 5 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.xlsx") returned 0 [0136.958] lstrlenA (lpString="*.xlsx") returned 6 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.ppt") returned 0 [0136.958] lstrlenA (lpString="*.ppt") returned 5 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.pptx") returned 0 [0136.958] lstrlenA (lpString="*.pptx") returned 6 [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.txt") returned 0 [0136.959] lstrlenA (lpString="*.txt") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.pdf") returned 0 [0136.959] lstrlenA (lpString="*.pdf") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.djvu") returned 0 [0136.959] lstrlenA (lpString="*.djvu") returned 6 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.htm") returned 0 [0136.959] lstrlenA (lpString="*.htm") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.html") returned 0 [0136.959] lstrlenA (lpString="*.html") returned 6 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.mdb") returned 0 [0136.959] lstrlenA (lpString="*.mdb") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.cer") returned 0 [0136.959] lstrlenA (lpString="*.cer") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.p12") returned 0 [0136.959] lstrlenA (lpString="*.p12") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.pfx") returned 0 [0136.959] lstrlenA (lpString="*.pfx") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.kwm") returned 0 [0136.959] lstrlenA (lpString="*.kwm") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.pwm") returned 0 [0136.959] lstrlenA (lpString="*.pwm") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.1cd") returned 0 [0136.959] lstrlenA (lpString="*.1cd") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.md") returned 0 [0136.959] lstrlenA (lpString="*.md") returned 4 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.mdf") returned 0 [0136.959] lstrlenA (lpString="*.mdf") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.dbf") returned 0 [0136.959] lstrlenA (lpString="*.dbf") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.odt") returned 0 [0136.959] lstrlenA (lpString="*.odt") returned 5 [0136.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.vob") returned 0 [0136.959] lstrlenA (lpString="*.vob") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.ifo") returned 0 [0136.960] lstrlenA (lpString="*.ifo") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.lnk") returned 0 [0136.960] lstrlenA (lpString="*.lnk") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.torrent") returned 0 [0136.960] lstrlenA (lpString="*.torrent") returned 9 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.mov") returned 0 [0136.960] lstrlenA (lpString="*.mov") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.m2v") returned 0 [0136.960] lstrlenA (lpString="*.m2v") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.3gp") returned 0 [0136.960] lstrlenA (lpString="*.3gp") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.mpeg") returned 0 [0136.960] lstrlenA (lpString="*.mpeg") returned 6 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.mpg") returned 0 [0136.960] lstrlenA (lpString="*.mpg") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.flv") returned 0 [0136.960] lstrlenA (lpString="*.flv") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.avi") returned 0 [0136.960] lstrlenA (lpString="*.avi") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.mp4") returned 0 [0136.960] lstrlenA (lpString="*.mp4") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.wmv") returned 0 [0136.960] lstrlenA (lpString="*.wmv") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.divx") returned 0 [0136.960] lstrlenA (lpString="*.divx") returned 6 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.mkv") returned 0 [0136.960] lstrlenA (lpString="*.mkv") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.mp3") returned 0 [0136.960] lstrlenA (lpString="*.mp3") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.wav") returned 0 [0136.960] lstrlenA (lpString="*.wav") returned 5 [0136.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.flac") returned 0 [0136.961] lstrlenA (lpString="*.flac") returned 6 [0136.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.ape") returned 0 [0136.961] lstrlenA (lpString="*.ape") returned 5 [0136.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.wma") returned 0 [0136.961] lstrlenA (lpString="*.wma") returned 5 [0136.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.ac3") returned 0 [0136.961] lstrlenA (lpString="*.ac3") returned 5 [0136.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll", pszSpec="*.doc") returned 0 [0136.961] lstrlenA (lpString="*.doc") returned 5 [0136.961] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f09d543, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8f09d543, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8f0e998a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.961] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux") returned -1 [0136.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux") returned -1 [0136.961] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux") returned -1 [0136.961] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll") returned="Microsoft.Windows.Appx.PackageManager.Commands.ni.dll" [0136.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\" [0136.961] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\") returned="" [0136.961] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\HOW TO DECRYPT FILES.txt" [0136.961] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.we5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\how to decrypt files.txt")) returned 0x20 [0136.961] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\", lpString2="Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux" [0136.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.961] lstrlenA (lpString="*.zip") returned 5 [0136.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.961] lstrlenA (lpString="*.rar") returned 5 [0136.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.961] lstrlenA (lpString="*.7z") returned 4 [0136.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.961] lstrlenA (lpString="*.tar") returned 5 [0136.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.962] lstrlenA (lpString="*.gzip") returned 6 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.962] lstrlenA (lpString="*.jpg") returned 5 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.962] lstrlenA (lpString="*.jpeg") returned 6 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.962] lstrlenA (lpString="*.psd") returned 5 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.962] lstrlenA (lpString="*.cdr") returned 5 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.962] lstrlenA (lpString="*.dwg") returned 5 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.max") returned 0 [0136.962] lstrlenA (lpString="*.max") returned 5 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.962] lstrlenA (lpString="*.bmp") returned 5 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.962] lstrlenA (lpString="*.gif") returned 5 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.png") returned 0 [0136.962] lstrlenA (lpString="*.png") returned 5 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.962] lstrlenA (lpString="*.doc") returned 5 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.962] lstrlenA (lpString="*.docx") returned 6 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.962] lstrlenA (lpString="*.xls") returned 5 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.962] lstrlenA (lpString="*.xlsx") returned 6 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.962] lstrlenA (lpString="*.ppt") returned 5 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.962] lstrlenA (lpString="*.pptx") returned 6 [0136.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.962] lstrlenA (lpString="*.txt") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.963] lstrlenA (lpString="*.pdf") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.963] lstrlenA (lpString="*.djvu") returned 6 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.963] lstrlenA (lpString="*.htm") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.html") returned 0 [0136.963] lstrlenA (lpString="*.html") returned 6 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.963] lstrlenA (lpString="*.mdb") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.963] lstrlenA (lpString="*.cer") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.963] lstrlenA (lpString="*.p12") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.963] lstrlenA (lpString="*.pfx") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.963] lstrlenA (lpString="*.kwm") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.963] lstrlenA (lpString="*.pwm") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.963] lstrlenA (lpString="*.1cd") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.md") returned 0 [0136.963] lstrlenA (lpString="*.md") returned 4 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.963] lstrlenA (lpString="*.mdf") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.963] lstrlenA (lpString="*.dbf") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.963] lstrlenA (lpString="*.odt") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.963] lstrlenA (lpString="*.vob") returned 5 [0136.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.964] lstrlenA (lpString="*.ifo") returned 5 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.964] lstrlenA (lpString="*.lnk") returned 5 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.964] lstrlenA (lpString="*.torrent") returned 9 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.964] lstrlenA (lpString="*.mov") returned 5 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.964] lstrlenA (lpString="*.m2v") returned 5 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.964] lstrlenA (lpString="*.3gp") returned 5 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.964] lstrlenA (lpString="*.mpeg") returned 6 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.964] lstrlenA (lpString="*.mpg") returned 5 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.964] lstrlenA (lpString="*.flv") returned 5 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.964] lstrlenA (lpString="*.avi") returned 5 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.964] lstrlenA (lpString="*.mp4") returned 5 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.964] lstrlenA (lpString="*.wmv") returned 5 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.964] lstrlenA (lpString="*.divx") returned 6 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.964] lstrlenA (lpString="*.mkv") returned 5 [0136.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.967] lstrlenA (lpString="*.mp3") returned 5 [0136.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.967] lstrlenA (lpString="*.wav") returned 5 [0136.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.967] lstrlenA (lpString="*.flac") returned 6 [0136.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.967] lstrlenA (lpString="*.ape") returned 5 [0136.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.967] lstrlenA (lpString="*.wma") returned 5 [0136.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.967] lstrlenA (lpString="*.ac3") returned 5 [0136.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We5b77bca#\\7f45ab655951f8b15493b9f5a274272e\\Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.967] lstrlenA (lpString="*.doc") returned 5 [0136.967] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f09d543, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8f09d543, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8f0e998a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Appx.PackageManager.Commands.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.967] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0136.968] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f09d543, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8f0e998a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8f0e998a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7f45ab655951f8b15493b9f5a274272e", cAlternateFileName="7F45AB~1")) returned 0 [0136.968] FindClose (in: hFindFile=0x759f50 | out: hFindFile=0x759f50) returned 1 [0136.968] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90bd5c6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c3054f2, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c3054f2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e69, dwReserved1=0x75612e6c, cFileName="Microsoft.We9f24001#", cAlternateFileName="MICROS~1.WE9")) returned 1 [0136.971] lstrcmpA (lpString1=".", lpString2="Microsoft.We9f24001#") returned -1 [0136.971] lstrcmpA (lpString1="..", lpString2="Microsoft.We9f24001#") returned -1 [0136.971] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.971] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.We9f24001#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#" [0136.971] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#") returned 67 [0136.971] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90bd5c6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c3054f2, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c3054f2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0136.972] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.972] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90bd5c6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c3054f2, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c3054f2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.972] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.972] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.972] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53023a12, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x53023a12, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x53023a12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e4322966d392d4e08b8b03570fc6645f", cAlternateFileName="E43229~1")) returned 1 [0136.972] lstrcmpA (lpString1=".", lpString2="e4322966d392d4e08b8b03570fc6645f") returned -1 [0136.972] lstrcmpA (lpString1="..", lpString2="e4322966d392d4e08b8b03570fc6645f") returned -1 [0136.972] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\*.*") returned="*.*" [0136.972] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\", lpString2="e4322966d392d4e08b8b03570fc6645f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f" [0136.972] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f") returned 100 [0136.973] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53023a12, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x53023a12, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x53023a12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0136.974] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.974] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53023a12, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x53023a12, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x53023a12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.974] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.974] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.974] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ffd7d5, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x52ffd7d5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x53023a12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x80a00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.WSMan.Management.Activities.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.974] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.974] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Management.Activities.ni.dll") returned -1 [0136.974] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Management.Activities.ni.dll") returned -1 [0136.974] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Management.Activities.ni.dll") returned -1 [0136.974] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\*.*") returned="*.*" [0136.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\" [0136.975] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\") returned="" [0136.975] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\HOW TO DECRYPT FILES.txt" [0136.975] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.we9f24001#\\e4322966d392d4e08b8b03570fc6645f\\how to decrypt files.txt")) returned 0xffffffff [0136.975] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.we9f24001#\\e4322966d392d4e08b8b03570fc6645f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.976] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0136.976] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.977] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.977] CloseHandle (hObject=0x214) returned 1 [0136.978] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\", lpString2="Microsoft.WSMan.Management.Activities.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll" [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.zip") returned 0 [0136.978] lstrlenA (lpString="*.zip") returned 5 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.rar") returned 0 [0136.978] lstrlenA (lpString="*.rar") returned 5 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.7z") returned 0 [0136.978] lstrlenA (lpString="*.7z") returned 4 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.tar") returned 0 [0136.978] lstrlenA (lpString="*.tar") returned 5 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.gzip") returned 0 [0136.978] lstrlenA (lpString="*.gzip") returned 6 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.jpg") returned 0 [0136.978] lstrlenA (lpString="*.jpg") returned 5 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.jpeg") returned 0 [0136.978] lstrlenA (lpString="*.jpeg") returned 6 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.psd") returned 0 [0136.978] lstrlenA (lpString="*.psd") returned 5 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.cdr") returned 0 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.dwg") returned 0 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.max") returned 0 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.bmp") returned 0 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.gif") returned 0 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.png") returned 0 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.doc") returned 0 [0136.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.docx") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.xls") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.xlsx") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.ppt") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.pptx") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.txt") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.pdf") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.djvu") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.htm") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.html") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.mdb") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.cer") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.p12") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.pfx") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.kwm") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.pwm") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.1cd") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.md") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.mdf") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.dbf") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.odt") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.vob") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.ifo") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.lnk") returned 0 [0136.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.torrent") returned 0 [0136.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.mov") returned 0 [0136.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.m2v") returned 0 [0136.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.3gp") returned 0 [0136.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.mpeg") returned 0 [0136.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.mpg") returned 0 [0136.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.flv") returned 0 [0136.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.avi") returned 0 [0136.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.mp4") returned 0 [0136.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.wmv") returned 0 [0136.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.divx") returned 0 [0136.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.mkv") returned 0 [0136.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.mp3") returned 0 [0136.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.wav") returned 0 [0136.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.flac") returned 0 [0136.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.ape") returned 0 [0136.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.wma") returned 0 [0136.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.ac3") returned 0 [0136.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll", pszSpec="*.doc") returned 0 [0136.981] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53023a12, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x53023a12, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x53023a12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.981] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.981] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Management.Activities.ni.dll.aux") returned -1 [0136.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Management.Activities.ni.dll.aux") returned -1 [0136.981] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Management.Activities.ni.dll.aux") returned -1 [0136.981] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll") returned="Microsoft.WSMan.Management.Activities.ni.dll" [0136.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\" [0136.981] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\") returned="" [0136.981] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\HOW TO DECRYPT FILES.txt" [0136.981] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.we9f24001#\\e4322966d392d4e08b8b03570fc6645f\\how to decrypt files.txt")) returned 0x20 [0136.981] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\", lpString2="Microsoft.WSMan.Management.Activities.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux" [0136.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.max") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.png") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.html") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.mdb") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.cer") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.p12") returned 0 [0136.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.pfx") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.kwm") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.pwm") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.1cd") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.md") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.mdf") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.dbf") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.odt") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.vob") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.ifo") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.lnk") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.torrent") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.mov") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.m2v") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.3gp") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.mpg") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.flv") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.avi") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.mp4") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.wmv") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.divx") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.mkv") returned 0 [0136.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.mp3") returned 0 [0136.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.wav") returned 0 [0136.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.flac") returned 0 [0136.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.ape") returned 0 [0136.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.wma") returned 0 [0136.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.ac3") returned 0 [0136.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We9f24001#\\e4322966d392d4e08b8b03570fc6645f\\Microsoft.WSMan.Management.Activities.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.984] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53023a12, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x53023a12, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x53023a12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.Activities.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0136.984] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0136.985] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53023a12, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x53023a12, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x53023a12, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e4322966d392d4e08b8b03570fc6645f", cAlternateFileName="E43229~1")) returned 0 [0136.985] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0136.985] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90e382d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c0a324a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c0a324a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="Microsoft.Wed3937f9#", cAlternateFileName="MICROS~1.WED")) returned 1 [0136.985] lstrcmpA (lpString1=".", lpString2="Microsoft.Wed3937f9#") returned -1 [0136.985] lstrcmpA (lpString1="..", lpString2="Microsoft.Wed3937f9#") returned -1 [0136.985] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0136.985] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Microsoft.Wed3937f9#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#" [0136.985] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90e382d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c0a324a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c0a324a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0136.986] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.986] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90e382d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c0a324a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c0a324a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.986] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.986] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.986] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9304258b, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x9304258b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x9304258b, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="228e24c27104905afe60c8aef65ecc48", cAlternateFileName="228E24~1")) returned 1 [0136.986] lstrcmpA (lpString1=".", lpString2="228e24c27104905afe60c8aef65ecc48") returned -1 [0136.986] lstrcmpA (lpString1="..", lpString2="228e24c27104905afe60c8aef65ecc48") returned -1 [0136.986] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\*.*") returned="*.*" [0136.986] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\", lpString2="228e24c27104905afe60c8aef65ecc48" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48" [0136.986] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9304258b, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x9304258b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x9304258b, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0136.987] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.987] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9304258b, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x9304258b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x9304258b, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0136.988] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.988] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.988] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9304258b, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x9304258b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x9304258b, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="Microsoft.Windows.Diagnosis.SDCommon.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0136.988] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.SDCommon.ni.dll") returned -1 [0136.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.SDCommon.ni.dll") returned -1 [0136.988] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.SDCommon.ni.dll") returned -1 [0136.988] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\*.*") returned="*.*" [0136.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\" [0136.988] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\") returned="" [0136.988] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\HOW TO DECRYPT FILES.txt" [0136.988] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\how to decrypt files.txt")) returned 0xffffffff [0136.988] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0136.989] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0136.990] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.990] CloseHandle (hObject=0x214) returned 1 [0136.990] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\", lpString2="Microsoft.Windows.Diagnosis.SDCommon.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll" [0136.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.zip") returned 0 [0136.990] lstrlenA (lpString="*.zip") returned 5 [0136.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.rar") returned 0 [0136.990] lstrlenA (lpString="*.rar") returned 5 [0136.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.7z") returned 0 [0136.990] lstrlenA (lpString="*.7z") returned 4 [0136.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.tar") returned 0 [0136.990] lstrlenA (lpString="*.tar") returned 5 [0136.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.gzip") returned 0 [0136.991] lstrlenA (lpString="*.gzip") returned 6 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.jpg") returned 0 [0136.991] lstrlenA (lpString="*.jpg") returned 5 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.jpeg") returned 0 [0136.991] lstrlenA (lpString="*.jpeg") returned 6 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.psd") returned 0 [0136.991] lstrlenA (lpString="*.psd") returned 5 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.cdr") returned 0 [0136.991] lstrlenA (lpString="*.cdr") returned 5 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.dwg") returned 0 [0136.991] lstrlenA (lpString="*.dwg") returned 5 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.max") returned 0 [0136.991] lstrlenA (lpString="*.max") returned 5 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.bmp") returned 0 [0136.991] lstrlenA (lpString="*.bmp") returned 5 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.gif") returned 0 [0136.991] lstrlenA (lpString="*.gif") returned 5 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.png") returned 0 [0136.991] lstrlenA (lpString="*.png") returned 5 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.doc") returned 0 [0136.991] lstrlenA (lpString="*.doc") returned 5 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.docx") returned 0 [0136.991] lstrlenA (lpString="*.docx") returned 6 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.xls") returned 0 [0136.991] lstrlenA (lpString="*.xls") returned 5 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.xlsx") returned 0 [0136.991] lstrlenA (lpString="*.xlsx") returned 6 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.ppt") returned 0 [0136.991] lstrlenA (lpString="*.ppt") returned 5 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.pptx") returned 0 [0136.991] lstrlenA (lpString="*.pptx") returned 6 [0136.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.txt") returned 0 [0136.991] lstrlenA (lpString="*.txt") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.pdf") returned 0 [0136.992] lstrlenA (lpString="*.pdf") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.djvu") returned 0 [0136.992] lstrlenA (lpString="*.djvu") returned 6 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.htm") returned 0 [0136.992] lstrlenA (lpString="*.htm") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.html") returned 0 [0136.992] lstrlenA (lpString="*.html") returned 6 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.mdb") returned 0 [0136.992] lstrlenA (lpString="*.mdb") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.cer") returned 0 [0136.992] lstrlenA (lpString="*.cer") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.p12") returned 0 [0136.992] lstrlenA (lpString="*.p12") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.pfx") returned 0 [0136.992] lstrlenA (lpString="*.pfx") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.kwm") returned 0 [0136.992] lstrlenA (lpString="*.kwm") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.pwm") returned 0 [0136.992] lstrlenA (lpString="*.pwm") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.1cd") returned 0 [0136.992] lstrlenA (lpString="*.1cd") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.md") returned 0 [0136.992] lstrlenA (lpString="*.md") returned 4 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.mdf") returned 0 [0136.992] lstrlenA (lpString="*.mdf") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.dbf") returned 0 [0136.992] lstrlenA (lpString="*.dbf") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.odt") returned 0 [0136.992] lstrlenA (lpString="*.odt") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.vob") returned 0 [0136.992] lstrlenA (lpString="*.vob") returned 5 [0136.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.ifo") returned 0 [0136.993] lstrlenA (lpString="*.ifo") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.lnk") returned 0 [0136.993] lstrlenA (lpString="*.lnk") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.torrent") returned 0 [0136.993] lstrlenA (lpString="*.torrent") returned 9 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.mov") returned 0 [0136.993] lstrlenA (lpString="*.mov") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.m2v") returned 0 [0136.993] lstrlenA (lpString="*.m2v") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.3gp") returned 0 [0136.993] lstrlenA (lpString="*.3gp") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.mpeg") returned 0 [0136.993] lstrlenA (lpString="*.mpeg") returned 6 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.mpg") returned 0 [0136.993] lstrlenA (lpString="*.mpg") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.flv") returned 0 [0136.993] lstrlenA (lpString="*.flv") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.avi") returned 0 [0136.993] lstrlenA (lpString="*.avi") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.mp4") returned 0 [0136.993] lstrlenA (lpString="*.mp4") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.wmv") returned 0 [0136.993] lstrlenA (lpString="*.wmv") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.divx") returned 0 [0136.993] lstrlenA (lpString="*.divx") returned 6 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.mkv") returned 0 [0136.993] lstrlenA (lpString="*.mkv") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.mp3") returned 0 [0136.993] lstrlenA (lpString="*.mp3") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.wav") returned 0 [0136.993] lstrlenA (lpString="*.wav") returned 5 [0136.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.flac") returned 0 [0136.993] lstrlenA (lpString="*.flac") returned 6 [0136.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.ape") returned 0 [0136.994] lstrlenA (lpString="*.ape") returned 5 [0136.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.wma") returned 0 [0136.994] lstrlenA (lpString="*.wma") returned 5 [0136.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.ac3") returned 0 [0136.994] lstrlenA (lpString="*.ac3") returned 5 [0136.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll", pszSpec="*.doc") returned 0 [0136.994] lstrlenA (lpString="*.doc") returned 5 [0136.994] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9304258b, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x9304258b, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 1 [0136.994] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0136.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux") returned -1 [0136.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux") returned -1 [0136.994] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux") returned -1 [0136.994] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll") returned="Microsoft.Windows.Diagnosis.SDCommon.ni.dll" [0136.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\" [0136.994] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\") returned="" [0136.994] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\HOW TO DECRYPT FILES.txt" [0136.994] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\how to decrypt files.txt")) returned 0x20 [0136.994] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\", lpString2="Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux" [0136.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.zip") returned 0 [0136.994] lstrlenA (lpString="*.zip") returned 5 [0136.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.rar") returned 0 [0136.994] lstrlenA (lpString="*.rar") returned 5 [0136.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.7z") returned 0 [0136.994] lstrlenA (lpString="*.7z") returned 4 [0136.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.tar") returned 0 [0136.994] lstrlenA (lpString="*.tar") returned 5 [0136.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.gzip") returned 0 [0136.994] lstrlenA (lpString="*.gzip") returned 6 [0136.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.jpg") returned 0 [0136.995] lstrlenA (lpString="*.jpg") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0136.995] lstrlenA (lpString="*.jpeg") returned 6 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.psd") returned 0 [0136.995] lstrlenA (lpString="*.psd") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.cdr") returned 0 [0136.995] lstrlenA (lpString="*.cdr") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.dwg") returned 0 [0136.995] lstrlenA (lpString="*.dwg") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.max") returned 0 [0136.995] lstrlenA (lpString="*.max") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.bmp") returned 0 [0136.995] lstrlenA (lpString="*.bmp") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.gif") returned 0 [0136.995] lstrlenA (lpString="*.gif") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.png") returned 0 [0136.995] lstrlenA (lpString="*.png") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.doc") returned 0 [0136.995] lstrlenA (lpString="*.doc") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.docx") returned 0 [0136.995] lstrlenA (lpString="*.docx") returned 6 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.xls") returned 0 [0136.995] lstrlenA (lpString="*.xls") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0136.995] lstrlenA (lpString="*.xlsx") returned 6 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.ppt") returned 0 [0136.995] lstrlenA (lpString="*.ppt") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.pptx") returned 0 [0136.995] lstrlenA (lpString="*.pptx") returned 6 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.txt") returned 0 [0136.995] lstrlenA (lpString="*.txt") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.pdf") returned 0 [0136.995] lstrlenA (lpString="*.pdf") returned 5 [0136.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.djvu") returned 0 [0136.996] lstrlenA (lpString="*.djvu") returned 6 [0136.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.htm") returned 0 [0136.996] lstrlenA (lpString="*.htm") returned 5 [0137.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.html") returned 0 [0137.017] lstrlenA (lpString="*.html") returned 6 [0137.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.mdb") returned 0 [0137.017] lstrlenA (lpString="*.mdb") returned 5 [0137.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.cer") returned 0 [0137.017] lstrlenA (lpString="*.cer") returned 5 [0137.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.p12") returned 0 [0137.017] lstrlenA (lpString="*.p12") returned 5 [0137.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.pfx") returned 0 [0137.017] lstrlenA (lpString="*.pfx") returned 5 [0137.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.kwm") returned 0 [0137.017] lstrlenA (lpString="*.kwm") returned 5 [0137.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.pwm") returned 0 [0137.017] lstrlenA (lpString="*.pwm") returned 5 [0137.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.1cd") returned 0 [0137.017] lstrlenA (lpString="*.1cd") returned 5 [0137.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.md") returned 0 [0137.017] lstrlenA (lpString="*.md") returned 4 [0137.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.mdf") returned 0 [0137.017] lstrlenA (lpString="*.mdf") returned 5 [0137.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.dbf") returned 0 [0137.018] lstrlenA (lpString="*.dbf") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.odt") returned 0 [0137.018] lstrlenA (lpString="*.odt") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.vob") returned 0 [0137.018] lstrlenA (lpString="*.vob") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.ifo") returned 0 [0137.018] lstrlenA (lpString="*.ifo") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.lnk") returned 0 [0137.018] lstrlenA (lpString="*.lnk") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.torrent") returned 0 [0137.018] lstrlenA (lpString="*.torrent") returned 9 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.mov") returned 0 [0137.018] lstrlenA (lpString="*.mov") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.m2v") returned 0 [0137.018] lstrlenA (lpString="*.m2v") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.3gp") returned 0 [0137.018] lstrlenA (lpString="*.3gp") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0137.018] lstrlenA (lpString="*.mpeg") returned 6 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.mpg") returned 0 [0137.018] lstrlenA (lpString="*.mpg") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.flv") returned 0 [0137.018] lstrlenA (lpString="*.flv") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.avi") returned 0 [0137.018] lstrlenA (lpString="*.avi") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.mp4") returned 0 [0137.018] lstrlenA (lpString="*.mp4") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.wmv") returned 0 [0137.018] lstrlenA (lpString="*.wmv") returned 5 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.divx") returned 0 [0137.018] lstrlenA (lpString="*.divx") returned 6 [0137.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.mkv") returned 0 [0137.018] lstrlenA (lpString="*.mkv") returned 5 [0137.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.mp3") returned 0 [0137.019] lstrlenA (lpString="*.mp3") returned 5 [0137.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.wav") returned 0 [0137.019] lstrlenA (lpString="*.wav") returned 5 [0137.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.flac") returned 0 [0137.019] lstrlenA (lpString="*.flac") returned 6 [0137.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.ape") returned 0 [0137.019] lstrlenA (lpString="*.ape") returned 5 [0137.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.wma") returned 0 [0137.019] lstrlenA (lpString="*.wma") returned 5 [0137.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.ac3") returned 0 [0137.019] lstrlenA (lpString="*.ac3") returned 5 [0137.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Wed3937f9#\\228e24c27104905afe60c8aef65ecc48\\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.019] lstrlenA (lpString="*.doc") returned 5 [0137.019] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9304258b, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x9304258b, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux", cAlternateFileName="MICROS~1.AUX")) returned 0 [0137.019] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0137.020] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9304258b, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x9304258b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x9304258b, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="228e24c27104905afe60c8aef65ecc48", cAlternateFileName="228E24~1")) returned 0 [0137.020] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0137.020] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8ef398d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c3c3fc6, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c3c3fc6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="MIGUIControls", cAlternateFileName="MIGUIC~1")) returned 1 [0137.020] lstrcmpA (lpString1=".", lpString2="MIGUIControls") returned -1 [0137.020] lstrcmpA (lpString1="..", lpString2="MIGUIControls") returned -1 [0137.020] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.020] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="MIGUIControls" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls" [0137.020] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls") returned 60 [0137.020] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8ef398d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c3c3fc6, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c3c3fc6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0137.021] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.021] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8ef398d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c3c3fc6, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c3c3fc6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.021] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.021] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.021] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563ae894, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5644713d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5644713d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="556c80bc4842252afb6b5f54b4a8445f", cAlternateFileName="556C80~1")) returned 1 [0137.021] lstrcmpA (lpString1=".", lpString2="556c80bc4842252afb6b5f54b4a8445f") returned -1 [0137.021] lstrcmpA (lpString1="..", lpString2="556c80bc4842252afb6b5f54b4a8445f") returned -1 [0137.021] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\*.*") returned="*.*" [0137.021] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\", lpString2="556c80bc4842252afb6b5f54b4a8445f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f" [0137.021] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f") returned 93 [0137.021] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563ae894, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5644713d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5644713d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0137.022] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.022] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563ae894, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5644713d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5644713d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.022] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.022] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.022] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56315fe5, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x56315fe5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5646d379, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x6e1200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="MIGUIControls.ni.dll", cAlternateFileName="MIGUIC~1.DLL")) returned 1 [0137.022] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.022] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MIGUIControls.ni.dll") returned -1 [0137.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MIGUIControls.ni.dll") returned -1 [0137.022] lstrcmpiA (lpString1="", lpString2="MIGUIControls.ni.dll") returned -1 [0137.022] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\*.*") returned="*.*" [0137.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\" [0137.022] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\") returned="" [0137.022] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\HOW TO DECRYPT FILES.txt" [0137.022] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\miguicontrols\\556c80bc4842252afb6b5f54b4a8445f\\how to decrypt files.txt")) returned 0xffffffff [0137.022] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\miguicontrols\\556c80bc4842252afb6b5f54b4a8445f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.024] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0137.024] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0137.025] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.025] CloseHandle (hObject=0x214) returned 1 [0137.026] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\", lpString2="MIGUIControls.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll" [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.zip") returned 0 [0137.026] lstrlenA (lpString="*.zip") returned 5 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.rar") returned 0 [0137.026] lstrlenA (lpString="*.rar") returned 5 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.7z") returned 0 [0137.026] lstrlenA (lpString="*.7z") returned 4 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.tar") returned 0 [0137.026] lstrlenA (lpString="*.tar") returned 5 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.gzip") returned 0 [0137.026] lstrlenA (lpString="*.gzip") returned 6 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.jpg") returned 0 [0137.026] lstrlenA (lpString="*.jpg") returned 5 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.jpeg") returned 0 [0137.026] lstrlenA (lpString="*.jpeg") returned 6 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.psd") returned 0 [0137.026] lstrlenA (lpString="*.psd") returned 5 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.cdr") returned 0 [0137.026] lstrlenA (lpString="*.cdr") returned 5 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.dwg") returned 0 [0137.026] lstrlenA (lpString="*.dwg") returned 5 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.max") returned 0 [0137.026] lstrlenA (lpString="*.max") returned 5 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.bmp") returned 0 [0137.026] lstrlenA (lpString="*.bmp") returned 5 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.gif") returned 0 [0137.026] lstrlenA (lpString="*.gif") returned 5 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.png") returned 0 [0137.026] lstrlenA (lpString="*.png") returned 5 [0137.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.doc") returned 0 [0137.027] lstrlenA (lpString="*.doc") returned 5 [0137.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.docx") returned 0 [0137.027] lstrlenA (lpString="*.docx") returned 6 [0137.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.xls") returned 0 [0137.027] lstrlenA (lpString="*.xls") returned 5 [0137.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.xlsx") returned 0 [0137.027] lstrlenA (lpString="*.xlsx") returned 6 [0137.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.ppt") returned 0 [0137.027] lstrlenA (lpString="*.ppt") returned 5 [0137.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.pptx") returned 0 [0137.027] lstrlenA (lpString="*.pptx") returned 6 [0137.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.txt") returned 0 [0137.029] lstrlenA (lpString="*.txt") returned 5 [0137.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.pdf") returned 0 [0137.029] lstrlenA (lpString="*.pdf") returned 5 [0137.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.djvu") returned 0 [0137.029] lstrlenA (lpString="*.djvu") returned 6 [0137.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.htm") returned 0 [0137.029] lstrlenA (lpString="*.htm") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.html") returned 0 [0137.030] lstrlenA (lpString="*.html") returned 6 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.mdb") returned 0 [0137.030] lstrlenA (lpString="*.mdb") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.cer") returned 0 [0137.030] lstrlenA (lpString="*.cer") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.p12") returned 0 [0137.030] lstrlenA (lpString="*.p12") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.pfx") returned 0 [0137.030] lstrlenA (lpString="*.pfx") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.kwm") returned 0 [0137.030] lstrlenA (lpString="*.kwm") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.pwm") returned 0 [0137.030] lstrlenA (lpString="*.pwm") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.1cd") returned 0 [0137.030] lstrlenA (lpString="*.1cd") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.md") returned 0 [0137.030] lstrlenA (lpString="*.md") returned 4 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.mdf") returned 0 [0137.030] lstrlenA (lpString="*.mdf") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.dbf") returned 0 [0137.030] lstrlenA (lpString="*.dbf") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.odt") returned 0 [0137.030] lstrlenA (lpString="*.odt") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.vob") returned 0 [0137.030] lstrlenA (lpString="*.vob") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.ifo") returned 0 [0137.030] lstrlenA (lpString="*.ifo") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.lnk") returned 0 [0137.030] lstrlenA (lpString="*.lnk") returned 5 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.torrent") returned 0 [0137.030] lstrlenA (lpString="*.torrent") returned 9 [0137.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.mov") returned 0 [0137.030] lstrlenA (lpString="*.mov") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.m2v") returned 0 [0137.031] lstrlenA (lpString="*.m2v") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.3gp") returned 0 [0137.031] lstrlenA (lpString="*.3gp") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.mpeg") returned 0 [0137.031] lstrlenA (lpString="*.mpeg") returned 6 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.mpg") returned 0 [0137.031] lstrlenA (lpString="*.mpg") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.flv") returned 0 [0137.031] lstrlenA (lpString="*.flv") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.avi") returned 0 [0137.031] lstrlenA (lpString="*.avi") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.mp4") returned 0 [0137.031] lstrlenA (lpString="*.mp4") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.wmv") returned 0 [0137.031] lstrlenA (lpString="*.wmv") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.divx") returned 0 [0137.031] lstrlenA (lpString="*.divx") returned 6 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.mkv") returned 0 [0137.031] lstrlenA (lpString="*.mkv") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.mp3") returned 0 [0137.031] lstrlenA (lpString="*.mp3") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.wav") returned 0 [0137.031] lstrlenA (lpString="*.wav") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.flac") returned 0 [0137.031] lstrlenA (lpString="*.flac") returned 6 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.ape") returned 0 [0137.031] lstrlenA (lpString="*.ape") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.wma") returned 0 [0137.031] lstrlenA (lpString="*.wma") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.ac3") returned 0 [0137.031] lstrlenA (lpString="*.ac3") returned 5 [0137.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll", pszSpec="*.doc") returned 0 [0137.031] lstrlenA (lpString="*.doc") returned 5 [0137.031] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5644713d, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5644713d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5644713d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="MIGUIControls.ni.dll.aux", cAlternateFileName="MIGUIC~1.AUX")) returned 1 [0137.032] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MIGUIControls.ni.dll.aux") returned -1 [0137.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MIGUIControls.ni.dll.aux") returned -1 [0137.032] lstrcmpiA (lpString1="", lpString2="MIGUIControls.ni.dll.aux") returned -1 [0137.032] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll") returned="MIGUIControls.ni.dll" [0137.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\" [0137.032] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\") returned="" [0137.032] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\HOW TO DECRYPT FILES.txt" [0137.032] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\miguicontrols\\556c80bc4842252afb6b5f54b4a8445f\\how to decrypt files.txt")) returned 0x20 [0137.032] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\", lpString2="MIGUIControls.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux" [0137.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.zip") returned 0 [0137.032] lstrlenA (lpString="*.zip") returned 5 [0137.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.rar") returned 0 [0137.032] lstrlenA (lpString="*.rar") returned 5 [0137.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.7z") returned 0 [0137.032] lstrlenA (lpString="*.7z") returned 4 [0137.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.tar") returned 0 [0137.032] lstrlenA (lpString="*.tar") returned 5 [0137.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.gzip") returned 0 [0137.032] lstrlenA (lpString="*.gzip") returned 6 [0137.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.jpg") returned 0 [0137.032] lstrlenA (lpString="*.jpg") returned 5 [0137.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0137.032] lstrlenA (lpString="*.jpeg") returned 6 [0137.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.psd") returned 0 [0137.032] lstrlenA (lpString="*.psd") returned 5 [0137.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.cdr") returned 0 [0137.032] lstrlenA (lpString="*.cdr") returned 5 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.dwg") returned 0 [0137.033] lstrlenA (lpString="*.dwg") returned 5 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.max") returned 0 [0137.033] lstrlenA (lpString="*.max") returned 5 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.bmp") returned 0 [0137.033] lstrlenA (lpString="*.bmp") returned 5 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.gif") returned 0 [0137.033] lstrlenA (lpString="*.gif") returned 5 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.png") returned 0 [0137.033] lstrlenA (lpString="*.png") returned 5 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.033] lstrlenA (lpString="*.doc") returned 5 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.docx") returned 0 [0137.033] lstrlenA (lpString="*.docx") returned 6 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.xls") returned 0 [0137.033] lstrlenA (lpString="*.xls") returned 5 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0137.033] lstrlenA (lpString="*.xlsx") returned 6 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.ppt") returned 0 [0137.033] lstrlenA (lpString="*.ppt") returned 5 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.pptx") returned 0 [0137.033] lstrlenA (lpString="*.pptx") returned 6 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.txt") returned 0 [0137.033] lstrlenA (lpString="*.txt") returned 5 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.pdf") returned 0 [0137.033] lstrlenA (lpString="*.pdf") returned 5 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.djvu") returned 0 [0137.033] lstrlenA (lpString="*.djvu") returned 6 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.htm") returned 0 [0137.033] lstrlenA (lpString="*.htm") returned 5 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.html") returned 0 [0137.033] lstrlenA (lpString="*.html") returned 6 [0137.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.mdb") returned 0 [0137.033] lstrlenA (lpString="*.mdb") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.cer") returned 0 [0137.034] lstrlenA (lpString="*.cer") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.p12") returned 0 [0137.034] lstrlenA (lpString="*.p12") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.pfx") returned 0 [0137.034] lstrlenA (lpString="*.pfx") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.kwm") returned 0 [0137.034] lstrlenA (lpString="*.kwm") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.pwm") returned 0 [0137.034] lstrlenA (lpString="*.pwm") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.1cd") returned 0 [0137.034] lstrlenA (lpString="*.1cd") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.md") returned 0 [0137.034] lstrlenA (lpString="*.md") returned 4 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.mdf") returned 0 [0137.034] lstrlenA (lpString="*.mdf") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.dbf") returned 0 [0137.034] lstrlenA (lpString="*.dbf") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.odt") returned 0 [0137.034] lstrlenA (lpString="*.odt") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.vob") returned 0 [0137.034] lstrlenA (lpString="*.vob") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.ifo") returned 0 [0137.034] lstrlenA (lpString="*.ifo") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.lnk") returned 0 [0137.034] lstrlenA (lpString="*.lnk") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.torrent") returned 0 [0137.034] lstrlenA (lpString="*.torrent") returned 9 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.mov") returned 0 [0137.034] lstrlenA (lpString="*.mov") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.m2v") returned 0 [0137.034] lstrlenA (lpString="*.m2v") returned 5 [0137.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.3gp") returned 0 [0137.034] lstrlenA (lpString="*.3gp") returned 5 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0137.035] lstrlenA (lpString="*.mpeg") returned 6 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.mpg") returned 0 [0137.035] lstrlenA (lpString="*.mpg") returned 5 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.flv") returned 0 [0137.035] lstrlenA (lpString="*.flv") returned 5 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.avi") returned 0 [0137.035] lstrlenA (lpString="*.avi") returned 5 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.mp4") returned 0 [0137.035] lstrlenA (lpString="*.mp4") returned 5 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.wmv") returned 0 [0137.035] lstrlenA (lpString="*.wmv") returned 5 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.divx") returned 0 [0137.035] lstrlenA (lpString="*.divx") returned 6 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.mkv") returned 0 [0137.035] lstrlenA (lpString="*.mkv") returned 5 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.mp3") returned 0 [0137.035] lstrlenA (lpString="*.mp3") returned 5 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.wav") returned 0 [0137.035] lstrlenA (lpString="*.wav") returned 5 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.flac") returned 0 [0137.035] lstrlenA (lpString="*.flac") returned 6 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.ape") returned 0 [0137.035] lstrlenA (lpString="*.ape") returned 5 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.wma") returned 0 [0137.035] lstrlenA (lpString="*.wma") returned 5 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.ac3") returned 0 [0137.035] lstrlenA (lpString="*.ac3") returned 5 [0137.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MIGUIControls\\556c80bc4842252afb6b5f54b4a8445f\\MIGUIControls.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.035] lstrlenA (lpString="*.doc") returned 5 [0137.035] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5644713d, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5644713d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5644713d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="MIGUIControls.ni.dll.aux", cAlternateFileName="MIGUIC~1.AUX")) returned 0 [0137.035] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0137.036] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563ae894, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5644713d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5644713d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="556c80bc4842252afb6b5f54b4a8445f", cAlternateFileName="556C80~1")) returned 0 [0137.036] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0137.036] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8c44f26, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c410425, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c410425, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="MMCEx", cAlternateFileName="")) returned 1 [0137.036] lstrcmpA (lpString1=".", lpString2="MMCEx") returned -1 [0137.036] lstrcmpA (lpString1="..", lpString2="MMCEx") returned -1 [0137.036] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.036] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="MMCEx" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx" [0137.036] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx") returned 52 [0137.036] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8c44f26, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c410425, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c410425, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0137.037] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.037] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8c44f26, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c410425, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c410425, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.037] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.037] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.037] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x575b4f78, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x575db13a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x575db13a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4356a7343313b6f92700d304505fa5eb", cAlternateFileName="4356A7~1")) returned 1 [0137.037] lstrcmpA (lpString1=".", lpString2="4356a7343313b6f92700d304505fa5eb") returned -1 [0137.037] lstrcmpA (lpString1="..", lpString2="4356a7343313b6f92700d304505fa5eb") returned -1 [0137.037] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\*.*") returned="*.*" [0137.037] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\", lpString2="4356a7343313b6f92700d304505fa5eb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb" [0137.037] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb") returned 85 [0137.037] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x575b4f78, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x575db13a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x575db13a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0137.038] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.038] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x575b4f78, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x575db13a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x575db13a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.038] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.038] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.038] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5758ed16, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5758ed16, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x575db13a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x204600, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="MMCEx.ni.dll", cAlternateFileName="MMCEXN~1.DLL")) returned 1 [0137.038] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.038] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMCEx.ni.dll") returned -1 [0137.038] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMCEx.ni.dll") returned -1 [0137.038] lstrcmpiA (lpString1="", lpString2="MMCEx.ni.dll") returned -1 [0137.038] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\*.*") returned="*.*" [0137.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\" [0137.038] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\") returned="" [0137.038] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\HOW TO DECRYPT FILES.txt" [0137.038] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mmcex\\4356a7343313b6f92700d304505fa5eb\\how to decrypt files.txt")) returned 0xffffffff [0137.038] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mmcex\\4356a7343313b6f92700d304505fa5eb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.040] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0137.040] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0137.041] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.041] CloseHandle (hObject=0x214) returned 1 [0137.042] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\", lpString2="MMCEx.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll" [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.zip") returned 0 [0137.042] lstrlenA (lpString="*.zip") returned 5 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.rar") returned 0 [0137.042] lstrlenA (lpString="*.rar") returned 5 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.7z") returned 0 [0137.042] lstrlenA (lpString="*.7z") returned 4 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.tar") returned 0 [0137.042] lstrlenA (lpString="*.tar") returned 5 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.gzip") returned 0 [0137.042] lstrlenA (lpString="*.gzip") returned 6 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.jpg") returned 0 [0137.042] lstrlenA (lpString="*.jpg") returned 5 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.jpeg") returned 0 [0137.042] lstrlenA (lpString="*.jpeg") returned 6 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.psd") returned 0 [0137.042] lstrlenA (lpString="*.psd") returned 5 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.cdr") returned 0 [0137.042] lstrlenA (lpString="*.cdr") returned 5 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.dwg") returned 0 [0137.042] lstrlenA (lpString="*.dwg") returned 5 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.max") returned 0 [0137.042] lstrlenA (lpString="*.max") returned 5 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.bmp") returned 0 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.gif") returned 0 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.png") returned 0 [0137.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.doc") returned 0 [0137.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.docx") returned 0 [0137.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.xls") returned 0 [0137.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.xlsx") returned 0 [0137.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.ppt") returned 0 [0137.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.pptx") returned 0 [0137.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.txt") returned 0 [0137.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.pdf") returned 0 [0137.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.djvu") returned 0 [0137.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.htm") returned 0 [0137.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.html") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.mdb") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.cer") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.p12") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.pfx") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.kwm") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.pwm") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.1cd") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.md") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.mdf") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.dbf") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.odt") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.vob") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.ifo") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.lnk") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.torrent") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.mov") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.m2v") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.3gp") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.mpeg") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.mpg") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.flv") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.avi") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.mp4") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.wmv") returned 0 [0137.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.divx") returned 0 [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.mkv") returned 0 [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.mp3") returned 0 [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.wav") returned 0 [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.flac") returned 0 [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.ape") returned 0 [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.wma") returned 0 [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.ac3") returned 0 [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll", pszSpec="*.doc") returned 0 [0137.045] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575db13a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x575db13a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x575db13a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMCEx.ni.dll.aux", cAlternateFileName="MMCEXN~1.AUX")) returned 1 [0137.045] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.045] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMCEx.ni.dll.aux") returned -1 [0137.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMCEx.ni.dll.aux") returned -1 [0137.045] lstrcmpiA (lpString1="", lpString2="MMCEx.ni.dll.aux") returned -1 [0137.045] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll") returned="MMCEx.ni.dll" [0137.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\" [0137.045] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\") returned="" [0137.045] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\HOW TO DECRYPT FILES.txt" [0137.045] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mmcex\\4356a7343313b6f92700d304505fa5eb\\how to decrypt files.txt")) returned 0x20 [0137.045] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\", lpString2="MMCEx.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux" [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.zip") returned 0 [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.rar") returned 0 [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.7z") returned 0 [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.tar") returned 0 [0137.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.gzip") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.jpg") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.psd") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.cdr") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.dwg") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.max") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.bmp") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.gif") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.png") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.docx") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.xls") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.ppt") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.pptx") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.txt") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.pdf") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.djvu") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.htm") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.html") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.mdb") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.cer") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.p12") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.pfx") returned 0 [0137.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.kwm") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.pwm") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.1cd") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.md") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.mdf") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.dbf") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.odt") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.vob") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.ifo") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.lnk") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.torrent") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.mov") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.m2v") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.3gp") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.mpg") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.flv") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.avi") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.mp4") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.wmv") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.divx") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.mkv") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.mp3") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.wav") returned 0 [0137.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.flac") returned 0 [0137.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.ape") returned 0 [0137.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.wma") returned 0 [0137.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.ac3") returned 0 [0137.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCEx\\4356a7343313b6f92700d304505fa5eb\\MMCEx.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.048] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575db13a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x575db13a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x575db13a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMCEx.ni.dll.aux", cAlternateFileName="MMCEXN~1.AUX")) returned 0 [0137.048] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0137.048] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x575b4f78, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x575db13a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x575db13a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4356a7343313b6f92700d304505fa5eb", cAlternateFileName="4356A7~1")) returned 0 [0137.048] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0137.048] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e5b00c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c45c875, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c45c875, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="MMCFxCommon", cAlternateFileName="MMCFXC~1")) returned 1 [0137.048] lstrcmpA (lpString1=".", lpString2="MMCFxCommon") returned -1 [0137.048] lstrcmpA (lpString1="..", lpString2="MMCFxCommon") returned -1 [0137.048] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.048] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="MMCFxCommon" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon" [0137.048] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e5b00c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c45c875, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c45c875, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0137.050] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.050] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e5b00c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c45c875, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c45c875, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.050] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.050] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.050] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5794831b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5794831b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5794831b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11523d9092f841985b48f205cd7f73db", cAlternateFileName="11523D~1")) returned 1 [0137.050] lstrcmpA (lpString1=".", lpString2="11523d9092f841985b48f205cd7f73db") returned -1 [0137.050] lstrcmpA (lpString1="..", lpString2="11523d9092f841985b48f205cd7f73db") returned -1 [0137.050] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\*.*") returned="*.*" [0137.050] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\", lpString2="11523d9092f841985b48f205cd7f73db" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db" [0137.050] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5794831b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5794831b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5794831b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0137.051] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.051] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5794831b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5794831b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5794831b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.051] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.051] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.051] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5794831b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5794831b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5794831b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4d400, dwReserved0=0x2, dwReserved1=0x0, cFileName="MMCFxCommon.ni.dll", cAlternateFileName="MMCFXC~1.DLL")) returned 1 [0137.051] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMCFxCommon.ni.dll") returned -1 [0137.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMCFxCommon.ni.dll") returned -1 [0137.051] lstrcmpiA (lpString1="", lpString2="MMCFxCommon.ni.dll") returned -1 [0137.051] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\*.*") returned="*.*" [0137.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\" [0137.051] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\") returned="" [0137.051] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\HOW TO DECRYPT FILES.txt" [0137.051] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mmcfxcommon\\11523d9092f841985b48f205cd7f73db\\how to decrypt files.txt")) returned 0xffffffff [0137.051] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mmcfxcommon\\11523d9092f841985b48f205cd7f73db\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.053] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0137.054] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.054] CloseHandle (hObject=0x214) returned 1 [0137.055] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\", lpString2="MMCFxCommon.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll" [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.zip") returned 0 [0137.055] lstrlenA (lpString="*.zip") returned 5 [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.rar") returned 0 [0137.055] lstrlenA (lpString="*.rar") returned 5 [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.7z") returned 0 [0137.055] lstrlenA (lpString="*.7z") returned 4 [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.tar") returned 0 [0137.055] lstrlenA (lpString="*.tar") returned 5 [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.gzip") returned 0 [0137.055] lstrlenA (lpString="*.gzip") returned 6 [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.jpg") returned 0 [0137.055] lstrlenA (lpString="*.jpg") returned 5 [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.jpeg") returned 0 [0137.055] lstrlenA (lpString="*.jpeg") returned 6 [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.psd") returned 0 [0137.055] lstrlenA (lpString="*.psd") returned 5 [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.cdr") returned 0 [0137.055] lstrlenA (lpString="*.cdr") returned 5 [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.dwg") returned 0 [0137.055] lstrlenA (lpString="*.dwg") returned 5 [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.max") returned 0 [0137.055] lstrlenA (lpString="*.max") returned 5 [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.bmp") returned 0 [0137.055] lstrlenA (lpString="*.bmp") returned 5 [0137.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.gif") returned 0 [0137.055] lstrlenA (lpString="*.gif") returned 5 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.png") returned 0 [0137.056] lstrlenA (lpString="*.png") returned 5 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.doc") returned 0 [0137.056] lstrlenA (lpString="*.doc") returned 5 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.docx") returned 0 [0137.056] lstrlenA (lpString="*.docx") returned 6 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.xls") returned 0 [0137.056] lstrlenA (lpString="*.xls") returned 5 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.xlsx") returned 0 [0137.056] lstrlenA (lpString="*.xlsx") returned 6 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.ppt") returned 0 [0137.056] lstrlenA (lpString="*.ppt") returned 5 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.pptx") returned 0 [0137.056] lstrlenA (lpString="*.pptx") returned 6 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.txt") returned 0 [0137.056] lstrlenA (lpString="*.txt") returned 5 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.pdf") returned 0 [0137.056] lstrlenA (lpString="*.pdf") returned 5 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.djvu") returned 0 [0137.056] lstrlenA (lpString="*.djvu") returned 6 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.htm") returned 0 [0137.056] lstrlenA (lpString="*.htm") returned 5 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.html") returned 0 [0137.056] lstrlenA (lpString="*.html") returned 6 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.mdb") returned 0 [0137.056] lstrlenA (lpString="*.mdb") returned 5 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.cer") returned 0 [0137.056] lstrlenA (lpString="*.cer") returned 5 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.p12") returned 0 [0137.056] lstrlenA (lpString="*.p12") returned 5 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.pfx") returned 0 [0137.056] lstrlenA (lpString="*.pfx") returned 5 [0137.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.kwm") returned 0 [0137.057] lstrlenA (lpString="*.kwm") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.pwm") returned 0 [0137.057] lstrlenA (lpString="*.pwm") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.1cd") returned 0 [0137.057] lstrlenA (lpString="*.1cd") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.md") returned 0 [0137.057] lstrlenA (lpString="*.md") returned 4 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.mdf") returned 0 [0137.057] lstrlenA (lpString="*.mdf") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.dbf") returned 0 [0137.057] lstrlenA (lpString="*.dbf") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.odt") returned 0 [0137.057] lstrlenA (lpString="*.odt") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.vob") returned 0 [0137.057] lstrlenA (lpString="*.vob") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.ifo") returned 0 [0137.057] lstrlenA (lpString="*.ifo") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.lnk") returned 0 [0137.057] lstrlenA (lpString="*.lnk") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.torrent") returned 0 [0137.057] lstrlenA (lpString="*.torrent") returned 9 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.mov") returned 0 [0137.057] lstrlenA (lpString="*.mov") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.m2v") returned 0 [0137.057] lstrlenA (lpString="*.m2v") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.3gp") returned 0 [0137.057] lstrlenA (lpString="*.3gp") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.mpeg") returned 0 [0137.057] lstrlenA (lpString="*.mpeg") returned 6 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.mpg") returned 0 [0137.057] lstrlenA (lpString="*.mpg") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.flv") returned 0 [0137.057] lstrlenA (lpString="*.flv") returned 5 [0137.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.avi") returned 0 [0137.058] lstrlenA (lpString="*.avi") returned 5 [0137.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.mp4") returned 0 [0137.058] lstrlenA (lpString="*.mp4") returned 5 [0137.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.wmv") returned 0 [0137.058] lstrlenA (lpString="*.wmv") returned 5 [0137.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.divx") returned 0 [0137.058] lstrlenA (lpString="*.divx") returned 6 [0137.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.mkv") returned 0 [0137.058] lstrlenA (lpString="*.mkv") returned 5 [0137.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.mp3") returned 0 [0137.058] lstrlenA (lpString="*.mp3") returned 5 [0137.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.wav") returned 0 [0137.058] lstrlenA (lpString="*.wav") returned 5 [0137.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.flac") returned 0 [0137.058] lstrlenA (lpString="*.flac") returned 6 [0137.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.ape") returned 0 [0137.058] lstrlenA (lpString="*.ape") returned 5 [0137.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.wma") returned 0 [0137.058] lstrlenA (lpString="*.wma") returned 5 [0137.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.ac3") returned 0 [0137.069] lstrlenA (lpString="*.ac3") returned 5 [0137.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll", pszSpec="*.doc") returned 0 [0137.069] lstrlenA (lpString="*.doc") returned 5 [0137.069] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5794831b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5794831b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5794831b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMCFxCommon.ni.dll.aux", cAlternateFileName="MMCFXC~1.AUX")) returned 1 [0137.070] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMCFxCommon.ni.dll.aux") returned -1 [0137.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMCFxCommon.ni.dll.aux") returned -1 [0137.070] lstrcmpiA (lpString1="", lpString2="MMCFxCommon.ni.dll.aux") returned -1 [0137.070] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll") returned="MMCFxCommon.ni.dll" [0137.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\" [0137.070] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\") returned="" [0137.070] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\HOW TO DECRYPT FILES.txt" [0137.070] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mmcfxcommon\\11523d9092f841985b48f205cd7f73db\\how to decrypt files.txt")) returned 0x20 [0137.070] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\", lpString2="MMCFxCommon.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux" [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.zip") returned 0 [0137.070] lstrlenA (lpString="*.zip") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.rar") returned 0 [0137.070] lstrlenA (lpString="*.rar") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.7z") returned 0 [0137.070] lstrlenA (lpString="*.7z") returned 4 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.tar") returned 0 [0137.070] lstrlenA (lpString="*.tar") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.gzip") returned 0 [0137.070] lstrlenA (lpString="*.gzip") returned 6 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.jpg") returned 0 [0137.070] lstrlenA (lpString="*.jpg") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0137.070] lstrlenA (lpString="*.jpeg") returned 6 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.psd") returned 0 [0137.070] lstrlenA (lpString="*.psd") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.cdr") returned 0 [0137.070] lstrlenA (lpString="*.cdr") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.dwg") returned 0 [0137.071] lstrlenA (lpString="*.dwg") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.max") returned 0 [0137.071] lstrlenA (lpString="*.max") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.bmp") returned 0 [0137.071] lstrlenA (lpString="*.bmp") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.gif") returned 0 [0137.071] lstrlenA (lpString="*.gif") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.png") returned 0 [0137.071] lstrlenA (lpString="*.png") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.071] lstrlenA (lpString="*.doc") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.docx") returned 0 [0137.071] lstrlenA (lpString="*.docx") returned 6 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.xls") returned 0 [0137.071] lstrlenA (lpString="*.xls") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0137.071] lstrlenA (lpString="*.xlsx") returned 6 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.ppt") returned 0 [0137.071] lstrlenA (lpString="*.ppt") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.pptx") returned 0 [0137.071] lstrlenA (lpString="*.pptx") returned 6 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.txt") returned 0 [0137.071] lstrlenA (lpString="*.txt") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.pdf") returned 0 [0137.071] lstrlenA (lpString="*.pdf") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.djvu") returned 0 [0137.071] lstrlenA (lpString="*.djvu") returned 6 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.htm") returned 0 [0137.071] lstrlenA (lpString="*.htm") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.html") returned 0 [0137.071] lstrlenA (lpString="*.html") returned 6 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.mdb") returned 0 [0137.071] lstrlenA (lpString="*.mdb") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.cer") returned 0 [0137.072] lstrlenA (lpString="*.cer") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.p12") returned 0 [0137.072] lstrlenA (lpString="*.p12") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.pfx") returned 0 [0137.072] lstrlenA (lpString="*.pfx") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.kwm") returned 0 [0137.072] lstrlenA (lpString="*.kwm") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.pwm") returned 0 [0137.072] lstrlenA (lpString="*.pwm") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.1cd") returned 0 [0137.072] lstrlenA (lpString="*.1cd") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.md") returned 0 [0137.072] lstrlenA (lpString="*.md") returned 4 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.mdf") returned 0 [0137.072] lstrlenA (lpString="*.mdf") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.dbf") returned 0 [0137.072] lstrlenA (lpString="*.dbf") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.odt") returned 0 [0137.072] lstrlenA (lpString="*.odt") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.vob") returned 0 [0137.072] lstrlenA (lpString="*.vob") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.ifo") returned 0 [0137.072] lstrlenA (lpString="*.ifo") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.lnk") returned 0 [0137.072] lstrlenA (lpString="*.lnk") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.torrent") returned 0 [0137.072] lstrlenA (lpString="*.torrent") returned 9 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.mov") returned 0 [0137.072] lstrlenA (lpString="*.mov") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.m2v") returned 0 [0137.072] lstrlenA (lpString="*.m2v") returned 5 [0137.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.3gp") returned 0 [0137.072] lstrlenA (lpString="*.3gp") returned 5 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0137.073] lstrlenA (lpString="*.mpeg") returned 6 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.mpg") returned 0 [0137.073] lstrlenA (lpString="*.mpg") returned 5 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.flv") returned 0 [0137.073] lstrlenA (lpString="*.flv") returned 5 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.avi") returned 0 [0137.073] lstrlenA (lpString="*.avi") returned 5 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.mp4") returned 0 [0137.073] lstrlenA (lpString="*.mp4") returned 5 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.wmv") returned 0 [0137.073] lstrlenA (lpString="*.wmv") returned 5 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.divx") returned 0 [0137.073] lstrlenA (lpString="*.divx") returned 6 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.mkv") returned 0 [0137.073] lstrlenA (lpString="*.mkv") returned 5 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.mp3") returned 0 [0137.073] lstrlenA (lpString="*.mp3") returned 5 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.wav") returned 0 [0137.073] lstrlenA (lpString="*.wav") returned 5 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.flac") returned 0 [0137.073] lstrlenA (lpString="*.flac") returned 6 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.ape") returned 0 [0137.073] lstrlenA (lpString="*.ape") returned 5 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.wma") returned 0 [0137.073] lstrlenA (lpString="*.wma") returned 5 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.ac3") returned 0 [0137.073] lstrlenA (lpString="*.ac3") returned 5 [0137.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MMCFxCommon\\11523d9092f841985b48f205cd7f73db\\MMCFxCommon.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.073] lstrlenA (lpString="*.doc") returned 5 [0137.073] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5794831b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5794831b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5794831b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMCFxCommon.ni.dll.aux", cAlternateFileName="MMCFXC~1.AUX")) returned 0 [0137.073] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0137.077] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5794831b, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x5794831b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5794831b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11523d9092f841985b48f205cd7f73db", cAlternateFileName="11523D~1")) returned 0 [0137.077] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0137.078] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7b2204d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c70af7c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c70af7c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="mscorlib", cAlternateFileName="")) returned 1 [0137.078] lstrcmpA (lpString1=".", lpString2="mscorlib") returned -1 [0137.078] lstrcmpA (lpString1="..", lpString2="mscorlib") returned -1 [0137.078] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.078] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="mscorlib" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib" [0137.078] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib") returned 55 [0137.078] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7b2204d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c70af7c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c70af7c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759fd0 [0137.078] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.078] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7b2204d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c70af7c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c70af7c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.078] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.078] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.078] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3287c60b, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3296142a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3296142a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ef49acbb43c068f6ddf1587283b5f29", cAlternateFileName="2EF49A~1")) returned 1 [0137.078] lstrcmpA (lpString1=".", lpString2="2ef49acbb43c068f6ddf1587283b5f29") returned -1 [0137.078] lstrcmpA (lpString1="..", lpString2="2ef49acbb43c068f6ddf1587283b5f29") returned -1 [0137.078] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\*.*") returned="*.*" [0137.078] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\", lpString2="2ef49acbb43c068f6ddf1587283b5f29" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29" [0137.079] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29") returned 88 [0137.079] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3287c60b, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3296142a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3296142a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0137.079] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.079] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3287c60b, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3296142a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3296142a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.079] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.079] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.079] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325a7ac6, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x325a7ac6, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x78478ac7, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x1581ca0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="mscorlib.ni.dll", cAlternateFileName="MSCORL~1.DLL")) returned 1 [0137.079] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorlib.ni.dll") returned -1 [0137.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorlib.ni.dll") returned -1 [0137.080] lstrcmpiA (lpString1="", lpString2="mscorlib.ni.dll") returned -1 [0137.080] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\*.*") returned="*.*" [0137.080] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\" [0137.080] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\") returned="" [0137.080] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\HOW TO DECRYPT FILES.txt" [0137.080] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\how to decrypt files.txt")) returned 0xffffffff [0137.080] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.082] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0137.082] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0137.083] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.083] CloseHandle (hObject=0x214) returned 1 [0137.084] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\", lpString2="mscorlib.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll" [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.zip") returned 0 [0137.084] lstrlenA (lpString="*.zip") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.rar") returned 0 [0137.084] lstrlenA (lpString="*.rar") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.7z") returned 0 [0137.084] lstrlenA (lpString="*.7z") returned 4 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.tar") returned 0 [0137.084] lstrlenA (lpString="*.tar") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.gzip") returned 0 [0137.084] lstrlenA (lpString="*.gzip") returned 6 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.jpg") returned 0 [0137.084] lstrlenA (lpString="*.jpg") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.jpeg") returned 0 [0137.084] lstrlenA (lpString="*.jpeg") returned 6 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.psd") returned 0 [0137.084] lstrlenA (lpString="*.psd") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.cdr") returned 0 [0137.084] lstrlenA (lpString="*.cdr") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.dwg") returned 0 [0137.084] lstrlenA (lpString="*.dwg") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.max") returned 0 [0137.084] lstrlenA (lpString="*.max") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.bmp") returned 0 [0137.084] lstrlenA (lpString="*.bmp") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.gif") returned 0 [0137.084] lstrlenA (lpString="*.gif") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.png") returned 0 [0137.084] lstrlenA (lpString="*.png") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.doc") returned 0 [0137.084] lstrlenA (lpString="*.doc") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.docx") returned 0 [0137.084] lstrlenA (lpString="*.docx") returned 6 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.xls") returned 0 [0137.085] lstrlenA (lpString="*.xls") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.xlsx") returned 0 [0137.085] lstrlenA (lpString="*.xlsx") returned 6 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.ppt") returned 0 [0137.085] lstrlenA (lpString="*.ppt") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.pptx") returned 0 [0137.085] lstrlenA (lpString="*.pptx") returned 6 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.txt") returned 0 [0137.085] lstrlenA (lpString="*.txt") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.pdf") returned 0 [0137.085] lstrlenA (lpString="*.pdf") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.djvu") returned 0 [0137.085] lstrlenA (lpString="*.djvu") returned 6 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.htm") returned 0 [0137.085] lstrlenA (lpString="*.htm") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.html") returned 0 [0137.085] lstrlenA (lpString="*.html") returned 6 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.mdb") returned 0 [0137.085] lstrlenA (lpString="*.mdb") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.cer") returned 0 [0137.085] lstrlenA (lpString="*.cer") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.p12") returned 0 [0137.085] lstrlenA (lpString="*.p12") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.pfx") returned 0 [0137.085] lstrlenA (lpString="*.pfx") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.kwm") returned 0 [0137.085] lstrlenA (lpString="*.kwm") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.pwm") returned 0 [0137.085] lstrlenA (lpString="*.pwm") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.1cd") returned 0 [0137.085] lstrlenA (lpString="*.1cd") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.md") returned 0 [0137.085] lstrlenA (lpString="*.md") returned 4 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.mdf") returned 0 [0137.086] lstrlenA (lpString="*.mdf") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.dbf") returned 0 [0137.086] lstrlenA (lpString="*.dbf") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.odt") returned 0 [0137.086] lstrlenA (lpString="*.odt") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.vob") returned 0 [0137.086] lstrlenA (lpString="*.vob") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.ifo") returned 0 [0137.086] lstrlenA (lpString="*.ifo") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.lnk") returned 0 [0137.086] lstrlenA (lpString="*.lnk") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.torrent") returned 0 [0137.086] lstrlenA (lpString="*.torrent") returned 9 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.mov") returned 0 [0137.086] lstrlenA (lpString="*.mov") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.m2v") returned 0 [0137.086] lstrlenA (lpString="*.m2v") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.3gp") returned 0 [0137.086] lstrlenA (lpString="*.3gp") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.mpeg") returned 0 [0137.086] lstrlenA (lpString="*.mpeg") returned 6 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.mpg") returned 0 [0137.086] lstrlenA (lpString="*.mpg") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.flv") returned 0 [0137.086] lstrlenA (lpString="*.flv") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.avi") returned 0 [0137.086] lstrlenA (lpString="*.avi") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.mp4") returned 0 [0137.086] lstrlenA (lpString="*.mp4") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.wmv") returned 0 [0137.086] lstrlenA (lpString="*.wmv") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.divx") returned 0 [0137.086] lstrlenA (lpString="*.divx") returned 6 [0137.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.mkv") returned 0 [0137.087] lstrlenA (lpString="*.mkv") returned 5 [0137.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.mp3") returned 0 [0137.087] lstrlenA (lpString="*.mp3") returned 5 [0137.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.wav") returned 0 [0137.087] lstrlenA (lpString="*.wav") returned 5 [0137.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.flac") returned 0 [0137.087] lstrlenA (lpString="*.flac") returned 6 [0137.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.ape") returned 0 [0137.087] lstrlenA (lpString="*.ape") returned 5 [0137.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.wma") returned 0 [0137.087] lstrlenA (lpString="*.wma") returned 5 [0137.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.ac3") returned 0 [0137.087] lstrlenA (lpString="*.ac3") returned 5 [0137.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll", pszSpec="*.doc") returned 0 [0137.087] lstrlenA (lpString="*.doc") returned 5 [0137.087] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3296142a, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3296142a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3296142a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorlib.ni.dll.aux", cAlternateFileName="MSCORL~1.AUX")) returned 1 [0137.087] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.087] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorlib.ni.dll.aux") returned -1 [0137.087] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorlib.ni.dll.aux") returned -1 [0137.087] lstrcmpiA (lpString1="", lpString2="mscorlib.ni.dll.aux") returned -1 [0137.087] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll") returned="mscorlib.ni.dll" [0137.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\" [0137.087] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\") returned="" [0137.087] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\HOW TO DECRYPT FILES.txt" [0137.087] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\how to decrypt files.txt")) returned 0x20 [0137.087] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\", lpString2="mscorlib.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux" [0137.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.zip") returned 0 [0137.087] lstrlenA (lpString="*.zip") returned 5 [0137.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.rar") returned 0 [0137.088] lstrlenA (lpString="*.rar") returned 5 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.7z") returned 0 [0137.088] lstrlenA (lpString="*.7z") returned 4 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.tar") returned 0 [0137.088] lstrlenA (lpString="*.tar") returned 5 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.gzip") returned 0 [0137.088] lstrlenA (lpString="*.gzip") returned 6 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.jpg") returned 0 [0137.088] lstrlenA (lpString="*.jpg") returned 5 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0137.088] lstrlenA (lpString="*.jpeg") returned 6 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.psd") returned 0 [0137.088] lstrlenA (lpString="*.psd") returned 5 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.cdr") returned 0 [0137.088] lstrlenA (lpString="*.cdr") returned 5 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.dwg") returned 0 [0137.088] lstrlenA (lpString="*.dwg") returned 5 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.max") returned 0 [0137.088] lstrlenA (lpString="*.max") returned 5 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.bmp") returned 0 [0137.088] lstrlenA (lpString="*.bmp") returned 5 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.gif") returned 0 [0137.088] lstrlenA (lpString="*.gif") returned 5 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.png") returned 0 [0137.088] lstrlenA (lpString="*.png") returned 5 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.088] lstrlenA (lpString="*.doc") returned 5 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.docx") returned 0 [0137.088] lstrlenA (lpString="*.docx") returned 6 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.xls") returned 0 [0137.088] lstrlenA (lpString="*.xls") returned 5 [0137.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0137.088] lstrlenA (lpString="*.xlsx") returned 6 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.ppt") returned 0 [0137.089] lstrlenA (lpString="*.ppt") returned 5 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.pptx") returned 0 [0137.089] lstrlenA (lpString="*.pptx") returned 6 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.txt") returned 0 [0137.089] lstrlenA (lpString="*.txt") returned 5 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.pdf") returned 0 [0137.089] lstrlenA (lpString="*.pdf") returned 5 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.djvu") returned 0 [0137.089] lstrlenA (lpString="*.djvu") returned 6 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.htm") returned 0 [0137.089] lstrlenA (lpString="*.htm") returned 5 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.html") returned 0 [0137.089] lstrlenA (lpString="*.html") returned 6 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.mdb") returned 0 [0137.089] lstrlenA (lpString="*.mdb") returned 5 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.cer") returned 0 [0137.089] lstrlenA (lpString="*.cer") returned 5 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.p12") returned 0 [0137.089] lstrlenA (lpString="*.p12") returned 5 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.pfx") returned 0 [0137.089] lstrlenA (lpString="*.pfx") returned 5 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.kwm") returned 0 [0137.089] lstrlenA (lpString="*.kwm") returned 5 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.pwm") returned 0 [0137.089] lstrlenA (lpString="*.pwm") returned 5 [0137.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.1cd") returned 0 [0137.141] lstrlenA (lpString="*.1cd") returned 5 [0137.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.md") returned 0 [0137.141] lstrlenA (lpString="*.md") returned 4 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.mdf") returned 0 [0137.142] lstrlenA (lpString="*.mdf") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.dbf") returned 0 [0137.142] lstrlenA (lpString="*.dbf") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.odt") returned 0 [0137.142] lstrlenA (lpString="*.odt") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.vob") returned 0 [0137.142] lstrlenA (lpString="*.vob") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.ifo") returned 0 [0137.142] lstrlenA (lpString="*.ifo") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.lnk") returned 0 [0137.142] lstrlenA (lpString="*.lnk") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.torrent") returned 0 [0137.142] lstrlenA (lpString="*.torrent") returned 9 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.mov") returned 0 [0137.142] lstrlenA (lpString="*.mov") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.m2v") returned 0 [0137.142] lstrlenA (lpString="*.m2v") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.3gp") returned 0 [0137.142] lstrlenA (lpString="*.3gp") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0137.142] lstrlenA (lpString="*.mpeg") returned 6 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.mpg") returned 0 [0137.142] lstrlenA (lpString="*.mpg") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.flv") returned 0 [0137.142] lstrlenA (lpString="*.flv") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.avi") returned 0 [0137.142] lstrlenA (lpString="*.avi") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.mp4") returned 0 [0137.142] lstrlenA (lpString="*.mp4") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.wmv") returned 0 [0137.142] lstrlenA (lpString="*.wmv") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.divx") returned 0 [0137.143] lstrlenA (lpString="*.divx") returned 6 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.mkv") returned 0 [0137.143] lstrlenA (lpString="*.mkv") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.mp3") returned 0 [0137.143] lstrlenA (lpString="*.mp3") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.wav") returned 0 [0137.143] lstrlenA (lpString="*.wav") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.flac") returned 0 [0137.143] lstrlenA (lpString="*.flac") returned 6 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.ape") returned 0 [0137.143] lstrlenA (lpString="*.ape") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.wma") returned 0 [0137.143] lstrlenA (lpString="*.wma") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.ac3") returned 0 [0137.143] lstrlenA (lpString="*.ac3") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\2ef49acbb43c068f6ddf1587283b5f29\\mscorlib.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.143] lstrlenA (lpString="*.doc") returned 5 [0137.143] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3296142a, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3296142a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3296142a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorlib.ni.dll.aux", cAlternateFileName="MSCORL~1.AUX")) returned 0 [0137.143] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0137.144] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3287c60b, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3296142a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3296142a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ef49acbb43c068f6ddf1587283b5f29", cAlternateFileName="2EF49A~1")) returned 0 [0137.144] FindClose (in: hFindFile=0x759fd0 | out: hFindFile=0x759fd0) returned 1 [0137.144] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8d29d47, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c4a8ccd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c4a8ccd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="napcrypt", cAlternateFileName="")) returned 1 [0137.144] lstrcmpA (lpString1=".", lpString2="napcrypt") returned -1 [0137.144] lstrcmpA (lpString1="..", lpString2="napcrypt") returned -1 [0137.144] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.144] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="napcrypt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt" [0137.145] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt") returned 55 [0137.145] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8d29d47, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c4a8ccd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c4a8ccd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0137.145] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.145] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8d29d47, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c4a8ccd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c4a8ccd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.145] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.145] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.146] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57b5e18e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57b5e18e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57b5e18e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="28943a869b4fd4bedce24271b5fa7259", cAlternateFileName="28943A~1")) returned 1 [0137.146] lstrcmpA (lpString1=".", lpString2="28943a869b4fd4bedce24271b5fa7259") returned -1 [0137.146] lstrcmpA (lpString1="..", lpString2="28943a869b4fd4bedce24271b5fa7259") returned -1 [0137.146] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\*.*") returned="*.*" [0137.146] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\", lpString2="28943a869b4fd4bedce24271b5fa7259" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259" [0137.146] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259") returned 88 [0137.146] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57b5e18e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57b5e18e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57b5e18e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0137.146] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.146] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57b5e18e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57b5e18e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57b5e18e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.146] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.146] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.147] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57b37f65, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57b37f65, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57b5e18e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="napcrypt.ni.dll", cAlternateFileName="NAPCRY~1.DLL")) returned 1 [0137.147] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="napcrypt.ni.dll") returned -1 [0137.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="napcrypt.ni.dll") returned -1 [0137.147] lstrcmpiA (lpString1="", lpString2="napcrypt.ni.dll") returned -1 [0137.147] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\*.*") returned="*.*" [0137.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\" [0137.147] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\") returned="" [0137.147] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\HOW TO DECRYPT FILES.txt" [0137.147] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\how to decrypt files.txt")) returned 0xffffffff [0137.147] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.149] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0137.149] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0137.150] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.150] CloseHandle (hObject=0x214) returned 1 [0137.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.zip") returned 0 [0137.150] lstrlenA (lpString="*.zip") returned 5 [0137.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.rar") returned 0 [0137.150] lstrlenA (lpString="*.rar") returned 5 [0137.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.7z") returned 0 [0137.150] lstrlenA (lpString="*.7z") returned 4 [0137.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.tar") returned 0 [0137.151] lstrlenA (lpString="*.tar") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.gzip") returned 0 [0137.151] lstrlenA (lpString="*.gzip") returned 6 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.jpg") returned 0 [0137.151] lstrlenA (lpString="*.jpg") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.jpeg") returned 0 [0137.151] lstrlenA (lpString="*.jpeg") returned 6 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.psd") returned 0 [0137.151] lstrlenA (lpString="*.psd") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.cdr") returned 0 [0137.151] lstrlenA (lpString="*.cdr") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.dwg") returned 0 [0137.151] lstrlenA (lpString="*.dwg") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.max") returned 0 [0137.151] lstrlenA (lpString="*.max") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.bmp") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.gif") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.png") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.doc") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.docx") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.xls") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.xlsx") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.ppt") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.pptx") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.txt") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.pdf") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.djvu") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.htm") returned 0 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.html") returned 0 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.mdb") returned 0 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.cer") returned 0 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.p12") returned 0 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.pfx") returned 0 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.kwm") returned 0 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.pwm") returned 0 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.1cd") returned 0 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.md") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.mdf") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.dbf") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.odt") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.vob") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.ifo") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.lnk") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.torrent") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.mov") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.m2v") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.3gp") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.mpeg") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.mpg") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.flv") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.avi") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.mp4") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.wmv") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.divx") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.mkv") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.mp3") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.wav") returned 0 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.flac") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.ape") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.wma") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.ac3") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll", pszSpec="*.doc") returned 0 [0137.154] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57b5e18e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57b5e18e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57b5e18e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x0, cFileName="napcrypt.ni.dll.aux", cAlternateFileName="NAPCRY~1.AUX")) returned 1 [0137.154] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.154] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="napcrypt.ni.dll.aux") returned -1 [0137.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="napcrypt.ni.dll.aux") returned -1 [0137.154] lstrcmpiA (lpString1="", lpString2="napcrypt.ni.dll.aux") returned -1 [0137.154] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll") returned="napcrypt.ni.dll" [0137.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\" [0137.154] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\") returned="" [0137.154] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\how to decrypt files.txt")) returned 0x20 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.zip") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.rar") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.7z") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.tar") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.gzip") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.jpg") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.psd") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.cdr") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.dwg") returned 0 [0137.154] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.max") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.bmp") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.gif") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.png") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.docx") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.xls") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.ppt") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.pptx") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.txt") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.pdf") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.djvu") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.htm") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.html") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.mdb") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.cer") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.p12") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.pfx") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.kwm") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.pwm") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.1cd") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.md") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.mdf") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.dbf") returned 0 [0137.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.odt") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.vob") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.ifo") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.lnk") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.torrent") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.mov") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.m2v") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.3gp") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.mpg") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.flv") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.avi") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.mp4") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.wmv") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.divx") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.mkv") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.mp3") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.wav") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.flac") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.ape") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.wma") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.ac3") returned 0 [0137.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napcrypt\\28943a869b4fd4bedce24271b5fa7259\\napcrypt.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.156] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57b5e18e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57b5e18e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57b5e18e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x0, cFileName="napcrypt.ni.dll.aux", cAlternateFileName="NAPCRY~1.AUX")) returned 0 [0137.156] FindClose (in: hFindFile=0x7599d0 | out: hFindFile=0x7599d0) returned 1 [0137.157] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57b5e18e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57b5e18e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57b5e18e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="28943a869b4fd4bedce24271b5fa7259", cAlternateFileName="28943A~1")) returned 0 [0137.157] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0137.157] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8d03ae9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c4f511e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c4f511e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="napinit", cAlternateFileName="")) returned 1 [0137.157] lstrcmpA (lpString1=".", lpString2="napinit") returned -1 [0137.157] lstrcmpA (lpString1="..", lpString2="napinit") returned -1 [0137.157] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.157] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8d03ae9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c4f511e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c4f511e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0137.157] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.157] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8d03ae9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c4f511e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c4f511e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.158] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.158] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.158] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57d27b8a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57d27b8a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57d27b8a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8dbf9318f80b74fdbfbc66de65eb20be", cAlternateFileName="8DBF93~1")) returned 1 [0137.158] lstrcmpA (lpString1=".", lpString2="8dbf9318f80b74fdbfbc66de65eb20be") returned -1 [0137.158] lstrcmpA (lpString1="..", lpString2="8dbf9318f80b74fdbfbc66de65eb20be") returned -1 [0137.158] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\*.*") returned="*.*" [0137.158] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57d27b8a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57d27b8a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57d27b8a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0137.158] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.158] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57d27b8a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57d27b8a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57d27b8a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.158] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.158] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.158] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d27b8a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57d27b8a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57d27b8a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="napinit.ni.dll", cAlternateFileName="NAPINI~1.DLL")) returned 1 [0137.158] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="napinit.ni.dll") returned -1 [0137.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="napinit.ni.dll") returned -1 [0137.158] lstrcmpiA (lpString1="", lpString2="napinit.ni.dll") returned -1 [0137.158] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\*.*") returned="*.*" [0137.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\" [0137.158] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\") returned="" [0137.158] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\how to decrypt files.txt")) returned 0xffffffff [0137.158] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.174] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.174] CloseHandle (hObject=0x214) returned 1 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.zip") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.rar") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.7z") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.tar") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.gzip") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.jpg") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.jpeg") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.psd") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.cdr") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.dwg") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.max") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.bmp") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.gif") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.png") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.doc") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.docx") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.xls") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.xlsx") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.ppt") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.pptx") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.txt") returned 0 [0137.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.pdf") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.djvu") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.htm") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.html") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.mdb") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.cer") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.p12") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.pfx") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.kwm") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.pwm") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.1cd") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.md") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.mdf") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.dbf") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.odt") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.vob") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.ifo") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.lnk") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.torrent") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.mov") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.m2v") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.3gp") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.mpeg") returned 0 [0137.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.mpg") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.flv") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.avi") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.mp4") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.wmv") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.divx") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.mkv") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.mp3") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.wav") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.flac") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.ape") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.wma") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.ac3") returned 0 [0137.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll", pszSpec="*.doc") returned 0 [0137.177] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d27b8a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57d27b8a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57d27b8a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="napinit.ni.dll.aux", cAlternateFileName="NAPINI~1.AUX")) returned 1 [0137.177] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.177] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="napinit.ni.dll.aux") returned -1 [0137.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="napinit.ni.dll.aux") returned -1 [0137.177] lstrcmpiA (lpString1="", lpString2="napinit.ni.dll.aux") returned -1 [0137.177] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll") returned="napinit.ni.dll" [0137.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\" [0137.177] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\") returned="" [0137.177] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\how to decrypt files.txt")) returned 0x20 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.zip") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.rar") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.7z") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.tar") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.gzip") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.jpg") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.psd") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.cdr") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.dwg") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.max") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.bmp") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.gif") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.png") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.docx") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.xls") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.ppt") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.pptx") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.txt") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.pdf") returned 0 [0137.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.djvu") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.htm") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.html") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.mdb") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.cer") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.p12") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.pfx") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.kwm") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.pwm") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.1cd") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.md") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.mdf") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.dbf") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.odt") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.vob") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.ifo") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.lnk") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.torrent") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.mov") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.m2v") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.3gp") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.mpg") returned 0 [0137.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.flv") returned 0 [0137.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.avi") returned 0 [0137.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.mp4") returned 0 [0137.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.wmv") returned 0 [0137.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.divx") returned 0 [0137.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.mkv") returned 0 [0137.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.mp3") returned 0 [0137.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.wav") returned 0 [0137.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.flac") returned 0 [0137.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.ape") returned 0 [0137.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.wma") returned 0 [0137.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.ac3") returned 0 [0137.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\napinit\\8dbf9318f80b74fdbfbc66de65eb20be\\napinit.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.180] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d27b8a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57d27b8a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57d27b8a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="napinit.ni.dll.aux", cAlternateFileName="NAPINI~1.AUX")) returned 0 [0137.180] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0137.180] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57d27b8a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x57d27b8a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x57d27b8a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8dbf9318f80b74fdbfbc66de65eb20be", cAlternateFileName="8DBF93~1")) returned 0 [0137.181] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0137.183] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb81fccab, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ab55ea6, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7ab55ea6, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="Presentatio5ae0f00f#", cAlternateFileName="PRESEN~2")) returned 1 [0137.183] lstrcmpA (lpString1=".", lpString2="Presentatio5ae0f00f#") returned -1 [0137.183] lstrcmpA (lpString1="..", lpString2="Presentatio5ae0f00f#") returned -1 [0137.183] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.183] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb81fccab, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ab55ea6, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7ab55ea6, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0137.184] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.184] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb81fccab, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ab55ea6, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7ab55ea6, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.184] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.184] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.184] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54f3ce0f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x54faf3bd, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x54faf3bd, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="73fccc5c750443c933e3a070e244f919", cAlternateFileName="73FCCC~1")) returned 1 [0137.184] lstrcmpA (lpString1=".", lpString2="73fccc5c750443c933e3a070e244f919") returned -1 [0137.184] lstrcmpA (lpString1="..", lpString2="73fccc5c750443c933e3a070e244f919") returned -1 [0137.184] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\*.*") returned="*.*" [0137.184] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54f3ce0f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x54faf3bd, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x54faf3bd, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0137.186] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.186] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54f3ce0f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x54faf3bd, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x54faf3bd, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.186] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.186] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.186] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54cda6f6, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x54cda6f6, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55047d75, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x1646c00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="PresentationFramework.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0137.186] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.186] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.ni.dll") returned -1 [0137.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.ni.dll") returned -1 [0137.186] lstrcmpiA (lpString1="", lpString2="PresentationFramework.ni.dll") returned -1 [0137.186] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\*.*") returned="*.*" [0137.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\" [0137.186] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\") returned="" [0137.186] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\how to decrypt files.txt")) returned 0xffffffff [0137.186] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.188] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.189] CloseHandle (hObject=0x214) returned 1 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.zip") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.rar") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.7z") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.tar") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.gzip") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.jpg") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.jpeg") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.psd") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.cdr") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.dwg") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.max") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.bmp") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.gif") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.png") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.doc") returned 0 [0137.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.docx") returned 0 [0137.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll", pszSpec="*.xls") returned 0 [0137.190] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f89193, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x54f89193, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x54f89193, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.ni.dll.aux", cAlternateFileName="PRESEN~1.AUX")) returned 1 [0137.190] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.190] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.ni.dll.aux") returned -1 [0137.190] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.ni.dll.aux") returned -1 [0137.190] lstrcmpiA (lpString1="", lpString2="PresentationFramework.ni.dll.aux") returned -1 [0137.190] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\PresentationFramework.ni.dll") returned="PresentationFramework.ni.dll" [0137.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\" [0137.190] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\") returned="" [0137.190] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\presentatio5ae0f00f#\\73fccc5c750443c933e3a070e244f919\\how to decrypt files.txt")) returned 0x20 [0137.190] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f89193, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x54f89193, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x54f89193, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.ni.dll.aux", cAlternateFileName="PRESEN~1.AUX")) returned 0 [0137.190] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0137.191] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54f3ce0f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x54faf3bd, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x54faf3bd, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="73fccc5c750443c933e3a070e244f919", cAlternateFileName="73FCCC~1")) returned 0 [0137.191] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0137.191] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb864f10e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7aba235b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7aba235b, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="Presentatioaec034ca#", cAlternateFileName="PRESEN~3")) returned 1 [0137.191] lstrcmpA (lpString1=".", lpString2="Presentatioaec034ca#") returned -1 [0137.191] lstrcmpA (lpString1="..", lpString2="Presentatioaec034ca#") returned -1 [0137.191] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.191] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb864f10e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7aba235b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7aba235b, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0137.191] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.191] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb864f10e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7aba235b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7aba235b, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.191] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.191] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.191] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55748c04, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x55748c04, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55748c04, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="44bbb99d68c0e41cfd1d0c05d470be33", cAlternateFileName="44BBB9~1")) returned 1 [0137.191] lstrcmpA (lpString1=".", lpString2="44bbb99d68c0e41cfd1d0c05d470be33") returned -1 [0137.192] lstrcmpA (lpString1="..", lpString2="44bbb99d68c0e41cfd1d0c05d470be33") returned -1 [0137.192] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\*.*") returned="*.*" [0137.192] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55748c04, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x55748c04, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55748c04, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759f10 [0137.194] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.194] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55748c04, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x55748c04, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55748c04, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.194] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.194] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.194] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55722993, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x55722993, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55748c04, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x9ee00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="PresentationFramework.Aero2.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0137.194] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.194] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Aero2.ni.dll") returned -1 [0137.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Aero2.ni.dll") returned -1 [0137.194] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Aero2.ni.dll") returned -1 [0137.194] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\*.*") returned="*.*" [0137.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\" [0137.194] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\") returned="" [0137.195] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\how to decrypt files.txt")) returned 0xffffffff [0137.195] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.196] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.196] CloseHandle (hObject=0x214) returned 1 [0137.197] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55748c04, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x55748c04, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55748c04, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Aero2.ni.dll.aux", cAlternateFileName="PRESEN~1.AUX")) returned 1 [0137.197] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.197] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Aero2.ni.dll.aux") returned -1 [0137.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Aero2.ni.dll.aux") returned -1 [0137.197] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Aero2.ni.dll.aux") returned -1 [0137.197] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\PresentationFramework.Aero2.ni.dll") returned="PresentationFramework.Aero2.ni.dll" [0137.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\" [0137.197] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\") returned="" [0137.197] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\presentatioaec034ca#\\44bbb99d68c0e41cfd1d0c05d470be33\\how to decrypt files.txt")) returned 0x20 [0137.197] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55748c04, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x55748c04, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55748c04, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Aero2.ni.dll.aux", cAlternateFileName="PRESEN~1.AUX")) returned 0 [0137.197] FindClose (in: hFindFile=0x759f10 | out: hFindFile=0x759f10) returned 1 [0137.197] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55748c04, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x55748c04, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55748c04, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="44bbb99d68c0e41cfd1d0c05d470be33", cAlternateFileName="44BBB9~1")) returned 0 [0137.197] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0137.198] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb80f1c2c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ab09a0d, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7ab09a0d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="PresentationCore", cAlternateFileName="PRESEN~1")) returned 1 [0137.198] lstrcmpA (lpString1=".", lpString2="PresentationCore") returned -1 [0137.198] lstrcmpA (lpString1="..", lpString2="PresentationCore") returned -1 [0137.198] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.198] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb80f1c2c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ab09a0d, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7ab09a0d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759c50 [0137.199] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.199] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb80f1c2c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ab09a0d, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7ab09a0d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.199] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.199] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.199] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b41d783, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x4b469c82, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x4b469c82, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="629565c1e1cd8c4797308c3b0173289f", cAlternateFileName="629565~1")) returned 1 [0137.199] lstrcmpA (lpString1=".", lpString2="629565c1e1cd8c4797308c3b0173289f") returned -1 [0137.199] lstrcmpA (lpString1="..", lpString2="629565c1e1cd8c4797308c3b0173289f") returned -1 [0137.199] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\*.*") returned="*.*" [0137.199] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b41d783, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x4b469c82, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x4b469c82, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0137.200] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.200] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b41d783, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x4b469c82, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x4b469c82, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.200] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.200] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.200] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b2c6228, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x4b2c6228, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x4b4dc34f, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0xdda400, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="PresentationCore.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0137.200] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationCore.ni.dll") returned -1 [0137.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationCore.ni.dll") returned -1 [0137.200] lstrcmpiA (lpString1="", lpString2="PresentationCore.ni.dll") returned -1 [0137.200] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\*.*") returned="*.*" [0137.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\" [0137.200] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\") returned="" [0137.201] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\presentationcore\\629565c1e1cd8c4797308c3b0173289f\\how to decrypt files.txt")) returned 0xffffffff [0137.201] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\presentationcore\\629565c1e1cd8c4797308c3b0173289f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.203] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.203] CloseHandle (hObject=0x214) returned 1 [0137.204] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b4439cf, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x4b4439cf, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x4b469c82, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.ni.dll.aux", cAlternateFileName="PRESEN~1.AUX")) returned 1 [0137.204] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.204] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationCore.ni.dll.aux") returned -1 [0137.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationCore.ni.dll.aux") returned -1 [0137.204] lstrcmpiA (lpString1="", lpString2="PresentationCore.ni.dll.aux") returned -1 [0137.204] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\PresentationCore.ni.dll") returned="PresentationCore.ni.dll" [0137.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\" [0137.204] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\") returned="" [0137.204] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\629565c1e1cd8c4797308c3b0173289f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\presentationcore\\629565c1e1cd8c4797308c3b0173289f\\how to decrypt files.txt")) returned 0x20 [0137.204] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b4439cf, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x4b4439cf, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x4b469c82, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.ni.dll.aux", cAlternateFileName="PRESEN~1.AUX")) returned 0 [0137.204] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0137.205] FindNextFileA (in: hFindFile=0x759c50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b41d783, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x4b469c82, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x4b469c82, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="629565c1e1cd8c4797308c3b0173289f", cAlternateFileName="629565~1")) returned 0 [0137.205] FindClose (in: hFindFile=0x759c50 | out: hFindFile=0x759c50) returned 1 [0137.205] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8b39ea7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c54157f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c54157f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="SecurityAudf6921413#", cAlternateFileName="SECURI~1")) returned 1 [0137.205] lstrcmpA (lpString1=".", lpString2="SecurityAudf6921413#") returned -1 [0137.205] lstrcmpA (lpString1="..", lpString2="SecurityAudf6921413#") returned -1 [0137.205] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.205] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8b39ea7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c54157f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c54157f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ed0 [0137.205] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.205] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8b39ea7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c54157f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c54157f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.205] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.205] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.205] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b0255c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x58b0255c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x58b0255c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e4b1c7f59fdbff6bfcb77a98871c9505", cAlternateFileName="E4B1C7~1")) returned 1 [0137.206] lstrcmpA (lpString1=".", lpString2="e4b1c7f59fdbff6bfcb77a98871c9505") returned -1 [0137.206] lstrcmpA (lpString1="..", lpString2="e4b1c7f59fdbff6bfcb77a98871c9505") returned -1 [0137.206] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\*.*") returned="*.*" [0137.206] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b0255c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x58b0255c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x58b0255c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759990 [0137.226] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.226] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b0255c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x58b0255c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x58b0255c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.227] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.227] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.227] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58adc323, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x58adc323, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x58b0255c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="SecurityAuditPoliciesSnapIn.ni.dll", cAlternateFileName="SECURI~1.DLL")) returned 1 [0137.227] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.227] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SecurityAuditPoliciesSnapIn.ni.dll") returned -1 [0137.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SecurityAuditPoliciesSnapIn.ni.dll") returned -1 [0137.227] lstrcmpiA (lpString1="", lpString2="SecurityAuditPoliciesSnapIn.ni.dll") returned -1 [0137.227] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\*.*") returned="*.*" [0137.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\" [0137.227] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\") returned="" [0137.227] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\securityaudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\how to decrypt files.txt")) returned 0xffffffff [0137.227] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\securityaudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.229] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.229] CloseHandle (hObject=0x214) returned 1 [0137.230] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b0255c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x58b0255c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x58b0255c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecurityAuditPoliciesSnapIn.ni.dll.aux", cAlternateFileName="SECURI~1.AUX")) returned 1 [0137.230] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SecurityAuditPoliciesSnapIn.ni.dll.aux") returned -1 [0137.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SecurityAuditPoliciesSnapIn.ni.dll.aux") returned -1 [0137.230] lstrcmpiA (lpString1="", lpString2="SecurityAuditPoliciesSnapIn.ni.dll.aux") returned -1 [0137.230] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\SecurityAuditPoliciesSnapIn.ni.dll") returned="SecurityAuditPoliciesSnapIn.ni.dll" [0137.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\" [0137.230] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\") returned="" [0137.230] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SecurityAudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\securityaudf6921413#\\e4b1c7f59fdbff6bfcb77a98871c9505\\how to decrypt files.txt")) returned 0x20 [0137.231] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b0255c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x58b0255c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x58b0255c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecurityAuditPoliciesSnapIn.ni.dll.aux", cAlternateFileName="SECURI~1.AUX")) returned 0 [0137.231] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0137.231] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b0255c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x58b0255c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x58b0255c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e4b1c7f59fdbff6bfcb77a98871c9505", cAlternateFileName="E4B1C7~1")) returned 0 [0137.232] FindClose (in: hFindFile=0x759ed0 | out: hFindFile=0x759ed0) returned 1 [0137.232] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1fa8fa, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xb1fa8fa, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xb1fa8fa, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="SMDiagnostics", cAlternateFileName="SMDIAG~1")) returned 1 [0137.232] lstrcmpA (lpString1=".", lpString2="SMDiagnostics") returned -1 [0137.232] lstrcmpA (lpString1="..", lpString2="SMDiagnostics") returned -1 [0137.232] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.232] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1fa8fa, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xb1fa8fa, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xb1fa8fa, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0137.233] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.233] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1fa8fa, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xb1fa8fa, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xb1fa8fa, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.233] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.233] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.233] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1fa8fa, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xb1fa8fa, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xb1fa8fa, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="74bb12c25dd6357a131f18f94611e30a", cAlternateFileName="74BB12~1")) returned 1 [0137.233] lstrcmpA (lpString1=".", lpString2="74bb12c25dd6357a131f18f94611e30a") returned -1 [0137.233] lstrcmpA (lpString1="..", lpString2="74bb12c25dd6357a131f18f94611e30a") returned -1 [0137.233] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\*.*") returned="*.*" [0137.233] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1fa8fa, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xb1fa8fa, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xb1fa8fa, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0137.233] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.233] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1fa8fa, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xb1fa8fa, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xb1fa8fa, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.233] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.233] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.233] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1fa8fa, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xb1fa8fa, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xb1fa8fa, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x23200, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="SMDiagnostics.ni.dll", cAlternateFileName="SMDIAG~1.DLL")) returned 1 [0137.233] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.233] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMDiagnostics.ni.dll") returned -1 [0137.233] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMDiagnostics.ni.dll") returned -1 [0137.233] lstrcmpiA (lpString1="", lpString2="SMDiagnostics.ni.dll") returned -1 [0137.233] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\*.*") returned="*.*" [0137.233] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\" [0137.234] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\") returned="" [0137.234] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\smdiagnostics\\74bb12c25dd6357a131f18f94611e30a\\how to decrypt files.txt")) returned 0xffffffff [0137.234] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\smdiagnostics\\74bb12c25dd6357a131f18f94611e30a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.237] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.237] CloseHandle (hObject=0x214) returned 1 [0137.237] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1fa8fa, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xb1fa8fa, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xb1fa8fa, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMDiagnostics.ni.dll.aux", cAlternateFileName="SMDIAG~1.AUX")) returned 1 [0137.237] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.237] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMDiagnostics.ni.dll.aux") returned -1 [0137.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMDiagnostics.ni.dll.aux") returned -1 [0137.237] lstrcmpiA (lpString1="", lpString2="SMDiagnostics.ni.dll.aux") returned -1 [0137.237] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\SMDiagnostics.ni.dll") returned="SMDiagnostics.ni.dll" [0137.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\" [0137.238] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\") returned="" [0137.238] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\74bb12c25dd6357a131f18f94611e30a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\smdiagnostics\\74bb12c25dd6357a131f18f94611e30a\\how to decrypt files.txt")) returned 0x20 [0137.238] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1fa8fa, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xb1fa8fa, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xb1fa8fa, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMDiagnostics.ni.dll.aux", cAlternateFileName="SMDIAG~1.AUX")) returned 0 [0137.238] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0137.238] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1fa8fa, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xb1fa8fa, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xb1fa8fa, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="74bb12c25dd6357a131f18f94611e30a", cAlternateFileName="74BB12~1")) returned 0 [0137.238] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0137.238] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb875a171, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c5b3bee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c5b3bee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="SrpUxSnapIn", cAlternateFileName="SRPUXS~1")) returned 1 [0137.238] lstrcmpA (lpString1=".", lpString2="SrpUxSnapIn") returned -1 [0137.238] lstrcmpA (lpString1="..", lpString2="SrpUxSnapIn") returned -1 [0137.238] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.239] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb875a171, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c5b3bee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c5b3bee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d90 [0137.239] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.239] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb875a171, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c5b3bee, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c5b3bee, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.239] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.239] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.239] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x592c161e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x592c161e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x592c161e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54d963009f09076abe9bce576b7d08c5", cAlternateFileName="54D963~1")) returned 1 [0137.239] lstrcmpA (lpString1=".", lpString2="54d963009f09076abe9bce576b7d08c5") returned -1 [0137.239] lstrcmpA (lpString1="..", lpString2="54d963009f09076abe9bce576b7d08c5") returned -1 [0137.239] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\*.*") returned="*.*" [0137.239] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x592c161e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x592c161e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x592c161e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759f50 [0137.240] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.240] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x592c161e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x592c161e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x592c161e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.240] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.240] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.240] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x592751b9, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x592751b9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x592c161e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x178200, dwReserved0=0x2, dwReserved1=0x0, cFileName="SrpUxSnapIn.ni.dll", cAlternateFileName="SRPUXS~1.DLL")) returned 1 [0137.240] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.240] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SrpUxSnapIn.ni.dll") returned -1 [0137.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SrpUxSnapIn.ni.dll") returned -1 [0137.240] lstrcmpiA (lpString1="", lpString2="SrpUxSnapIn.ni.dll") returned -1 [0137.240] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\*.*") returned="*.*" [0137.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\" [0137.241] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\") returned="" [0137.241] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\srpuxsnapin\\54d963009f09076abe9bce576b7d08c5\\how to decrypt files.txt")) returned 0xffffffff [0137.241] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\srpuxsnapin\\54d963009f09076abe9bce576b7d08c5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.243] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.243] CloseHandle (hObject=0x214) returned 1 [0137.244] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x592c161e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x592c161e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x592c161e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SrpUxSnapIn.ni.dll.aux", cAlternateFileName="SRPUXS~1.AUX")) returned 1 [0137.244] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.244] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SrpUxSnapIn.ni.dll.aux") returned -1 [0137.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SrpUxSnapIn.ni.dll.aux") returned -1 [0137.244] lstrcmpiA (lpString1="", lpString2="SrpUxSnapIn.ni.dll.aux") returned -1 [0137.244] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\SrpUxSnapIn.ni.dll") returned="SrpUxSnapIn.ni.dll" [0137.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\" [0137.244] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\") returned="" [0137.244] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SrpUxSnapIn\\54d963009f09076abe9bce576b7d08c5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\srpuxsnapin\\54d963009f09076abe9bce576b7d08c5\\how to decrypt files.txt")) returned 0x20 [0137.244] FindNextFileA (in: hFindFile=0x759f50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x592c161e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x592c161e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x592c161e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SrpUxSnapIn.ni.dll.aux", cAlternateFileName="SRPUXS~1.AUX")) returned 0 [0137.244] FindClose (in: hFindFile=0x759f50 | out: hFindFile=0x759f50) returned 1 [0137.245] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x592c161e, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x592c161e, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x592c161e, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54d963009f09076abe9bce576b7d08c5", cAlternateFileName="54D963~1")) returned 0 [0137.245] FindClose (in: hFindFile=0x759d90 | out: hFindFile=0x759d90) returned 1 [0137.245] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7e69407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c6e4d49, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c6e4d49, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System", cAlternateFileName="")) returned 1 [0137.245] lstrcmpA (lpString1=".", lpString2="System") returned -1 [0137.245] lstrcmpA (lpString1="..", lpString2="System") returned -1 [0137.245] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.245] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7e69407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c6e4d49, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c6e4d49, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759990 [0137.245] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.245] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7e69407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c6e4d49, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c6e4d49, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.245] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.245] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.245] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39307b4d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x39353ff2, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x39353ff2, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="81628942bacc75f31a81ed994f9aadfc", cAlternateFileName="816289~1")) returned 1 [0137.245] lstrcmpA (lpString1=".", lpString2="81628942bacc75f31a81ed994f9aadfc") returned -1 [0137.245] lstrcmpA (lpString1="..", lpString2="81628942bacc75f31a81ed994f9aadfc") returned -1 [0137.245] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\*.*") returned="*.*" [0137.245] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39307b4d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x39353ff2, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x39353ff2, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0137.246] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.246] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39307b4d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x39353ff2, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x39353ff2, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.246] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.246] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.247] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391d6864, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x391d6864, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x393a0485, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0xc1fa00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.247] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.247] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ni.dll") returned -1 [0137.247] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ni.dll") returned -1 [0137.247] lstrcmpiA (lpString1="", lpString2="System.ni.dll") returned -1 [0137.247] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\*.*") returned="*.*" [0137.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\" [0137.247] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\") returned="" [0137.247] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\81628942bacc75f31a81ed994f9aadfc\\how to decrypt files.txt")) returned 0xffffffff [0137.247] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\81628942bacc75f31a81ed994f9aadfc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.250] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.254] CloseHandle (hObject=0x214) returned 1 [0137.254] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39353ff2, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe267aac, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x39353ff2, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x26c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.254] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.254] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ni.dll.aux") returned -1 [0137.254] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ni.dll.aux") returned -1 [0137.254] lstrcmpiA (lpString1="", lpString2="System.ni.dll.aux") returned -1 [0137.254] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\System.ni.dll") returned="System.ni.dll" [0137.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\" [0137.255] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\") returned="" [0137.255] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\81628942bacc75f31a81ed994f9aadfc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\81628942bacc75f31a81ed994f9aadfc\\how to decrypt files.txt")) returned 0x20 [0137.255] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39353ff2, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe267aac, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x39353ff2, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x26c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.255] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0137.255] FindNextFileA (in: hFindFile=0x759990, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39307b4d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x39353ff2, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x39353ff2, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="81628942bacc75f31a81ed994f9aadfc", cAlternateFileName="816289~1")) returned 0 [0137.255] FindClose (in: hFindFile=0x759990 | out: hFindFile=0x759990) returned 1 [0137.255] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20911d4d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x20911d4d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x20911d4d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Acti2661942e#", cAlternateFileName="SYSTEM~2.ACT")) returned 1 [0137.255] lstrcmpA (lpString1=".", lpString2="System.Acti2661942e#") returned -1 [0137.255] lstrcmpA (lpString1="..", lpString2="System.Acti2661942e#") returned -1 [0137.255] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.255] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20911d4d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x20911d4d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x20911d4d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0137.259] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.259] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20911d4d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x20911d4d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x20911d4d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.259] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.259] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.259] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20911d4d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x20911d4d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x20911d4d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0bd5239d4f580b61fa6b591b380dbaa", cAlternateFileName="C0BD52~1")) returned 1 [0137.259] lstrcmpA (lpString1=".", lpString2="c0bd5239d4f580b61fa6b591b380dbaa") returned -1 [0137.259] lstrcmpA (lpString1="..", lpString2="c0bd5239d4f580b61fa6b591b380dbaa") returned -1 [0137.259] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\*.*") returned="*.*" [0137.259] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20911d4d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x20911d4d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x20911d4d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759e50 [0137.261] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.261] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20911d4d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x20911d4d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x20911d4d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.261] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.261] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.261] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x208ebae3, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x208ebae3, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x20911d4d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x85a00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Activities.DurableInstancing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.261] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.261] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Activities.DurableInstancing.ni.dll") returned -1 [0137.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Activities.DurableInstancing.ni.dll") returned -1 [0137.261] lstrcmpiA (lpString1="", lpString2="System.Activities.DurableInstancing.ni.dll") returned -1 [0137.261] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\*.*") returned="*.*" [0137.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\" [0137.261] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\") returned="" [0137.261] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\how to decrypt files.txt")) returned 0xffffffff [0137.261] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.267] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.267] CloseHandle (hObject=0x214) returned 1 [0137.267] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20911d4d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x20911d4d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x20911d4d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Activities.DurableInstancing.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.267] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Activities.DurableInstancing.ni.dll.aux") returned -1 [0137.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Activities.DurableInstancing.ni.dll.aux") returned -1 [0137.267] lstrcmpiA (lpString1="", lpString2="System.Activities.DurableInstancing.ni.dll.aux") returned -1 [0137.267] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\System.Activities.DurableInstancing.ni.dll") returned="System.Activities.DurableInstancing.ni.dll" [0137.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\" [0137.268] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\") returned="" [0137.268] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.acti2661942e#\\c0bd5239d4f580b61fa6b591b380dbaa\\how to decrypt files.txt")) returned 0x20 [0137.268] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20911d4d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x20911d4d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x20911d4d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Activities.DurableInstancing.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.268] FindClose (in: hFindFile=0x759e50 | out: hFindFile=0x759e50) returned 1 [0137.268] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20911d4d, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x20911d4d, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x20911d4d, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0bd5239d4f580b61fa6b591b380dbaa", cAlternateFileName="C0BD52~1")) returned 0 [0137.268] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0137.268] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe0bce4, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1fe0bce4, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1fe0bce4, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Activities", cAlternateFileName="SYSTEM~1.ACT")) returned 1 [0137.268] lstrcmpA (lpString1=".", lpString2="System.Activities") returned -1 [0137.268] lstrcmpA (lpString1="..", lpString2="System.Activities") returned -1 [0137.269] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.269] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe0bce4, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1fe0bce4, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1fe0bce4, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0137.290] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.290] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe0bce4, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1fe0bce4, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1fe0bce4, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.290] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.290] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.290] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe0bce4, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1fe0bce4, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1fe0bce4, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9d7ebf0947e75beaaab2d411542006c6", cAlternateFileName="9D7EBF~1")) returned 1 [0137.290] lstrcmpA (lpString1=".", lpString2="9d7ebf0947e75beaaab2d411542006c6") returned -1 [0137.290] lstrcmpA (lpString1="..", lpString2="9d7ebf0947e75beaaab2d411542006c6") returned -1 [0137.291] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\*.*") returned="*.*" [0137.291] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe0bce4, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1fe0bce4, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1fe0bce4, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0137.291] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.291] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe0bce4, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1fe0bce4, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1fe0bce4, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.291] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.291] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.291] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fd73339, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1fd73339, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1fe5821a, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x6e1a00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Activities.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.291] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.291] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Activities.ni.dll") returned -1 [0137.291] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Activities.ni.dll") returned -1 [0137.291] lstrcmpiA (lpString1="", lpString2="System.Activities.ni.dll") returned -1 [0137.291] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\*.*") returned="*.*" [0137.291] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\" [0137.291] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\") returned="" [0137.291] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.activities\\9d7ebf0947e75beaaab2d411542006c6\\how to decrypt files.txt")) returned 0xffffffff [0137.291] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.activities\\9d7ebf0947e75beaaab2d411542006c6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.295] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.295] CloseHandle (hObject=0x214) returned 1 [0137.296] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe0bce4, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1fe0bce4, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1fe0bce4, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x8d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Activities.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.296] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.296] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Activities.ni.dll.aux") returned -1 [0137.296] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Activities.ni.dll.aux") returned -1 [0137.296] lstrcmpiA (lpString1="", lpString2="System.Activities.ni.dll.aux") returned -1 [0137.296] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\System.Activities.ni.dll") returned="System.Activities.ni.dll" [0137.296] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\" [0137.296] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\") returned="" [0137.296] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\9d7ebf0947e75beaaab2d411542006c6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.activities\\9d7ebf0947e75beaaab2d411542006c6\\how to decrypt files.txt")) returned 0x20 [0137.296] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe0bce4, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1fe0bce4, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1fe0bce4, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x8d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Activities.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.296] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0137.296] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe0bce4, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x1fe0bce4, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1fe0bce4, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9d7ebf0947e75beaaab2d411542006c6", cAlternateFileName="9D7EBF~1")) returned 0 [0137.296] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0137.297] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8e3751, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa8e3751, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa8e3751, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Comp46f2b404#", cAlternateFileName="SYSTEM~1.COM")) returned 1 [0137.297] lstrcmpA (lpString1=".", lpString2="System.Comp46f2b404#") returned -1 [0137.297] lstrcmpA (lpString1="..", lpString2="System.Comp46f2b404#") returned -1 [0137.297] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.297] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8e3751, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa8e3751, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa8e3751, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e50 [0137.298] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.298] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8e3751, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa8e3751, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa8e3751, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.298] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.298] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.298] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8e3751, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa8e3751, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa8e3751, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="57b82c36db94c3cde4645115d7edbd9e", cAlternateFileName="57B82C~1")) returned 1 [0137.298] lstrcmpA (lpString1=".", lpString2="57b82c36db94c3cde4645115d7edbd9e") returned -1 [0137.298] lstrcmpA (lpString1="..", lpString2="57b82c36db94c3cde4645115d7edbd9e") returned -1 [0137.298] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\*.*") returned="*.*" [0137.298] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8e3751, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa8e3751, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa8e3751, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759e90 [0137.300] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.300] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8e3751, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa8e3751, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa8e3751, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.300] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.300] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.300] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bd4d2, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa8bd4d2, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa8e3751, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x55600, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.ComponentModel.DataAnnotations.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.300] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.300] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ComponentModel.DataAnnotations.ni.dll") returned -1 [0137.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ComponentModel.DataAnnotations.ni.dll") returned -1 [0137.300] lstrcmpiA (lpString1="", lpString2="System.ComponentModel.DataAnnotations.ni.dll") returned -1 [0137.300] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\*.*") returned="*.*" [0137.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\" [0137.301] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\") returned="" [0137.301] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\how to decrypt files.txt")) returned 0xffffffff [0137.301] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.302] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.302] CloseHandle (hObject=0x214) returned 1 [0137.303] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8e3751, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa8e3751, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa8e3751, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.303] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.303] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ComponentModel.DataAnnotations.ni.dll.aux") returned -1 [0137.303] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ComponentModel.DataAnnotations.ni.dll.aux") returned -1 [0137.303] lstrcmpiA (lpString1="", lpString2="System.ComponentModel.DataAnnotations.ni.dll.aux") returned -1 [0137.303] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\System.ComponentModel.DataAnnotations.ni.dll") returned="System.ComponentModel.DataAnnotations.ni.dll" [0137.303] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\" [0137.303] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\") returned="" [0137.303] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.comp46f2b404#\\57b82c36db94c3cde4645115d7edbd9e\\how to decrypt files.txt")) returned 0x20 [0137.303] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8e3751, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa8e3751, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa8e3751, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.303] FindClose (in: hFindFile=0x759e90 | out: hFindFile=0x759e90) returned 1 [0137.304] FindNextFileA (in: hFindFile=0x759e50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8e3751, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa8e3751, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa8e3751, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="57b82c36db94c3cde4645115d7edbd9e", cAlternateFileName="57B82C~1")) returned 0 [0137.304] FindClose (in: hFindFile=0x759e50 | out: hFindFile=0x759e50) returned 1 [0137.304] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb851de02, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ac3ad1f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7ac3ad1f, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Confe64a9051#", cAlternateFileName="SYSTEM~2.CON")) returned 1 [0137.304] lstrcmpA (lpString1=".", lpString2="System.Confe64a9051#") returned -1 [0137.304] lstrcmpA (lpString1="..", lpString2="System.Confe64a9051#") returned -1 [0137.304] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.304] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb851de02, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ac3ad1f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7ac3ad1f, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ad0 [0137.305] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.305] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb851de02, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ac3ad1f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7ac3ad1f, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.305] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.305] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.305] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5624fa6d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x5624fa6d, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x5624fa6d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fafcc6016662a6acedb24716d1b69090", cAlternateFileName="FAFCC6~1")) returned 1 [0137.305] lstrcmpA (lpString1=".", lpString2="fafcc6016662a6acedb24716d1b69090") returned -1 [0137.305] lstrcmpA (lpString1="..", lpString2="fafcc6016662a6acedb24716d1b69090") returned -1 [0137.305] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\*.*") returned="*.*" [0137.305] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5624fa6d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x5624fa6d, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x5624fa6d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759fd0 [0137.307] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.307] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5624fa6d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x5624fa6d, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x5624fa6d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.307] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.307] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.307] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5624fa6d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x5624fa6d, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x5624fa6d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Configuration.Install.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.307] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.307] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Configuration.Install.ni.dll") returned -1 [0137.307] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Configuration.Install.ni.dll") returned -1 [0137.307] lstrcmpiA (lpString1="", lpString2="System.Configuration.Install.ni.dll") returned -1 [0137.307] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\*.*") returned="*.*" [0137.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\" [0137.307] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\") returned="" [0137.307] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\how to decrypt files.txt")) returned 0xffffffff [0137.307] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.312] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.312] CloseHandle (hObject=0x214) returned 1 [0137.312] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5624fa6d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x5624fa6d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x4ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Configuration.Install.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.312] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.312] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Configuration.Install.ni.dll.aux") returned -1 [0137.313] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Configuration.Install.ni.dll.aux") returned -1 [0137.313] lstrcmpiA (lpString1="", lpString2="System.Configuration.Install.ni.dll.aux") returned -1 [0137.313] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\System.Configuration.Install.ni.dll") returned="System.Configuration.Install.ni.dll" [0137.313] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\" [0137.313] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\") returned="" [0137.313] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.confe64a9051#\\fafcc6016662a6acedb24716d1b69090\\how to decrypt files.txt")) returned 0x20 [0137.313] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5624fa6d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x5624fa6d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x4ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Configuration.Install.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.313] FindClose (in: hFindFile=0x759fd0 | out: hFindFile=0x759fd0) returned 1 [0137.313] FindNextFileA (in: hFindFile=0x759ad0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5624fa6d, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x5624fa6d, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x5624fa6d, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fafcc6016662a6acedb24716d1b69090", cAlternateFileName="FAFCC6~1")) returned 0 [0137.313] FindClose (in: hFindFile=0x759ad0 | out: hFindFile=0x759ad0) returned 1 [0137.314] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb832df7a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7abee822, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7abee822, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Configuration", cAlternateFileName="SYSTEM~1.CON")) returned 1 [0137.314] lstrcmpA (lpString1=".", lpString2="System.Configuration") returned -1 [0137.314] lstrcmpA (lpString1="..", lpString2="System.Configuration") returned -1 [0137.314] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.314] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb832df7a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7abee822, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7abee822, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e90 [0137.314] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.314] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb832df7a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7abee822, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7abee822, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.314] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.314] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.314] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55f08676, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x55f08676, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55f08676, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b2eafdfa06ffab1b6ce64f2b23cf43e9", cAlternateFileName="B2EAFD~1")) returned 1 [0137.314] lstrcmpA (lpString1=".", lpString2="b2eafdfa06ffab1b6ce64f2b23cf43e9") returned -1 [0137.314] lstrcmpA (lpString1="..", lpString2="b2eafdfa06ffab1b6ce64f2b23cf43e9") returned -1 [0137.314] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\*.*") returned="*.*" [0137.314] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55f08676, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x55f08676, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55f08676, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0137.315] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.315] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55f08676, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x55f08676, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55f08676, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.315] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.315] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.315] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f08676, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x55f08676, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55f2e8d8, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x11f000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Configuration.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.315] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.315] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Configuration.ni.dll") returned -1 [0137.315] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Configuration.ni.dll") returned -1 [0137.315] lstrcmpiA (lpString1="", lpString2="System.Configuration.ni.dll") returned -1 [0137.315] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\*.*") returned="*.*" [0137.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\" [0137.315] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\") returned="" [0137.315] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\how to decrypt files.txt")) returned 0xffffffff [0137.315] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.319] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.319] CloseHandle (hObject=0x214) returned 1 [0137.319] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f08676, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe267aac, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x55f08676, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Configuration.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.319] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.319] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Configuration.ni.dll.aux") returned -1 [0137.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Configuration.ni.dll.aux") returned -1 [0137.319] lstrcmpiA (lpString1="", lpString2="System.Configuration.ni.dll.aux") returned -1 [0137.319] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\System.Configuration.ni.dll") returned="System.Configuration.ni.dll" [0137.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\" [0137.319] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\") returned="" [0137.319] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.configuration\\b2eafdfa06ffab1b6ce64f2b23cf43e9\\how to decrypt files.txt")) returned 0x20 [0137.319] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f08676, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe267aac, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x55f08676, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Configuration.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.320] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0137.320] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55f08676, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x55f08676, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x55f08676, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b2eafdfa06ffab1b6ce64f2b23cf43e9", cAlternateFileName="B2EAFD~1")) returned 0 [0137.320] FindClose (in: hFindFile=0x759e90 | out: hFindFile=0x759e90) returned 1 [0137.320] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7f27fb2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c600049, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c600049, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Core", cAlternateFileName="SYSTEM~1.COR")) returned 1 [0137.320] lstrcmpA (lpString1=".", lpString2="System.Core") returned -1 [0137.320] lstrcmpA (lpString1="..", lpString2="System.Core") returned -1 [0137.320] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.320] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7f27fb2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c600049, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c600049, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759b50 [0137.321] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.321] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7f27fb2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5c600049, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5c600049, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.321] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.321] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.321] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d557405, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3d5a389a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3d5a389a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fc381577aaba38fdf0cf3c88fce06b19", cAlternateFileName="FC3815~1")) returned 1 [0137.321] lstrcmpA (lpString1=".", lpString2="fc381577aaba38fdf0cf3c88fce06b19") returned -1 [0137.321] lstrcmpA (lpString1="..", lpString2="fc381577aaba38fdf0cf3c88fce06b19") returned -1 [0137.321] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\*.*") returned="*.*" [0137.321] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d557405, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3d5a389a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3d5a389a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759f10 [0137.321] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.321] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d557405, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3d5a389a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3d5a389a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.321] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.322] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.322] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d236295, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3d236295, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3d5efda3, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x9bd400, dwReserved0=0x2, dwReserved1=0x0, cFileName="System.Core.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.322] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.322] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Core.ni.dll") returned -1 [0137.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Core.ni.dll") returned -1 [0137.322] lstrcmpiA (lpString1="", lpString2="System.Core.ni.dll") returned -1 [0137.322] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\*.*") returned="*.*" [0137.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\" [0137.322] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\") returned="" [0137.322] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\fc381577aaba38fdf0cf3c88fce06b19\\how to decrypt files.txt")) returned 0xffffffff [0137.322] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\fc381577aaba38fdf0cf3c88fce06b19\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.329] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.329] CloseHandle (hObject=0x214) returned 1 [0137.329] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d57d651, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe267aac, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x3d57d651, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Core.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.329] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.329] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Core.ni.dll.aux") returned -1 [0137.329] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Core.ni.dll.aux") returned -1 [0137.329] lstrcmpiA (lpString1="", lpString2="System.Core.ni.dll.aux") returned -1 [0137.329] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\System.Core.ni.dll") returned="System.Core.ni.dll" [0137.329] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\" [0137.329] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\") returned="" [0137.329] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\fc381577aaba38fdf0cf3c88fce06b19\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\fc381577aaba38fdf0cf3c88fce06b19\\how to decrypt files.txt")) returned 0x20 [0137.330] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d57d651, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe267aac, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x3d57d651, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Core.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.330] FindClose (in: hFindFile=0x759f10 | out: hFindFile=0x759f10) returned 1 [0137.330] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d557405, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x3d5a389a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x3d5a389a, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fc381577aaba38fdf0cf3c88fce06b19", cAlternateFileName="FC3815~1")) returned 0 [0137.330] FindClose (in: hFindFile=0x759b50 | out: hFindFile=0x759b50) returned 1 [0137.330] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb83541d3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7acad3f8, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7acad3f8, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Data", cAlternateFileName="SYSTEM~1.DAT")) returned 1 [0137.330] lstrcmpA (lpString1=".", lpString2="System.Data") returned -1 [0137.330] lstrcmpA (lpString1="..", lpString2="System.Data") returned -1 [0137.330] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.331] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb83541d3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7acad3f8, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7acad3f8, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759fd0 [0137.331] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.331] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb83541d3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7acad3f8, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x7acad3f8, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.331] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.331] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.331] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b22e9c3, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x5b254c18, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x5b254c18, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="02a68b8ea184944294e2c3379482e599", cAlternateFileName="02A68B~1")) returned 1 [0137.331] lstrcmpA (lpString1=".", lpString2="02a68b8ea184944294e2c3379482e599") returned -1 [0137.331] lstrcmpA (lpString1="..", lpString2="02a68b8ea184944294e2c3379482e599") returned -1 [0137.331] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\*.*") returned="*.*" [0137.331] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b22e9c3, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x5b254c18, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x5b254c18, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0137.332] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.332] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b22e9c3, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x5b254c18, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x5b254c18, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.332] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.332] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.332] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b19603a, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x5b19603a, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x5b2a109f, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x8fa800, dwReserved0=0x2, dwReserved1=0x0, cFileName="System.Data.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.332] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.332] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.ni.dll") returned -1 [0137.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.ni.dll") returned -1 [0137.332] lstrcmpiA (lpString1="", lpString2="System.Data.ni.dll") returned -1 [0137.332] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\*.*") returned="*.*" [0137.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\" [0137.332] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\") returned="" [0137.332] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data\\02a68b8ea184944294e2c3379482e599\\how to decrypt files.txt")) returned 0xffffffff [0137.332] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data\\02a68b8ea184944294e2c3379482e599\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.349] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.350] CloseHandle (hObject=0x214) returned 1 [0137.350] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b254c18, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x5b254c18, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x604, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.350] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.350] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.ni.dll.aux") returned -1 [0137.350] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.ni.dll.aux") returned -1 [0137.350] lstrcmpiA (lpString1="", lpString2="System.Data.ni.dll.aux") returned -1 [0137.350] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\System.Data.ni.dll") returned="System.Data.ni.dll" [0137.350] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\" [0137.350] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\") returned="" [0137.350] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\02a68b8ea184944294e2c3379482e599\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data\\02a68b8ea184944294e2c3379482e599\\how to decrypt files.txt")) returned 0x20 [0137.350] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b254c18, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xe0737866, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x5b254c18, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x604, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.350] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0137.351] FindNextFileA (in: hFindFile=0x759fd0, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b22e9c3, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x5b254c18, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x5b254c18, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="02a68b8ea184944294e2c3379482e599", cAlternateFileName="02A68B~1")) returned 0 [0137.351] FindClose (in: hFindFile=0x759fd0 | out: hFindFile=0x759fd0) returned 1 [0137.351] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8797c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x18e8797c, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x18e8797c, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Data.Entity", cAlternateFileName="SYSTEM~2.ENT")) returned 1 [0137.351] lstrcmpA (lpString1=".", lpString2="System.Data.Entity") returned -1 [0137.351] lstrcmpA (lpString1="..", lpString2="System.Data.Entity") returned -1 [0137.351] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.351] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8797c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x18e8797c, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x18e8797c, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0137.375] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.375] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8797c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x18e8797c, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x18e8797c, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.376] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.376] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.376] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8797c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x18ed3e58, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x18ed3e58, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="a8996df0d1e09c161f451193dd52a9ba", cAlternateFileName="A8996D~1")) returned 1 [0137.376] lstrcmpA (lpString1=".", lpString2="a8996df0d1e09c161f451193dd52a9ba") returned -1 [0137.376] lstrcmpA (lpString1="..", lpString2="a8996df0d1e09c161f451193dd52a9ba") returned -1 [0137.376] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\*.*") returned="*.*" [0137.376] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8797c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x18ed3e58, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x18ed3e58, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759e90 [0137.377] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.377] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8797c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x18ed3e58, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x18ed3e58, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.377] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.377] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.377] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18d303c3, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x18d303c3, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x18f92a1f, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x10d5000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Data.Entity.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.377] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Entity.ni.dll") returned -1 [0137.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Entity.ni.dll") returned -1 [0137.377] lstrcmpiA (lpString1="", lpString2="System.Data.Entity.ni.dll") returned -1 [0137.377] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\*.*") returned="*.*" [0137.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\" [0137.377] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\") returned="" [0137.377] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data.entity\\a8996df0d1e09c161f451193dd52a9ba\\how to decrypt files.txt")) returned 0xffffffff [0137.377] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data.entity\\a8996df0d1e09c161f451193dd52a9ba\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.381] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.381] CloseHandle (hObject=0x214) returned 1 [0137.382] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18ed3e58, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x18ed3e58, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x18ed3e58, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.382] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.382] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Entity.ni.dll.aux") returned -1 [0137.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Entity.ni.dll.aux") returned -1 [0137.382] lstrcmpiA (lpString1="", lpString2="System.Data.Entity.ni.dll.aux") returned -1 [0137.382] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\System.Data.Entity.ni.dll") returned="System.Data.Entity.ni.dll" [0137.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\" [0137.382] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\") returned="" [0137.382] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\a8996df0d1e09c161f451193dd52a9ba\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data.entity\\a8996df0d1e09c161f451193dd52a9ba\\how to decrypt files.txt")) returned 0x20 [0137.382] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18ed3e58, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x18ed3e58, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x18ed3e58, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.382] FindClose (in: hFindFile=0x759e90 | out: hFindFile=0x759e90) returned 1 [0137.383] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8797c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x18ed3e58, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x18ed3e58, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="a8996df0d1e09c161f451193dd52a9ba", cAlternateFileName="A8996D~1")) returned 0 [0137.383] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0137.383] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21bbfd4c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x21bbfd4c, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x21bbfd4c, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Data.Linq", cAlternateFileName="SYSTEM~2.LIN")) returned 1 [0137.383] lstrcmpA (lpString1=".", lpString2="System.Data.Linq") returned -1 [0137.383] lstrcmpA (lpString1="..", lpString2="System.Data.Linq") returned -1 [0137.383] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.383] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21bbfd4c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x21bbfd4c, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x21bbfd4c, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e10 [0137.384] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.384] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21bbfd4c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x21bbfd4c, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x21bbfd4c, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.384] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.384] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.384] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21bbfd4c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x21bbfd4c, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x21bbfd4c, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="007b02a1e3d37bdcdaae0d700cf97948", cAlternateFileName="007B02~1")) returned 1 [0137.384] lstrcmpA (lpString1=".", lpString2="007b02a1e3d37bdcdaae0d700cf97948") returned -1 [0137.384] lstrcmpA (lpString1="..", lpString2="007b02a1e3d37bdcdaae0d700cf97948") returned -1 [0137.384] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\*.*") returned="*.*" [0137.384] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21bbfd4c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x21bbfd4c, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x21bbfd4c, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759f10 [0137.385] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.385] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21bbfd4c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x21bbfd4c, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x21bbfd4c, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.385] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.385] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.385] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b73899, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x21b73899, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x21be5f93, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x313e00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Data.Linq.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.385] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.385] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Linq.ni.dll") returned -1 [0137.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Linq.ni.dll") returned -1 [0137.385] lstrcmpiA (lpString1="", lpString2="System.Data.Linq.ni.dll") returned -1 [0137.385] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\*.*") returned="*.*" [0137.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\" [0137.385] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\") returned="" [0137.385] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data.linq\\007b02a1e3d37bdcdaae0d700cf97948\\how to decrypt files.txt")) returned 0xffffffff [0137.386] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data.linq\\007b02a1e3d37bdcdaae0d700cf97948\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.409] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.409] CloseHandle (hObject=0x214) returned 1 [0137.409] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21bbfd4c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x21bbfd4c, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x21bbfd4c, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Linq.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.409] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.409] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Linq.ni.dll.aux") returned -1 [0137.409] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Linq.ni.dll.aux") returned -1 [0137.410] lstrcmpiA (lpString1="", lpString2="System.Data.Linq.ni.dll.aux") returned -1 [0137.410] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\System.Data.Linq.ni.dll") returned="System.Data.Linq.ni.dll" [0137.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\" [0137.410] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\") returned="" [0137.410] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\007b02a1e3d37bdcdaae0d700cf97948\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data.linq\\007b02a1e3d37bdcdaae0d700cf97948\\how to decrypt files.txt")) returned 0x20 [0137.410] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21bbfd4c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x21bbfd4c, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x21bbfd4c, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Linq.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.410] FindClose (in: hFindFile=0x759f10 | out: hFindFile=0x759f10) returned 1 [0137.410] FindNextFileA (in: hFindFile=0x759e10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21bbfd4c, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x21bbfd4c, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x21bbfd4c, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="007b02a1e3d37bdcdaae0d700cf97948", cAlternateFileName="007B02~1")) returned 0 [0137.410] FindClose (in: hFindFile=0x759e10 | out: hFindFile=0x759e10) returned 1 [0137.411] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd797f63, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfd797f63, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfd797f63, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Data.SqlXml", cAlternateFileName="SYSTEM~1.SQL")) returned 1 [0137.411] lstrcmpA (lpString1=".", lpString2="System.Data.SqlXml") returned -1 [0137.411] lstrcmpA (lpString1="..", lpString2="System.Data.SqlXml") returned -1 [0137.411] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.411] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd797f63, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfd797f63, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfd797f63, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759e90 [0137.412] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.412] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd797f63, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfd797f63, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfd797f63, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.412] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.412] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.412] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd797f63, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfd797f63, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfd797f63, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6045428bf312d53d160f2c00a64a7b50", cAlternateFileName="604542~1")) returned 1 [0137.412] lstrcmpA (lpString1=".", lpString2="6045428bf312d53d160f2c00a64a7b50") returned -1 [0137.412] lstrcmpA (lpString1="..", lpString2="6045428bf312d53d160f2c00a64a7b50") returned -1 [0137.412] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\*.*") returned="*.*" [0137.412] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd797f63, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfd797f63, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfd797f63, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0137.417] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.417] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd797f63, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfd797f63, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfd797f63, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.417] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.417] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.417] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd725856, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfd725856, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfd7be1ec, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x2f9400, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Data.SqlXml.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.417] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.SqlXml.ni.dll") returned -1 [0137.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.SqlXml.ni.dll") returned -1 [0137.417] lstrcmpiA (lpString1="", lpString2="System.Data.SqlXml.ni.dll") returned -1 [0137.417] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\*.*") returned="*.*" [0137.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\" [0137.417] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\") returned="" [0137.417] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data.sqlxml\\6045428bf312d53d160f2c00a64a7b50\\how to decrypt files.txt")) returned 0xffffffff [0137.418] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data.sqlxml\\6045428bf312d53d160f2c00a64a7b50\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.421] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.421] CloseHandle (hObject=0x214) returned 1 [0137.421] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\", lpString2="System.Data.SqlXml.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll" [0137.421] lstrlenA (lpString="*.zip") returned 5 [0137.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.rar") returned 0 [0137.421] lstrlenA (lpString="*.rar") returned 5 [0137.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.7z") returned 0 [0137.421] lstrlenA (lpString="*.7z") returned 4 [0137.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.tar") returned 0 [0137.421] lstrlenA (lpString="*.tar") returned 5 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.gzip") returned 0 [0137.422] lstrlenA (lpString="*.gzip") returned 6 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.jpg") returned 0 [0137.422] lstrlenA (lpString="*.jpg") returned 5 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.jpeg") returned 0 [0137.422] lstrlenA (lpString="*.jpeg") returned 6 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.psd") returned 0 [0137.422] lstrlenA (lpString="*.psd") returned 5 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.cdr") returned 0 [0137.422] lstrlenA (lpString="*.cdr") returned 5 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.dwg") returned 0 [0137.422] lstrlenA (lpString="*.dwg") returned 5 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.max") returned 0 [0137.422] lstrlenA (lpString="*.max") returned 5 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.bmp") returned 0 [0137.422] lstrlenA (lpString="*.bmp") returned 5 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.gif") returned 0 [0137.422] lstrlenA (lpString="*.gif") returned 5 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.png") returned 0 [0137.422] lstrlenA (lpString="*.png") returned 5 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.doc") returned 0 [0137.422] lstrlenA (lpString="*.doc") returned 5 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.docx") returned 0 [0137.422] lstrlenA (lpString="*.docx") returned 6 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.xls") returned 0 [0137.422] lstrlenA (lpString="*.xls") returned 5 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.xlsx") returned 0 [0137.422] lstrlenA (lpString="*.xlsx") returned 6 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.ppt") returned 0 [0137.422] lstrlenA (lpString="*.ppt") returned 5 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.pptx") returned 0 [0137.422] lstrlenA (lpString="*.pptx") returned 6 [0137.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.txt") returned 0 [0137.423] lstrlenA (lpString="*.txt") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.pdf") returned 0 [0137.423] lstrlenA (lpString="*.pdf") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.djvu") returned 0 [0137.423] lstrlenA (lpString="*.djvu") returned 6 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.htm") returned 0 [0137.423] lstrlenA (lpString="*.htm") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.html") returned 0 [0137.423] lstrlenA (lpString="*.html") returned 6 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.mdb") returned 0 [0137.423] lstrlenA (lpString="*.mdb") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.cer") returned 0 [0137.423] lstrlenA (lpString="*.cer") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.p12") returned 0 [0137.423] lstrlenA (lpString="*.p12") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.pfx") returned 0 [0137.423] lstrlenA (lpString="*.pfx") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.kwm") returned 0 [0137.423] lstrlenA (lpString="*.kwm") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.pwm") returned 0 [0137.423] lstrlenA (lpString="*.pwm") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.1cd") returned 0 [0137.423] lstrlenA (lpString="*.1cd") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.md") returned 0 [0137.423] lstrlenA (lpString="*.md") returned 4 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.mdf") returned 0 [0137.423] lstrlenA (lpString="*.mdf") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.dbf") returned 0 [0137.423] lstrlenA (lpString="*.dbf") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.odt") returned 0 [0137.423] lstrlenA (lpString="*.odt") returned 5 [0137.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.vob") returned 0 [0137.423] lstrlenA (lpString="*.vob") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.ifo") returned 0 [0137.424] lstrlenA (lpString="*.ifo") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.lnk") returned 0 [0137.424] lstrlenA (lpString="*.lnk") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.torrent") returned 0 [0137.424] lstrlenA (lpString="*.torrent") returned 9 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.mov") returned 0 [0137.424] lstrlenA (lpString="*.mov") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.m2v") returned 0 [0137.424] lstrlenA (lpString="*.m2v") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.3gp") returned 0 [0137.424] lstrlenA (lpString="*.3gp") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.mpeg") returned 0 [0137.424] lstrlenA (lpString="*.mpeg") returned 6 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.mpg") returned 0 [0137.424] lstrlenA (lpString="*.mpg") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.flv") returned 0 [0137.424] lstrlenA (lpString="*.flv") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.avi") returned 0 [0137.424] lstrlenA (lpString="*.avi") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.mp4") returned 0 [0137.424] lstrlenA (lpString="*.mp4") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.wmv") returned 0 [0137.424] lstrlenA (lpString="*.wmv") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.divx") returned 0 [0137.424] lstrlenA (lpString="*.divx") returned 6 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.mkv") returned 0 [0137.424] lstrlenA (lpString="*.mkv") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.mp3") returned 0 [0137.424] lstrlenA (lpString="*.mp3") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.wav") returned 0 [0137.424] lstrlenA (lpString="*.wav") returned 5 [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.flac") returned 0 [0137.425] lstrlenA (lpString="*.flac") returned 6 [0137.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.ape") returned 0 [0137.425] lstrlenA (lpString="*.ape") returned 5 [0137.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.wma") returned 0 [0137.425] lstrlenA (lpString="*.wma") returned 5 [0137.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.ac3") returned 0 [0137.425] lstrlenA (lpString="*.ac3") returned 5 [0137.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll", pszSpec="*.doc") returned 0 [0137.425] lstrlenA (lpString="*.doc") returned 5 [0137.425] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd797f63, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfd797f63, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfd797f63, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.SqlXml.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.425] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.SqlXml.ni.dll.aux") returned -1 [0137.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.SqlXml.ni.dll.aux") returned -1 [0137.425] lstrcmpiA (lpString1="", lpString2="System.Data.SqlXml.ni.dll.aux") returned -1 [0137.425] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll") returned="System.Data.SqlXml.ni.dll" [0137.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\" [0137.425] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\") returned="" [0137.425] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\HOW TO DECRYPT FILES.txt" [0137.425] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data.sqlxml\\6045428bf312d53d160f2c00a64a7b50\\how to decrypt files.txt")) returned 0x20 [0137.425] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\", lpString2="System.Data.SqlXml.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux" [0137.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.zip") returned 0 [0137.425] lstrlenA (lpString="*.zip") returned 5 [0137.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.rar") returned 0 [0137.425] lstrlenA (lpString="*.rar") returned 5 [0137.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.7z") returned 0 [0137.425] lstrlenA (lpString="*.7z") returned 4 [0137.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.tar") returned 0 [0137.425] lstrlenA (lpString="*.tar") returned 5 [0137.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.gzip") returned 0 [0137.426] lstrlenA (lpString="*.gzip") returned 6 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.jpg") returned 0 [0137.426] lstrlenA (lpString="*.jpg") returned 5 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0137.426] lstrlenA (lpString="*.jpeg") returned 6 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.psd") returned 0 [0137.426] lstrlenA (lpString="*.psd") returned 5 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.cdr") returned 0 [0137.426] lstrlenA (lpString="*.cdr") returned 5 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.dwg") returned 0 [0137.426] lstrlenA (lpString="*.dwg") returned 5 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.max") returned 0 [0137.426] lstrlenA (lpString="*.max") returned 5 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.bmp") returned 0 [0137.426] lstrlenA (lpString="*.bmp") returned 5 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.gif") returned 0 [0137.426] lstrlenA (lpString="*.gif") returned 5 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.png") returned 0 [0137.426] lstrlenA (lpString="*.png") returned 5 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.426] lstrlenA (lpString="*.doc") returned 5 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.docx") returned 0 [0137.426] lstrlenA (lpString="*.docx") returned 6 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.xls") returned 0 [0137.426] lstrlenA (lpString="*.xls") returned 5 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0137.426] lstrlenA (lpString="*.xlsx") returned 6 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.ppt") returned 0 [0137.426] lstrlenA (lpString="*.ppt") returned 5 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.pptx") returned 0 [0137.426] lstrlenA (lpString="*.pptx") returned 6 [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.txt") returned 0 [0137.426] lstrlenA (lpString="*.txt") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.pdf") returned 0 [0137.427] lstrlenA (lpString="*.pdf") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.djvu") returned 0 [0137.427] lstrlenA (lpString="*.djvu") returned 6 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.htm") returned 0 [0137.427] lstrlenA (lpString="*.htm") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.html") returned 0 [0137.427] lstrlenA (lpString="*.html") returned 6 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.mdb") returned 0 [0137.427] lstrlenA (lpString="*.mdb") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.cer") returned 0 [0137.427] lstrlenA (lpString="*.cer") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.p12") returned 0 [0137.427] lstrlenA (lpString="*.p12") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.pfx") returned 0 [0137.427] lstrlenA (lpString="*.pfx") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.kwm") returned 0 [0137.427] lstrlenA (lpString="*.kwm") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.pwm") returned 0 [0137.427] lstrlenA (lpString="*.pwm") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.1cd") returned 0 [0137.427] lstrlenA (lpString="*.1cd") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.md") returned 0 [0137.427] lstrlenA (lpString="*.md") returned 4 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.mdf") returned 0 [0137.427] lstrlenA (lpString="*.mdf") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.dbf") returned 0 [0137.427] lstrlenA (lpString="*.dbf") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.odt") returned 0 [0137.427] lstrlenA (lpString="*.odt") returned 5 [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.vob") returned 0 [0137.427] lstrlenA (lpString="*.vob") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.ifo") returned 0 [0137.428] lstrlenA (lpString="*.ifo") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.lnk") returned 0 [0137.428] lstrlenA (lpString="*.lnk") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.torrent") returned 0 [0137.428] lstrlenA (lpString="*.torrent") returned 9 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.mov") returned 0 [0137.428] lstrlenA (lpString="*.mov") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.m2v") returned 0 [0137.428] lstrlenA (lpString="*.m2v") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.3gp") returned 0 [0137.428] lstrlenA (lpString="*.3gp") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0137.428] lstrlenA (lpString="*.mpeg") returned 6 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.mpg") returned 0 [0137.428] lstrlenA (lpString="*.mpg") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.flv") returned 0 [0137.428] lstrlenA (lpString="*.flv") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.avi") returned 0 [0137.428] lstrlenA (lpString="*.avi") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.mp4") returned 0 [0137.428] lstrlenA (lpString="*.mp4") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.wmv") returned 0 [0137.428] lstrlenA (lpString="*.wmv") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.divx") returned 0 [0137.428] lstrlenA (lpString="*.divx") returned 6 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.mkv") returned 0 [0137.428] lstrlenA (lpString="*.mkv") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.mp3") returned 0 [0137.428] lstrlenA (lpString="*.mp3") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.wav") returned 0 [0137.428] lstrlenA (lpString="*.wav") returned 5 [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.flac") returned 0 [0137.429] lstrlenA (lpString="*.flac") returned 6 [0137.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.ape") returned 0 [0137.429] lstrlenA (lpString="*.ape") returned 5 [0137.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.wma") returned 0 [0137.429] lstrlenA (lpString="*.wma") returned 5 [0137.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.ac3") returned 0 [0137.429] lstrlenA (lpString="*.ac3") returned 5 [0137.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\6045428bf312d53d160f2c00a64a7b50\\System.Data.SqlXml.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.429] lstrlenA (lpString="*.doc") returned 5 [0137.429] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd797f63, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfd797f63, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfd797f63, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.SqlXml.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.429] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0137.429] FindNextFileA (in: hFindFile=0x759e90, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd797f63, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xfd797f63, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfd797f63, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6045428bf312d53d160f2c00a64a7b50", cAlternateFileName="604542~1")) returned 0 [0137.429] FindClose (in: hFindFile=0x759e90 | out: hFindFile=0x759e90) returned 1 [0137.430] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x198a9bf6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x198a9bf6, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x198a9bf6, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Data14bed3a9#", cAlternateFileName="SYSTEM~4.DAT")) returned 1 [0137.430] lstrcmpA (lpString1=".", lpString2="System.Data14bed3a9#") returned -1 [0137.430] lstrcmpA (lpString1="..", lpString2="System.Data14bed3a9#") returned -1 [0137.430] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.430] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Data14bed3a9#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#" [0137.430] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#") returned 67 [0137.430] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x198a9bf6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x198a9bf6, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x198a9bf6, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759f10 [0137.430] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.431] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x198a9bf6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x198a9bf6, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x198a9bf6, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.431] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.431] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.431] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x198a9bf6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x198f60a7, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x198f60a7, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="99b26001f34521e5e92bb33744e3014e", cAlternateFileName="99B260~1")) returned 1 [0137.431] lstrcmpA (lpString1=".", lpString2="99b26001f34521e5e92bb33744e3014e") returned -1 [0137.431] lstrcmpA (lpString1="..", lpString2="99b26001f34521e5e92bb33744e3014e") returned -1 [0137.431] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\*.*") returned="*.*" [0137.431] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\", lpString2="99b26001f34521e5e92bb33744e3014e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e" [0137.431] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e") returned 100 [0137.431] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x198a9bf6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x198f60a7, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x198f60a7, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759b50 [0137.433] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.433] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x198a9bf6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x198f60a7, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x198f60a7, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.433] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.433] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.433] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19883977, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x19883977, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x1991c2f4, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x1a5c00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Data.Services.Client.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.433] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.433] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.Client.ni.dll") returned -1 [0137.433] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Client.ni.dll") returned -1 [0137.433] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Client.ni.dll") returned -1 [0137.433] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\*.*") returned="*.*" [0137.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\" [0137.433] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\") returned="" [0137.433] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\HOW TO DECRYPT FILES.txt" [0137.434] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\how to decrypt files.txt")) returned 0xffffffff [0137.434] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.435] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0137.435] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0137.436] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.436] CloseHandle (hObject=0x214) returned 1 [0137.437] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\", lpString2="System.Data.Services.Client.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll" [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.zip") returned 0 [0137.437] lstrlenA (lpString="*.zip") returned 5 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.rar") returned 0 [0137.437] lstrlenA (lpString="*.rar") returned 5 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.7z") returned 0 [0137.437] lstrlenA (lpString="*.7z") returned 4 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.tar") returned 0 [0137.437] lstrlenA (lpString="*.tar") returned 5 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.gzip") returned 0 [0137.437] lstrlenA (lpString="*.gzip") returned 6 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.jpg") returned 0 [0137.437] lstrlenA (lpString="*.jpg") returned 5 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.jpeg") returned 0 [0137.437] lstrlenA (lpString="*.jpeg") returned 6 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.psd") returned 0 [0137.437] lstrlenA (lpString="*.psd") returned 5 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.cdr") returned 0 [0137.437] lstrlenA (lpString="*.cdr") returned 5 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.dwg") returned 0 [0137.437] lstrlenA (lpString="*.dwg") returned 5 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.max") returned 0 [0137.437] lstrlenA (lpString="*.max") returned 5 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.bmp") returned 0 [0137.437] lstrlenA (lpString="*.bmp") returned 5 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.gif") returned 0 [0137.437] lstrlenA (lpString="*.gif") returned 5 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.png") returned 0 [0137.437] lstrlenA (lpString="*.png") returned 5 [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.doc") returned 0 [0137.437] lstrlenA (lpString="*.doc") returned 5 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.docx") returned 0 [0137.438] lstrlenA (lpString="*.docx") returned 6 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.xls") returned 0 [0137.438] lstrlenA (lpString="*.xls") returned 5 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.xlsx") returned 0 [0137.438] lstrlenA (lpString="*.xlsx") returned 6 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.ppt") returned 0 [0137.438] lstrlenA (lpString="*.ppt") returned 5 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.pptx") returned 0 [0137.438] lstrlenA (lpString="*.pptx") returned 6 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.txt") returned 0 [0137.438] lstrlenA (lpString="*.txt") returned 5 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.pdf") returned 0 [0137.438] lstrlenA (lpString="*.pdf") returned 5 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.djvu") returned 0 [0137.438] lstrlenA (lpString="*.djvu") returned 6 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.htm") returned 0 [0137.438] lstrlenA (lpString="*.htm") returned 5 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.html") returned 0 [0137.438] lstrlenA (lpString="*.html") returned 6 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.mdb") returned 0 [0137.438] lstrlenA (lpString="*.mdb") returned 5 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.cer") returned 0 [0137.438] lstrlenA (lpString="*.cer") returned 5 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.p12") returned 0 [0137.438] lstrlenA (lpString="*.p12") returned 5 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.pfx") returned 0 [0137.438] lstrlenA (lpString="*.pfx") returned 5 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.kwm") returned 0 [0137.438] lstrlenA (lpString="*.kwm") returned 5 [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.pwm") returned 0 [0137.438] lstrlenA (lpString="*.pwm") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.1cd") returned 0 [0137.439] lstrlenA (lpString="*.1cd") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.md") returned 0 [0137.439] lstrlenA (lpString="*.md") returned 4 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.mdf") returned 0 [0137.439] lstrlenA (lpString="*.mdf") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.dbf") returned 0 [0137.439] lstrlenA (lpString="*.dbf") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.odt") returned 0 [0137.439] lstrlenA (lpString="*.odt") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.vob") returned 0 [0137.439] lstrlenA (lpString="*.vob") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.ifo") returned 0 [0137.439] lstrlenA (lpString="*.ifo") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.lnk") returned 0 [0137.439] lstrlenA (lpString="*.lnk") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.torrent") returned 0 [0137.439] lstrlenA (lpString="*.torrent") returned 9 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.mov") returned 0 [0137.439] lstrlenA (lpString="*.mov") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.m2v") returned 0 [0137.439] lstrlenA (lpString="*.m2v") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.3gp") returned 0 [0137.439] lstrlenA (lpString="*.3gp") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.mpeg") returned 0 [0137.439] lstrlenA (lpString="*.mpeg") returned 6 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.mpg") returned 0 [0137.439] lstrlenA (lpString="*.mpg") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.flv") returned 0 [0137.439] lstrlenA (lpString="*.flv") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.avi") returned 0 [0137.439] lstrlenA (lpString="*.avi") returned 5 [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.mp4") returned 0 [0137.440] lstrlenA (lpString="*.mp4") returned 5 [0137.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.wmv") returned 0 [0137.440] lstrlenA (lpString="*.wmv") returned 5 [0137.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.divx") returned 0 [0137.440] lstrlenA (lpString="*.divx") returned 6 [0137.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.mkv") returned 0 [0137.440] lstrlenA (lpString="*.mkv") returned 5 [0137.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.mp3") returned 0 [0137.440] lstrlenA (lpString="*.mp3") returned 5 [0137.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.wav") returned 0 [0137.440] lstrlenA (lpString="*.wav") returned 5 [0137.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.flac") returned 0 [0137.440] lstrlenA (lpString="*.flac") returned 6 [0137.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.ape") returned 0 [0137.440] lstrlenA (lpString="*.ape") returned 5 [0137.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.wma") returned 0 [0137.440] lstrlenA (lpString="*.wma") returned 5 [0137.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.ac3") returned 0 [0137.440] lstrlenA (lpString="*.ac3") returned 5 [0137.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll", pszSpec="*.doc") returned 0 [0137.440] lstrlenA (lpString="*.doc") returned 5 [0137.440] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x198a9bf6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x198a9bf6, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x198f60a7, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Client.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.440] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.440] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.Client.ni.dll.aux") returned -1 [0137.440] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Client.ni.dll.aux") returned -1 [0137.440] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Client.ni.dll.aux") returned -1 [0137.440] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll") returned="System.Data.Services.Client.ni.dll" [0137.440] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\" [0137.440] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\") returned="" [0137.440] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\HOW TO DECRYPT FILES.txt" [0137.441] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\how to decrypt files.txt")) returned 0x20 [0137.441] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\", lpString2="System.Data.Services.Client.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux" [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.zip") returned 0 [0137.441] lstrlenA (lpString="*.zip") returned 5 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.rar") returned 0 [0137.441] lstrlenA (lpString="*.rar") returned 5 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.7z") returned 0 [0137.441] lstrlenA (lpString="*.7z") returned 4 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.tar") returned 0 [0137.441] lstrlenA (lpString="*.tar") returned 5 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.gzip") returned 0 [0137.441] lstrlenA (lpString="*.gzip") returned 6 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.jpg") returned 0 [0137.441] lstrlenA (lpString="*.jpg") returned 5 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0137.441] lstrlenA (lpString="*.jpeg") returned 6 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.psd") returned 0 [0137.441] lstrlenA (lpString="*.psd") returned 5 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.cdr") returned 0 [0137.441] lstrlenA (lpString="*.cdr") returned 5 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.dwg") returned 0 [0137.441] lstrlenA (lpString="*.dwg") returned 5 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.max") returned 0 [0137.441] lstrlenA (lpString="*.max") returned 5 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.bmp") returned 0 [0137.441] lstrlenA (lpString="*.bmp") returned 5 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.gif") returned 0 [0137.441] lstrlenA (lpString="*.gif") returned 5 [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.png") returned 0 [0137.441] lstrlenA (lpString="*.png") returned 5 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.442] lstrlenA (lpString="*.doc") returned 5 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.docx") returned 0 [0137.442] lstrlenA (lpString="*.docx") returned 6 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.xls") returned 0 [0137.442] lstrlenA (lpString="*.xls") returned 5 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0137.442] lstrlenA (lpString="*.xlsx") returned 6 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.ppt") returned 0 [0137.442] lstrlenA (lpString="*.ppt") returned 5 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.pptx") returned 0 [0137.442] lstrlenA (lpString="*.pptx") returned 6 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.txt") returned 0 [0137.442] lstrlenA (lpString="*.txt") returned 5 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.pdf") returned 0 [0137.442] lstrlenA (lpString="*.pdf") returned 5 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.djvu") returned 0 [0137.442] lstrlenA (lpString="*.djvu") returned 6 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.htm") returned 0 [0137.442] lstrlenA (lpString="*.htm") returned 5 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.html") returned 0 [0137.442] lstrlenA (lpString="*.html") returned 6 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.mdb") returned 0 [0137.442] lstrlenA (lpString="*.mdb") returned 5 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.cer") returned 0 [0137.442] lstrlenA (lpString="*.cer") returned 5 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.p12") returned 0 [0137.442] lstrlenA (lpString="*.p12") returned 5 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.pfx") returned 0 [0137.442] lstrlenA (lpString="*.pfx") returned 5 [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.kwm") returned 0 [0137.442] lstrlenA (lpString="*.kwm") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.pwm") returned 0 [0137.443] lstrlenA (lpString="*.pwm") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.1cd") returned 0 [0137.443] lstrlenA (lpString="*.1cd") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.md") returned 0 [0137.443] lstrlenA (lpString="*.md") returned 4 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.mdf") returned 0 [0137.443] lstrlenA (lpString="*.mdf") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.dbf") returned 0 [0137.443] lstrlenA (lpString="*.dbf") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.odt") returned 0 [0137.443] lstrlenA (lpString="*.odt") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.vob") returned 0 [0137.443] lstrlenA (lpString="*.vob") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.ifo") returned 0 [0137.443] lstrlenA (lpString="*.ifo") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.lnk") returned 0 [0137.443] lstrlenA (lpString="*.lnk") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.torrent") returned 0 [0137.443] lstrlenA (lpString="*.torrent") returned 9 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.mov") returned 0 [0137.443] lstrlenA (lpString="*.mov") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.m2v") returned 0 [0137.443] lstrlenA (lpString="*.m2v") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.3gp") returned 0 [0137.443] lstrlenA (lpString="*.3gp") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0137.443] lstrlenA (lpString="*.mpeg") returned 6 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.mpg") returned 0 [0137.443] lstrlenA (lpString="*.mpg") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.flv") returned 0 [0137.443] lstrlenA (lpString="*.flv") returned 5 [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.avi") returned 0 [0137.444] lstrlenA (lpString="*.avi") returned 5 [0137.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.mp4") returned 0 [0137.444] lstrlenA (lpString="*.mp4") returned 5 [0137.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.wmv") returned 0 [0137.444] lstrlenA (lpString="*.wmv") returned 5 [0137.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.divx") returned 0 [0137.444] lstrlenA (lpString="*.divx") returned 6 [0137.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.mkv") returned 0 [0137.444] lstrlenA (lpString="*.mkv") returned 5 [0137.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.mp3") returned 0 [0137.444] lstrlenA (lpString="*.mp3") returned 5 [0137.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.wav") returned 0 [0137.444] lstrlenA (lpString="*.wav") returned 5 [0137.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.flac") returned 0 [0137.444] lstrlenA (lpString="*.flac") returned 6 [0137.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.ape") returned 0 [0137.444] lstrlenA (lpString="*.ape") returned 5 [0137.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.wma") returned 0 [0137.444] lstrlenA (lpString="*.wma") returned 5 [0137.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.ac3") returned 0 [0137.444] lstrlenA (lpString="*.ac3") returned 5 [0137.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\99b26001f34521e5e92bb33744e3014e\\System.Data.Services.Client.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.444] lstrlenA (lpString="*.doc") returned 5 [0137.444] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x198a9bf6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x198a9bf6, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x198f60a7, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Client.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.444] FindClose (in: hFindFile=0x759b50 | out: hFindFile=0x759b50) returned 1 [0137.445] FindNextFileA (in: hFindFile=0x759f10, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x198a9bf6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x198f60a7, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x198f60a7, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="99b26001f34521e5e92bb33744e3014e", cAlternateFileName="99B260~1")) returned 0 [0137.445] FindClose (in: hFindFile=0x759f10 | out: hFindFile=0x759f10) returned 1 [0137.445] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d38115, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x12d38115, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x12d38115, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Data16016462#", cAlternateFileName="SYSTEM~3.DAT")) returned 1 [0137.445] lstrcmpA (lpString1=".", lpString2="System.Data16016462#") returned -1 [0137.445] lstrcmpA (lpString1="..", lpString2="System.Data16016462#") returned -1 [0137.445] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.445] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Data16016462#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#" [0137.445] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#") returned 67 [0137.445] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d38115, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x12d38115, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x12d38115, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0137.446] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.446] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d38115, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x12d38115, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x12d38115, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.446] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.446] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.446] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d38115, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x12d5e375, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x12d5e375, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="222260bea54c2e8d1121a9b3b79c14bc", cAlternateFileName="222260~1")) returned 1 [0137.446] lstrcmpA (lpString1=".", lpString2="222260bea54c2e8d1121a9b3b79c14bc") returned -1 [0137.446] lstrcmpA (lpString1="..", lpString2="222260bea54c2e8d1121a9b3b79c14bc") returned -1 [0137.446] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\*.*") returned="*.*" [0137.446] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\", lpString2="222260bea54c2e8d1121a9b3b79c14bc" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc" [0137.446] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc") returned 100 [0137.446] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d38115, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x12d5e375, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x12d5e375, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759d90 [0137.448] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.448] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d38115, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x12d5e375, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x12d5e375, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.448] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.448] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.448] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12d38115, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x12d38115, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x12d845c9, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Data.Services.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.448] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.448] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.Design.ni.dll") returned -1 [0137.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Design.ni.dll") returned -1 [0137.448] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Design.ni.dll") returned -1 [0137.448] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\*.*") returned="*.*" [0137.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\" [0137.448] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\") returned="" [0137.448] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\HOW TO DECRYPT FILES.txt" [0137.448] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\how to decrypt files.txt")) returned 0xffffffff [0137.448] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.450] lstrlenA (lpString="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n") returned 306 [0137.450] WriteFile (in: hFile=0x214, lpBuffer=0x74ffd8*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x74ffd8*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1 [0137.451] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.451] CloseHandle (hObject=0x214) returned 1 [0137.451] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\", lpString2="System.Data.Services.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll" [0137.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.zip") returned 0 [0137.451] lstrlenA (lpString="*.zip") returned 5 [0137.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.rar") returned 0 [0137.451] lstrlenA (lpString="*.rar") returned 5 [0137.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.7z") returned 0 [0137.451] lstrlenA (lpString="*.7z") returned 4 [0137.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.tar") returned 0 [0137.451] lstrlenA (lpString="*.tar") returned 5 [0137.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.gzip") returned 0 [0137.451] lstrlenA (lpString="*.gzip") returned 6 [0137.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.jpg") returned 0 [0137.451] lstrlenA (lpString="*.jpg") returned 5 [0137.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0137.451] lstrlenA (lpString="*.jpeg") returned 6 [0137.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.psd") returned 0 [0137.452] lstrlenA (lpString="*.psd") returned 5 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.cdr") returned 0 [0137.452] lstrlenA (lpString="*.cdr") returned 5 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.dwg") returned 0 [0137.452] lstrlenA (lpString="*.dwg") returned 5 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.max") returned 0 [0137.452] lstrlenA (lpString="*.max") returned 5 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.bmp") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.gif") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.png") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.doc") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.docx") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.xls") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.ppt") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.pptx") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.txt") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.pdf") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.djvu") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.htm") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.html") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.mdb") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.cer") returned 0 [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.p12") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.pfx") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.kwm") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.pwm") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.1cd") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.md") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.mdf") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.dbf") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.odt") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.vob") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.ifo") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.lnk") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.torrent") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.mov") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.m2v") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.3gp") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.mpeg") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.mpg") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.flv") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.avi") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.mp4") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.wmv") returned 0 [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.divx") returned 0 [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.mkv") returned 0 [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.mp3") returned 0 [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.wav") returned 0 [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.flac") returned 0 [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.ape") returned 0 [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.wma") returned 0 [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.ac3") returned 0 [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll", pszSpec="*.doc") returned 0 [0137.454] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12d5e375, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x12d5e375, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x12d5e375, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.454] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.454] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.Design.ni.dll.aux") returned -1 [0137.454] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Design.ni.dll.aux") returned -1 [0137.454] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Design.ni.dll.aux") returned -1 [0137.454] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll") returned="System.Data.Services.Design.ni.dll" [0137.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\" [0137.454] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\") returned="" [0137.454] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\HOW TO DECRYPT FILES.txt" [0137.454] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\how to decrypt files.txt")) returned 0x20 [0137.454] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\", lpString2="System.Data.Services.Design.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux" [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.zip") returned 0 [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.rar") returned 0 [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.7z") returned 0 [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.tar") returned 0 [0137.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.gzip") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.jpg") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.psd") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.cdr") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.dwg") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.max") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.bmp") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.gif") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.png") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.docx") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.xls") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.ppt") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.pptx") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.txt") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.pdf") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.djvu") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.htm") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.html") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.mdb") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.cer") returned 0 [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.p12") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.pfx") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.kwm") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.pwm") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.1cd") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.md") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.mdf") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.dbf") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.odt") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.vob") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.ifo") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.lnk") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.torrent") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.mov") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.m2v") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.3gp") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.mpg") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.flv") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.avi") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.mp4") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.wmv") returned 0 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.divx") returned 0 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.mkv") returned 0 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.mp3") returned 0 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.wav") returned 0 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.flac") returned 0 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.ape") returned 0 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.wma") returned 0 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.ac3") returned 0 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\222260bea54c2e8d1121a9b3b79c14bc\\System.Data.Services.Design.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.457] FindNextFileA (in: hFindFile=0x759d90, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12d5e375, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x12d5e375, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x12d5e375, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.457] FindClose (in: hFindFile=0x759d90 | out: hFindFile=0x759d90) returned 1 [0137.457] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d38115, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x12d5e375, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x12d5e375, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="222260bea54c2e8d1121a9b3b79c14bc", cAlternateFileName="222260~1")) returned 0 [0137.457] FindClose (in: hFindFile=0x759d50 | out: hFindFile=0x759d50) returned 1 [0137.458] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3d2624, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa3d2624, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa3d2624, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Data86569bbf#", cAlternateFileName="SYSTEM~2.DAT")) returned 1 [0137.458] lstrcmpA (lpString1=".", lpString2="System.Data86569bbf#") returned -1 [0137.458] lstrcmpA (lpString1="..", lpString2="System.Data86569bbf#") returned -1 [0137.458] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.458] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Data86569bbf#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#" [0137.458] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3d2624, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa3d2624, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa3d2624, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759b50 [0137.471] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.471] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3d2624, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa3d2624, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa3d2624, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.471] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.471] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.471] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3d2624, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa3d2624, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa3d2624, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="a122d0bd81029f2a1af93b6adfabd52f", cAlternateFileName="A122D0~1")) returned 1 [0137.471] lstrcmpA (lpString1=".", lpString2="a122d0bd81029f2a1af93b6adfabd52f") returned -1 [0137.471] lstrcmpA (lpString1="..", lpString2="a122d0bd81029f2a1af93b6adfabd52f") returned -1 [0137.471] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\*.*") returned="*.*" [0137.471] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\", lpString2="a122d0bd81029f2a1af93b6adfabd52f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f" [0137.471] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3d2624, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa3d2624, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa3d2624, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x759ed0 [0137.473] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.473] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3d2624, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa3d2624, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa3d2624, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.474] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.474] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.474] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3ac395, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa3ac395, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa3f8830, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x153c00, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Data.OracleClient.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.474] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.474] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.OracleClient.ni.dll") returned -1 [0137.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.OracleClient.ni.dll") returned -1 [0137.474] lstrcmpiA (lpString1="", lpString2="System.Data.OracleClient.ni.dll") returned -1 [0137.474] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\*.*") returned="*.*" [0137.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\" [0137.474] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\") returned="" [0137.474] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\HOW TO DECRYPT FILES.txt" [0137.474] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\how to decrypt files.txt")) returned 0xffffffff [0137.474] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.476] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.477] CloseHandle (hObject=0x214) returned 1 [0137.477] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\", lpString2="System.Data.OracleClient.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll" [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.zip") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.rar") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.7z") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.tar") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.gzip") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.jpg") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.jpeg") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.psd") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.cdr") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.dwg") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.max") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.bmp") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.gif") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.png") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.doc") returned 0 [0137.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.docx") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.xls") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.xlsx") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.ppt") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.pptx") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.txt") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.pdf") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.djvu") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.htm") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.html") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.mdb") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.cer") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.p12") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.pfx") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.kwm") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.pwm") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.1cd") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.md") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.mdf") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.dbf") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.odt") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.vob") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.ifo") returned 0 [0137.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.lnk") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.torrent") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.mov") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.m2v") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.3gp") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.mpeg") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.mpg") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.flv") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.avi") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.mp4") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.wmv") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.divx") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.mkv") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.mp3") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.wav") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.flac") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.ape") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.wma") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.ac3") returned 0 [0137.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll", pszSpec="*.doc") returned 0 [0137.479] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d2624, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa3d2624, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa3d2624, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.OracleClient.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.479] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.479] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.OracleClient.ni.dll.aux") returned -1 [0137.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.OracleClient.ni.dll.aux") returned -1 [0137.479] lstrcmpiA (lpString1="", lpString2="System.Data.OracleClient.ni.dll.aux") returned -1 [0137.480] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll") returned="System.Data.OracleClient.ni.dll" [0137.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\" [0137.480] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\") returned="" [0137.480] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\HOW TO DECRYPT FILES.txt" [0137.480] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\how to decrypt files.txt")) returned 0x20 [0137.480] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\", lpString2="System.Data.OracleClient.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux" [0137.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.zip") returned 0 [0137.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.rar") returned 0 [0137.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.7z") returned 0 [0137.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.tar") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.gzip") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.jpg") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.psd") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.cdr") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.dwg") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.max") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.bmp") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.gif") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.png") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.docx") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.xls") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.ppt") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.pptx") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.txt") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.pdf") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.djvu") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.htm") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.html") returned 0 [0137.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.mdb") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.cer") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.p12") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.pfx") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.kwm") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.pwm") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.1cd") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.md") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.mdf") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.dbf") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.odt") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.vob") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.ifo") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.lnk") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.torrent") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.mov") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.m2v") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.3gp") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.mpg") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.flv") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.avi") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.mp4") returned 0 [0137.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.wmv") returned 0 [0137.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.divx") returned 0 [0137.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.mkv") returned 0 [0137.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.mp3") returned 0 [0137.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.wav") returned 0 [0137.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.flac") returned 0 [0137.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.ape") returned 0 [0137.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.wma") returned 0 [0137.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.ac3") returned 0 [0137.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a122d0bd81029f2a1af93b6adfabd52f\\System.Data.OracleClient.ni.dll.aux", pszSpec="*.doc") returned 0 [0137.483] FindNextFileA (in: hFindFile=0x759ed0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d2624, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa3d2624, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa3d2624, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.OracleClient.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0137.483] FindClose (in: hFindFile=0x759ed0 | out: hFindFile=0x759ed0) returned 1 [0137.484] FindNextFileA (in: hFindFile=0x759b50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3d2624, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0xa3d2624, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0xa3d2624, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="a122d0bd81029f2a1af93b6adfabd52f", cAlternateFileName="A122D0~1")) returned 0 [0137.484] FindClose (in: hFindFile=0x759b50 | out: hFindFile=0x759b50) returned 1 [0137.484] FindNextFileA (in: hFindFile=0x759dd0, lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c54b6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x94c54b6, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x94c54b6, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e00, dwReserved1=0x75612e6c, cFileName="System.Deployment", cAlternateFileName="SYSTEM~1.DEP")) returned 1 [0137.484] lstrcmpA (lpString1=".", lpString2="System.Deployment") returned -1 [0137.484] lstrcmpA (lpString1="..", lpString2="System.Deployment") returned -1 [0137.484] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.484] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Deployment" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment" [0137.484] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\*.*", lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c54b6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x94c54b6, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x94c54b6, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d50 [0137.485] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.485] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c54b6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x94c54b6, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x94c54b6, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.485] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.485] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.485] FindNextFileA (in: hFindFile=0x759d50, lpFindFileData=0x19f8f0 | out: lpFindFileData=0x19f8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c54b6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x94eb73f, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x94eb73f, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="41c1499e9c9208577068bd6ef85ca7bd", cAlternateFileName="41C149~1")) returned 1 [0137.485] lstrcmpA (lpString1=".", lpString2="41c1499e9c9208577068bd6ef85ca7bd") returned -1 [0137.485] lstrcmpA (lpString1="..", lpString2="41c1499e9c9208577068bd6ef85ca7bd") returned -1 [0137.485] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\*.*") returned="*.*" [0137.485] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\", lpString2="41c1499e9c9208577068bd6ef85ca7bd" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd" [0137.485] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\*.*", lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c54b6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x94eb73f, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x94eb73f, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x7599d0 [0137.486] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.486] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c54b6, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x94eb73f, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x94eb73f, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0137.486] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.486] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.486] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949f244, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x949f244, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x94eb73f, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x220600, dwReserved0=0xffffffff, dwReserved1=0x20000, cFileName="System.Deployment.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.486] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.486] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Deployment.ni.dll") returned -1 [0137.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Deployment.ni.dll") returned -1 [0137.486] lstrcmpiA (lpString1="", lpString2="System.Deployment.ni.dll") returned -1 [0137.486] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\*.*") returned="*.*" [0137.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\" [0137.486] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\") returned="" [0137.486] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\HOW TO DECRYPT FILES.txt" [0137.486] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.deployment\\41c1499e9c9208577068bd6ef85ca7bd\\how to decrypt files.txt")) returned 0xffffffff [0137.486] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.deployment\\41c1499e9c9208577068bd6ef85ca7bd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.490] SetFileTime (hFile=0x214, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.490] CloseHandle (hObject=0x214) returned 1 [0137.490] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\", lpString2="System.Deployment.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll" [0137.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.zip") returned 0 [0137.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.rar") returned 0 [0137.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.7z") returned 0 [0137.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.tar") returned 0 [0137.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.gzip") returned 0 [0137.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.jpg") returned 0 [0137.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.jpeg") returned 0 [0137.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.psd") returned 0 [0137.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.cdr") returned 0 [0137.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.dwg") returned 0 [0137.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.max") returned 0 [0137.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.bmp") returned 0 [0137.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.gif") returned 0 [0137.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.png") returned 0 [0137.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.doc") returned 0 [0137.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.docx") returned 0 [0137.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll", pszSpec="*.xls") returned 0 [0137.491] FindNextFileA (in: hFindFile=0x7599d0, lpFindFileData=0x19f7a0 | out: lpFindFileData=0x19f7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94eb73f, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x94eb73f, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x94eb73f, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Deployment.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0137.491] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Deployment.ni.dll.aux") returned -1 [0137.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Deployment.ni.dll.aux") returned -1 [0137.491] lstrcmpiA (lpString1="", lpString2="System.Deployment.ni.dll.aux") returned -1 [0137.491] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll") returned="System.Deployment.ni.dll" [0137.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\" [0137.492] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\") returned="" [0137.492] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\HOW TO DECRYPT FILES.txt" [0137.492] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.deployment\\41c1499e9c9208577068bd6ef85ca7bd\\how to decrypt files.txt")) returned 0x20 [0137.492] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\", lpString2="System.Deployment.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\41c1499e9c9208577068bd6ef85ca7bd\\System.Deployment.ni.dll.aux" [0137.493] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.493] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Design" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design" [0137.494] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\*.*") returned="*.*" [0137.494] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\", lpString2="dba0c22132bef7f6cc3a9ac1ad96c9ad" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad" [0137.497] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.497] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Design.ni.dll") returned -1 [0137.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Design.ni.dll") returned -1 [0137.497] lstrcmpiA (lpString1="", lpString2="System.Design.ni.dll") returned -1 [0137.497] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\*.*") returned="*.*" [0137.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\" [0137.497] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\") returned="" [0137.497] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\HOW TO DECRYPT FILES.txt" [0137.497] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\how to decrypt files.txt")) returned 0xffffffff [0137.497] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.501] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.501] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Design.ni.dll.aux") returned -1 [0137.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Design.ni.dll.aux") returned -1 [0137.501] lstrcmpiA (lpString1="", lpString2="System.Design.ni.dll.aux") returned -1 [0137.501] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\System.Design.ni.dll") returned="System.Design.ni.dll" [0137.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\" [0137.501] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\") returned="" [0137.501] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\HOW TO DECRYPT FILES.txt" [0137.501] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\how to decrypt files.txt")) returned 0x20 [0137.501] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\", lpString2="System.Design.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\System.Design.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\dba0c22132bef7f6cc3a9ac1ad96c9ad\\System.Design.ni.dll.aux" [0137.501] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.501] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Diagd2d95910#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#" [0137.502] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\*.*") returned="*.*" [0137.502] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\", lpString2="9e3f5b8833d63a671804bc99ad12009c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c" [0137.503] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.503] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Diagnostics.Tracing.ni.dll") returned -1 [0137.503] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Diagnostics.Tracing.ni.dll") returned -1 [0137.503] lstrcmpiA (lpString1="", lpString2="System.Diagnostics.Tracing.ni.dll") returned -1 [0137.504] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\*.*") returned="*.*" [0137.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\" [0137.504] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\") returned="" [0137.504] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\HOW TO DECRYPT FILES.txt" [0137.504] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\how to decrypt files.txt")) returned 0xffffffff [0137.504] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.506] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.506] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Diagnostics.Tracing.ni.dll.aux") returned -1 [0137.506] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Diagnostics.Tracing.ni.dll.aux") returned -1 [0137.506] lstrcmpiA (lpString1="", lpString2="System.Diagnostics.Tracing.ni.dll.aux") returned -1 [0137.506] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\System.Diagnostics.Tracing.ni.dll") returned="System.Diagnostics.Tracing.ni.dll" [0137.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\" [0137.506] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\") returned="" [0137.506] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\HOW TO DECRYPT FILES.txt" [0137.506] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\how to decrypt files.txt")) returned 0x20 [0137.506] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\", lpString2="System.Diagnostics.Tracing.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\System.Diagnostics.Tracing.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Diagd2d95910#\\9e3f5b8833d63a671804bc99ad12009c\\System.Diagnostics.Tracing.ni.dll.aux" [0137.506] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.506] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Dire5d62f0a2#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#" [0137.524] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\*.*") returned="*.*" [0137.524] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\", lpString2="8eb5aa83f2f97f8aed81c0b9405fcf81" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81" [0137.526] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.526] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.Protocols.ni.dll") returned -1 [0137.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.Protocols.ni.dll") returned -1 [0137.526] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.Protocols.ni.dll") returned -1 [0137.526] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\*.*") returned="*.*" [0137.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\" [0137.526] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\") returned="" [0137.526] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\HOW TO DECRYPT FILES.txt" [0137.526] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\how to decrypt files.txt")) returned 0xffffffff [0137.526] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.530] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.530] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.Protocols.ni.dll.aux") returned -1 [0137.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.Protocols.ni.dll.aux") returned -1 [0137.530] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.Protocols.ni.dll.aux") returned -1 [0137.530] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\System.DirectoryServices.Protocols.ni.dll") returned="System.DirectoryServices.Protocols.ni.dll" [0137.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\" [0137.530] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\") returned="" [0137.530] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\HOW TO DECRYPT FILES.txt" [0137.531] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\how to decrypt files.txt")) returned 0x20 [0137.531] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\", lpString2="System.DirectoryServices.Protocols.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\System.DirectoryServices.Protocols.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\8eb5aa83f2f97f8aed81c0b9405fcf81\\System.DirectoryServices.Protocols.ni.dll.aux" [0137.531] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.531] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Dired13b18a9#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#" [0137.532] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\*.*") returned="*.*" [0137.532] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\", lpString2="750cb34fc3203f4ca647ea446572341f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f" [0137.534] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.534] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.ni.dll") returned -1 [0137.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.ni.dll") returned -1 [0137.534] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.ni.dll") returned -1 [0137.534] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\*.*") returned="*.*" [0137.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\" [0137.534] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\") returned="" [0137.534] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\HOW TO DECRYPT FILES.txt" [0137.534] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\how to decrypt files.txt")) returned 0xffffffff [0137.534] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.536] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.536] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.ni.dll.aux") returned -1 [0137.536] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.ni.dll.aux") returned -1 [0137.536] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.ni.dll.aux") returned -1 [0137.536] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\System.DirectoryServices.ni.dll") returned="System.DirectoryServices.ni.dll" [0137.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\" [0137.536] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\") returned="" [0137.536] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\HOW TO DECRYPT FILES.txt" [0137.536] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\how to decrypt files.txt")) returned 0x20 [0137.536] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\", lpString2="System.DirectoryServices.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\System.DirectoryServices.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\750cb34fc3203f4ca647ea446572341f\\System.DirectoryServices.ni.dll.aux" [0137.537] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.537] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Draw0a54d252#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#" [0137.537] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\*.*") returned="*.*" [0137.537] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\", lpString2="3040e2110c2167f5adb3a85a4ecf1826" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826" [0137.539] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.Design.ni.dll") returned -1 [0137.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.Design.ni.dll") returned -1 [0137.539] lstrcmpiA (lpString1="", lpString2="System.Drawing.Design.ni.dll") returned -1 [0137.539] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\*.*") returned="*.*" [0137.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\" [0137.539] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\") returned="" [0137.539] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\HOW TO DECRYPT FILES.txt" [0137.539] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\how to decrypt files.txt")) returned 0xffffffff [0137.539] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.541] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.541] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.Design.ni.dll.aux") returned -1 [0137.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.Design.ni.dll.aux") returned -1 [0137.542] lstrcmpiA (lpString1="", lpString2="System.Drawing.Design.ni.dll.aux") returned -1 [0137.542] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\System.Drawing.Design.ni.dll") returned="System.Drawing.Design.ni.dll" [0137.542] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\" [0137.542] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\") returned="" [0137.542] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\HOW TO DECRYPT FILES.txt" [0137.542] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\how to decrypt files.txt")) returned 0x20 [0137.542] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\", lpString2="System.Drawing.Design.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\System.Drawing.Design.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\3040e2110c2167f5adb3a85a4ecf1826\\System.Drawing.Design.ni.dll.aux" [0137.542] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.542] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Drawing" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing" [0137.542] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\*.*") returned="*.*" [0137.542] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\", lpString2="ac6a6e699deef074ee277bc2bc44b5da" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da" [0137.542] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.583] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.ni.dll") returned -1 [0137.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.ni.dll") returned -1 [0137.583] lstrcmpiA (lpString1="", lpString2="System.Drawing.ni.dll") returned -1 [0137.583] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\*.*") returned="*.*" [0137.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\" [0137.583] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\") returned="" [0137.583] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\HOW TO DECRYPT FILES.txt" [0137.584] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ac6a6e699deef074ee277bc2bc44b5da\\how to decrypt files.txt")) returned 0xffffffff [0137.584] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ac6a6e699deef074ee277bc2bc44b5da\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.587] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.587] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.ni.dll.aux") returned -1 [0137.587] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.ni.dll.aux") returned -1 [0137.587] lstrcmpiA (lpString1="", lpString2="System.Drawing.ni.dll.aux") returned -1 [0137.587] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\System.Drawing.ni.dll") returned="System.Drawing.ni.dll" [0137.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\" [0137.587] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\") returned="" [0137.587] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\HOW TO DECRYPT FILES.txt" [0137.588] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ac6a6e699deef074ee277bc2bc44b5da\\how to decrypt files.txt")) returned 0x20 [0137.588] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\", lpString2="System.Drawing.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\System.Drawing.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ac6a6e699deef074ee277bc2bc44b5da\\System.Drawing.ni.dll.aux" [0137.588] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.588] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Dynamic" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic" [0137.589] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\*.*") returned="*.*" [0137.589] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\", lpString2="922bf9ea21fc0063ee2946f1ce6ba3d0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0" [0137.590] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.590] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Dynamic.ni.dll") returned -1 [0137.590] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Dynamic.ni.dll") returned -1 [0137.590] lstrcmpiA (lpString1="", lpString2="System.Dynamic.ni.dll") returned -1 [0137.590] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\*.*") returned="*.*" [0137.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\" [0137.591] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\") returned="" [0137.591] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\HOW TO DECRYPT FILES.txt" [0137.591] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\how to decrypt files.txt")) returned 0xffffffff [0137.591] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.595] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.595] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Dynamic.ni.dll.aux") returned -1 [0137.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Dynamic.ni.dll.aux") returned -1 [0137.595] lstrcmpiA (lpString1="", lpString2="System.Dynamic.ni.dll.aux") returned -1 [0137.595] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\System.Dynamic.ni.dll") returned="System.Dynamic.ni.dll" [0137.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\" [0137.595] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\") returned="" [0137.595] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\HOW TO DECRYPT FILES.txt" [0137.595] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\how to decrypt files.txt")) returned 0x20 [0137.595] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\", lpString2="System.Dynamic.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\System.Dynamic.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\922bf9ea21fc0063ee2946f1ce6ba3d0\\System.Dynamic.ni.dll.aux" [0137.595] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.595] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Ente96d83b35#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#" [0137.596] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\*.*") returned="*.*" [0137.596] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\", lpString2="9d999077664f1be3d0884470e8e27ee4" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4" [0137.597] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.597] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.EnterpriseServices.ni.dll") returned -1 [0137.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.EnterpriseServices.ni.dll") returned -1 [0137.597] lstrcmpiA (lpString1="", lpString2="System.EnterpriseServices.ni.dll") returned -1 [0137.597] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\*.*") returned="*.*" [0137.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\" [0137.598] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\") returned="" [0137.598] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\HOW TO DECRYPT FILES.txt" [0137.598] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\how to decrypt files.txt")) returned 0xffffffff [0137.598] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.600] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.EnterpriseServices.ni.dll.aux") returned -1 [0137.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.EnterpriseServices.ni.dll.aux") returned -1 [0137.600] lstrcmpiA (lpString1="", lpString2="System.EnterpriseServices.ni.dll.aux") returned -1 [0137.600] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\System.EnterpriseServices.ni.dll") returned="System.EnterpriseServices.ni.dll" [0137.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\" [0137.600] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\") returned="" [0137.600] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\HOW TO DECRYPT FILES.txt" [0137.600] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\how to decrypt files.txt")) returned 0x20 [0137.600] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\", lpString2="System.EnterpriseServices.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\System.EnterpriseServices.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\System.EnterpriseServices.ni.dll.aux" [0137.600] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1 [0137.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1 [0137.600] lstrcmpiA (lpString1="", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1 [0137.600] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\System.EnterpriseServices.ni.dll.aux") returned="System.EnterpriseServices.ni.dll.aux" [0137.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\" [0137.600] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\") returned="" [0137.601] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\HOW TO DECRYPT FILES.txt" [0137.601] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\how to decrypt files.txt")) returned 0x20 [0137.601] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\", lpString2="System.EnterpriseServices.Wrapper.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\System.EnterpriseServices.Wrapper.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\9d999077664f1be3d0884470e8e27ee4\\System.EnterpriseServices.Wrapper.dll" [0137.601] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.601] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Idena7b556ff#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#" [0137.602] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\*.*") returned="*.*" [0137.602] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\", lpString2="c7f9d2ecea2e14599bd161418c071b44" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44" [0137.604] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.604] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.Selectors.ni.dll") returned -1 [0137.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.Selectors.ni.dll") returned -1 [0137.604] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.Selectors.ni.dll") returned -1 [0137.604] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\*.*") returned="*.*" [0137.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\" [0137.604] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\") returned="" [0137.604] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\HOW TO DECRYPT FILES.txt" [0137.604] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\how to decrypt files.txt")) returned 0xffffffff [0137.604] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.609] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.609] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.Selectors.ni.dll.aux") returned -1 [0137.609] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.Selectors.ni.dll.aux") returned -1 [0137.609] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.Selectors.ni.dll.aux") returned -1 [0137.609] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\System.IdentityModel.Selectors.ni.dll") returned="System.IdentityModel.Selectors.ni.dll" [0137.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\" [0137.610] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\") returned="" [0137.610] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\HOW TO DECRYPT FILES.txt" [0137.610] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\how to decrypt files.txt")) returned 0x20 [0137.610] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\", lpString2="System.IdentityModel.Selectors.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\System.IdentityModel.Selectors.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\c7f9d2ecea2e14599bd161418c071b44\\System.IdentityModel.Selectors.ni.dll.aux" [0137.610] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.610] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.IdentityModel" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel" [0137.611] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\*.*") returned="*.*" [0137.611] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\", lpString2="a7c0084fc2674e0a2628fc1931410496" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496" [0137.611] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.611] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.ni.dll") returned -1 [0137.611] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.ni.dll") returned -1 [0137.611] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.ni.dll") returned -1 [0137.611] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\*.*") returned="*.*" [0137.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\" [0137.611] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\") returned="" [0137.611] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\HOW TO DECRYPT FILES.txt" [0137.611] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.identitymodel\\a7c0084fc2674e0a2628fc1931410496\\how to decrypt files.txt")) returned 0xffffffff [0137.611] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.identitymodel\\a7c0084fc2674e0a2628fc1931410496\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.614] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.615] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.ni.dll.aux") returned -1 [0137.615] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.ni.dll.aux") returned -1 [0137.615] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.ni.dll.aux") returned -1 [0137.615] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\System.IdentityModel.ni.dll") returned="System.IdentityModel.ni.dll" [0137.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\" [0137.615] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\") returned="" [0137.615] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\HOW TO DECRYPT FILES.txt" [0137.615] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.identitymodel\\a7c0084fc2674e0a2628fc1931410496\\how to decrypt files.txt")) returned 0x20 [0137.615] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\", lpString2="System.IdentityModel.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\System.IdentityModel.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\a7c0084fc2674e0a2628fc1931410496\\System.IdentityModel.ni.dll.aux" [0137.615] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.615] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Manaa57fc8cc#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#" [0137.616] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\*.*") returned="*.*" [0137.616] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\", lpString2="2fdbea724c8a270350bdd592c56e0860" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860" [0137.618] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.618] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\*.*") returned="*.*" [0137.618] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\" [0137.618] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\") returned="" [0137.618] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\HOW TO DECRYPT FILES.txt" [0137.618] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\how to decrypt files.txt")) returned 0xffffffff [0137.618] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.621] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.621] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\System.Management.Automation.ni.dll") returned="System.Management.Automation.ni.dll" [0137.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\" [0137.621] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\") returned="" [0137.621] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\HOW TO DECRYPT FILES.txt" [0137.621] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\how to decrypt files.txt")) returned 0x20 [0137.621] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\", lpString2="System.Management.Automation.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\System.Management.Automation.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\2fdbea724c8a270350bdd592c56e0860\\System.Management.Automation.ni.dll.aux" [0137.622] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.622] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Management" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management" [0137.622] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\*.*") returned="*.*" [0137.622] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\", lpString2="22bd3b2335053b60c100d13f3eb49481" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481" [0137.623] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.623] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\*.*") returned="*.*" [0137.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\" [0137.623] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\") returned="" [0137.623] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\HOW TO DECRYPT FILES.txt" [0137.623] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.management\\22bd3b2335053b60c100d13f3eb49481\\how to decrypt files.txt")) returned 0xffffffff [0137.623] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.management\\22bd3b2335053b60c100d13f3eb49481\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.626] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.626] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\System.Management.ni.dll") returned="System.Management.ni.dll" [0137.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\" [0137.626] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\") returned="" [0137.626] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\HOW TO DECRYPT FILES.txt" [0137.626] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.management\\22bd3b2335053b60c100d13f3eb49481\\how to decrypt files.txt")) returned 0x20 [0137.626] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\", lpString2="System.Management.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\System.Management.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\22bd3b2335053b60c100d13f3eb49481\\System.Management.ni.dll.aux" [0137.626] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.626] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Messaging" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging" [0137.661] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\*.*") returned="*.*" [0137.661] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\", lpString2="48a6fe1e314ebf355ec133aa4916e86e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e" [0137.661] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.661] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\*.*") returned="*.*" [0137.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\" [0137.662] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\") returned="" [0137.662] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\HOW TO DECRYPT FILES.txt" [0137.662] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.messaging\\48a6fe1e314ebf355ec133aa4916e86e\\how to decrypt files.txt")) returned 0xffffffff [0137.662] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.messaging\\48a6fe1e314ebf355ec133aa4916e86e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.665] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.666] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\System.Messaging.ni.dll") returned="System.Messaging.ni.dll" [0137.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\" [0137.666] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\") returned="" [0137.666] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\HOW TO DECRYPT FILES.txt" [0137.666] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.messaging\\48a6fe1e314ebf355ec133aa4916e86e\\how to decrypt files.txt")) returned 0x20 [0137.666] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\", lpString2="System.Messaging.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\System.Messaging.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\48a6fe1e314ebf355ec133aa4916e86e\\System.Messaging.ni.dll.aux" [0137.666] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.666] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Net.Http" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http" [0137.667] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\*.*") returned="*.*" [0137.667] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\", lpString2="d9673165e138070d27961581a90e5e1b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b" [0137.667] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.667] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\*.*") returned="*.*" [0137.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\" [0137.668] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\") returned="" [0137.668] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\HOW TO DECRYPT FILES.txt" [0137.668] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.net.http\\d9673165e138070d27961581a90e5e1b\\how to decrypt files.txt")) returned 0xffffffff [0137.668] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.net.http\\d9673165e138070d27961581a90e5e1b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.671] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.671] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\System.Net.Http.ni.dll") returned="System.Net.Http.ni.dll" [0137.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\" [0137.671] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\") returned="" [0137.671] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\HOW TO DECRYPT FILES.txt" [0137.672] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.net.http\\d9673165e138070d27961581a90e5e1b\\how to decrypt files.txt")) returned 0x20 [0137.672] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\", lpString2="System.Net.Http.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\System.Net.Http.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\d9673165e138070d27961581a90e5e1b\\System.Net.Http.ni.dll.aux" [0137.672] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.672] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Numerics" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics" [0137.672] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\*.*") returned="*.*" [0137.672] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\", lpString2="c80b3db2c630200239b5e853aa6913cf" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf" [0137.672] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.672] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\*.*") returned="*.*" [0137.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\" [0137.672] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\") returned="" [0137.672] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\HOW TO DECRYPT FILES.txt" [0137.672] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.numerics\\c80b3db2c630200239b5e853aa6913cf\\how to decrypt files.txt")) returned 0xffffffff [0137.673] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.numerics\\c80b3db2c630200239b5e853aa6913cf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.676] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.676] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\System.Numerics.ni.dll") returned="System.Numerics.ni.dll" [0137.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\" [0137.676] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\") returned="" [0137.676] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\HOW TO DECRYPT FILES.txt" [0137.676] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.numerics\\c80b3db2c630200239b5e853aa6913cf\\how to decrypt files.txt")) returned 0x20 [0137.677] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\", lpString2="System.Numerics.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\System.Numerics.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\c80b3db2c630200239b5e853aa6913cf\\System.Numerics.ni.dll.aux" [0137.677] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.677] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runt0d283adf#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#" [0137.677] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\*.*") returned="*.*" [0137.677] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\", lpString2="c9cc3601e45a8e99ff0fdbecf72d932b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b" [0137.679] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.679] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\*.*") returned="*.*" [0137.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\" [0137.679] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\") returned="" [0137.679] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\HOW TO DECRYPT FILES.txt" [0137.679] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\how to decrypt files.txt")) returned 0xffffffff [0137.680] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.681] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.682] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\System.Runtime.WindowsRuntime.ni.dll") returned="System.Runtime.WindowsRuntime.ni.dll" [0137.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\" [0137.682] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\") returned="" [0137.682] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\HOW TO DECRYPT FILES.txt" [0137.682] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\how to decrypt files.txt")) returned 0x20 [0137.682] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\", lpString2="System.Runtime.WindowsRuntime.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\System.Runtime.WindowsRuntime.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt0d283adf#\\c9cc3601e45a8e99ff0fdbecf72d932b\\System.Runtime.WindowsRuntime.ni.dll.aux" [0137.682] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.682] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runt19c51595#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#" [0137.683] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\*.*") returned="*.*" [0137.683] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\", lpString2="c6388f1431a60b250e22a55f6cbca766" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766" [0137.685] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.685] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\*.*") returned="*.*" [0137.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\" [0137.685] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\") returned="" [0137.685] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\HOW TO DECRYPT FILES.txt" [0137.685] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\how to decrypt files.txt")) returned 0xffffffff [0137.685] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.687] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.687] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\System.Runtime.Caching.ni.dll") returned="System.Runtime.Caching.ni.dll" [0137.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\" [0137.687] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\") returned="" [0137.687] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\HOW TO DECRYPT FILES.txt" [0137.687] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\how to decrypt files.txt")) returned 0x20 [0137.688] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\", lpString2="System.Runtime.Caching.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\System.Runtime.Caching.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\c6388f1431a60b250e22a55f6cbca766\\System.Runtime.Caching.ni.dll.aux" [0137.688] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.688] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runt73a1fc9d#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#" [0137.688] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\*.*") returned="*.*" [0137.688] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\", lpString2="9064a8e423fba29fcba81dd7e15f0ff9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9" [0137.690] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.690] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\*.*") returned="*.*" [0137.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\" [0137.690] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\") returned="" [0137.690] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\HOW TO DECRYPT FILES.txt" [0137.690] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\how to decrypt files.txt")) returned 0xffffffff [0137.691] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.692] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.692] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\System.Runtime.Remoting.ni.dll") returned="System.Runtime.Remoting.ni.dll" [0137.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\" [0137.692] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\") returned="" [0137.692] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\HOW TO DECRYPT FILES.txt" [0137.693] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\how to decrypt files.txt")) returned 0x20 [0137.693] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\", lpString2="System.Runtime.Remoting.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\System.Runtime.Remoting.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9064a8e423fba29fcba81dd7e15f0ff9\\System.Runtime.Remoting.ni.dll.aux" [0137.693] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.693] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runt9064068c#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#" [0137.693] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\*.*") returned="*.*" [0137.694] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\", lpString2="245ac460e7769f8114c7219cdf08d917" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917" [0137.715] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.715] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\*.*") returned="*.*" [0137.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\" [0137.715] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\") returned="" [0137.715] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\HOW TO DECRYPT FILES.txt" [0137.715] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\how to decrypt files.txt")) returned 0xffffffff [0137.715] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.718] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.718] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\System.Runtime.Serialization.Formatters.Soap.ni.dll") returned="System.Runtime.Serialization.Formatters.Soap.ni.dll" [0137.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\" [0137.719] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\") returned="" [0137.719] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\HOW TO DECRYPT FILES.txt" [0137.719] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\how to decrypt files.txt")) returned 0x20 [0137.719] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\245ac460e7769f8114c7219cdf08d917\\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux" [0137.719] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.719] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runt93d54979#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#" [0137.729] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\*.*") returned="*.*" [0137.729] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\", lpString2="82d3091365564c5129a0240f722927bf" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf" [0137.731] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.731] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\*.*") returned="*.*" [0137.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\" [0137.731] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\") returned="" [0137.731] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\HOW TO DECRYPT FILES.txt" [0137.731] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt93d54979#\\82d3091365564c5129a0240f722927bf\\how to decrypt files.txt")) returned 0xffffffff [0137.732] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt93d54979#\\82d3091365564c5129a0240f722927bf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.734] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.734] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\System.Runtime.DurableInstancing.ni.dll") returned="System.Runtime.DurableInstancing.ni.dll" [0137.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\" [0137.734] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\") returned="" [0137.734] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\HOW TO DECRYPT FILES.txt" [0137.734] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt93d54979#\\82d3091365564c5129a0240f722927bf\\how to decrypt files.txt")) returned 0x20 [0137.734] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\", lpString2="System.Runtime.DurableInstancing.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\System.Runtime.DurableInstancing.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\82d3091365564c5129a0240f722927bf\\System.Runtime.DurableInstancing.ni.dll.aux" [0137.734] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.734] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runtc259d85b#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#" [0137.734] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\*.*") returned="*.*" [0137.735] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\", lpString2="7361a97ed5d8c874cbfff4feeef8894a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a" [0137.737] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.737] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\*.*") returned="*.*" [0137.737] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\" [0137.737] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\") returned="" [0137.737] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\HOW TO DECRYPT FILES.txt" [0137.737] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\how to decrypt files.txt")) returned 0xffffffff [0137.737] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.739] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.739] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\System.Runtime.WindowsRuntime.UI.Xaml.ni.dll") returned="System.Runtime.WindowsRuntime.UI.Xaml.ni.dll" [0137.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\" [0137.739] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\") returned="" [0137.739] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\HOW TO DECRYPT FILES.txt" [0137.739] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\how to decrypt files.txt")) returned 0x20 [0137.739] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\", lpString2="System.Runtime.WindowsRuntime.UI.Xaml.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\System.Runtime.WindowsRuntime.UI.Xaml.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtc259d85b#\\7361a97ed5d8c874cbfff4feeef8894a\\System.Runtime.WindowsRuntime.UI.Xaml.ni.dll.aux" [0137.740] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.740] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runteb92aa12#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#" [0137.740] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\*.*") returned="*.*" [0137.740] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\", lpString2="ec5e209a6df1d6dda07dd81dbd7de193" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193" [0137.743] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.743] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\*.*") returned="*.*" [0137.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\" [0137.743] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\") returned="" [0137.743] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\HOW TO DECRYPT FILES.txt" [0137.743] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\how to decrypt files.txt")) returned 0xffffffff [0137.743] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.745] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.745] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\System.Runtime.Serialization.ni.dll") returned="System.Runtime.Serialization.ni.dll" [0137.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\" [0137.745] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\") returned="" [0137.745] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\HOW TO DECRYPT FILES.txt" [0137.745] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\how to decrypt files.txt")) returned 0x20 [0137.745] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\", lpString2="System.Runtime.Serialization.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\System.Runtime.Serialization.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\ec5e209a6df1d6dda07dd81dbd7de193\\System.Runtime.Serialization.ni.dll.aux" [0137.745] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.745] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runtime" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime" [0137.746] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\*.*") returned="*.*" [0137.746] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\", lpString2="2b5bb734fcfaafb2f122ed0e6d5c17ca" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca" [0137.747] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.747] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\*.*") returned="*.*" [0137.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\" [0137.747] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\") returned="" [0137.747] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\HOW TO DECRYPT FILES.txt" [0137.747] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\how to decrypt files.txt")) returned 0xffffffff [0137.747] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.751] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.751] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\System.Runtime.ni.dll") returned="System.Runtime.ni.dll" [0137.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\" [0137.751] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\") returned="" [0137.751] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\HOW TO DECRYPT FILES.txt" [0137.751] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\how to decrypt files.txt")) returned 0x20 [0137.751] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\", lpString2="System.Runtime.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\System.Runtime.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runtime\\2b5bb734fcfaafb2f122ed0e6d5c17ca\\System.Runtime.ni.dll.aux" [0137.751] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.751] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Security" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security" [0137.752] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\*.*") returned="*.*" [0137.752] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\", lpString2="02408be4b9897287421589563925935f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f" [0137.752] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.752] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\*.*") returned="*.*" [0137.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\" [0137.752] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\") returned="" [0137.752] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\HOW TO DECRYPT FILES.txt" [0137.752] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.security\\02408be4b9897287421589563925935f\\how to decrypt files.txt")) returned 0xffffffff [0137.752] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.security\\02408be4b9897287421589563925935f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.755] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.755] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\System.Security.ni.dll") returned="System.Security.ni.dll" [0137.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\" [0137.756] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\") returned="" [0137.756] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\HOW TO DECRYPT FILES.txt" [0137.756] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.security\\02408be4b9897287421589563925935f\\how to decrypt files.txt")) returned 0x20 [0137.756] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\", lpString2="System.Security.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\System.Security.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\02408be4b9897287421589563925935f\\System.Security.ni.dll.aux" [0137.756] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.756] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Serv14259fd9#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#" [0137.757] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\*.*") returned="*.*" [0137.757] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\", lpString2="0c11e6abc335fa97faf176b109a02310" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310" [0137.758] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.758] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\*.*") returned="*.*" [0137.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\" [0137.758] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\") returned="" [0137.758] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\HOW TO DECRYPT FILES.txt" [0137.758] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\how to decrypt files.txt")) returned 0xffffffff [0137.758] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.760] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.760] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\System.ServiceModel.Activities.ni.dll") returned="System.ServiceModel.Activities.ni.dll" [0137.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\" [0137.760] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\") returned="" [0137.760] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\HOW TO DECRYPT FILES.txt" [0137.760] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\how to decrypt files.txt")) returned 0x20 [0137.760] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\", lpString2="System.ServiceModel.Activities.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\System.ServiceModel.Activities.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\0c11e6abc335fa97faf176b109a02310\\System.ServiceModel.Activities.ni.dll.aux" [0137.760] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.760] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Serv14b62006#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#" [0137.761] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\*.*") returned="*.*" [0137.761] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\", lpString2="6c6233af15b8ecf4b70be131fd3a8068" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068" [0137.766] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.766] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\*.*") returned="*.*" [0137.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\" [0137.766] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\") returned="" [0137.766] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\HOW TO DECRYPT FILES.txt" [0137.766] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\how to decrypt files.txt")) returned 0xffffffff [0137.766] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.770] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.771] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\System.ServiceModel.Activation.ni.dll") returned="System.ServiceModel.Activation.ni.dll" [0137.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\" [0137.771] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\") returned="" [0137.771] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\HOW TO DECRYPT FILES.txt" [0137.771] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\how to decrypt files.txt")) returned 0x20 [0137.771] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\", lpString2="System.ServiceModel.Activation.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\System.ServiceModel.Activation.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\6c6233af15b8ecf4b70be131fd3a8068\\System.ServiceModel.Activation.ni.dll.aux" [0137.771] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.771] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Serv759bfb78#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#" [0137.771] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\*.*") returned="*.*" [0137.771] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\", lpString2="5677254fb7b3452b2aaca6e7b269927e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e" [0137.797] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.797] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\*.*") returned="*.*" [0137.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\" [0137.797] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\") returned="" [0137.798] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\HOW TO DECRYPT FILES.txt" [0137.798] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\how to decrypt files.txt")) returned 0xffffffff [0137.798] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.800] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.800] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\System.ServiceProcess.ni.dll") returned="System.ServiceProcess.ni.dll" [0137.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\" [0137.800] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\") returned="" [0137.800] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\HOW TO DECRYPT FILES.txt" [0137.801] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\how to decrypt files.txt")) returned 0x20 [0137.801] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\", lpString2="System.ServiceProcess.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\System.ServiceProcess.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\5677254fb7b3452b2aaca6e7b269927e\\System.ServiceProcess.ni.dll.aux" [0137.801] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.801] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Servd1dec626#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#" [0137.802] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\*.*") returned="*.*" [0137.802] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\", lpString2="e2a38bcd9c537c89f652aa52dac6a1ae" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae" [0137.804] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.804] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\*.*") returned="*.*" [0137.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\" [0137.804] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\") returned="" [0137.804] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\HOW TO DECRYPT FILES.txt" [0137.804] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\how to decrypt files.txt")) returned 0xffffffff [0137.804] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.806] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.806] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\System.ServiceModel.Internals.ni.dll") returned="System.ServiceModel.Internals.ni.dll" [0137.806] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\" [0137.807] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\") returned="" [0137.807] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\HOW TO DECRYPT FILES.txt" [0137.807] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\how to decrypt files.txt")) returned 0x20 [0137.807] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\", lpString2="System.ServiceModel.Internals.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\System.ServiceModel.Internals.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\e2a38bcd9c537c89f652aa52dac6a1ae\\System.ServiceModel.Internals.ni.dll.aux" [0137.807] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.807] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.ServiceModel" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel" [0137.808] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\*.*") returned="*.*" [0137.808] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\", lpString2="ca3ce66e1fa72f936b6849ada805fafa" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa" [0137.808] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.808] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\*.*") returned="*.*" [0137.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\" [0137.808] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\") returned="" [0137.808] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\HOW TO DECRYPT FILES.txt" [0137.808] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servicemodel\\ca3ce66e1fa72f936b6849ada805fafa\\how to decrypt files.txt")) returned 0xffffffff [0137.808] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servicemodel\\ca3ce66e1fa72f936b6849ada805fafa\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.812] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.812] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\System.ServiceModel.ni.dll") returned="System.ServiceModel.ni.dll" [0137.812] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\" [0137.812] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\") returned="" [0137.812] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\HOW TO DECRYPT FILES.txt" [0137.812] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servicemodel\\ca3ce66e1fa72f936b6849ada805fafa\\how to decrypt files.txt")) returned 0x20 [0137.812] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\", lpString2="System.ServiceModel.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\System.ServiceModel.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\ca3ce66e1fa72f936b6849ada805fafa\\System.ServiceModel.ni.dll.aux" [0137.812] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.812] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Transactions" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions" [0137.812] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\*.*") returned="*.*" [0137.812] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\", lpString2="4b6f97d7763c99c66c7847b4bf7e65be" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be" [0137.813] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.813] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\*.*") returned="*.*" [0137.813] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\" [0137.813] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\") returned="" [0137.813] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\HOW TO DECRYPT FILES.txt" [0137.813] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\how to decrypt files.txt")) returned 0xffffffff [0137.813] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.816] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.816] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\System.Transactions.ni.dll") returned="System.Transactions.ni.dll" [0137.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\" [0137.816] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\") returned="" [0137.816] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\HOW TO DECRYPT FILES.txt" [0137.816] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\how to decrypt files.txt")) returned 0x20 [0137.816] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\", lpString2="System.Transactions.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\System.Transactions.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\4b6f97d7763c99c66c7847b4bf7e65be\\System.Transactions.ni.dll.aux" [0137.817] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.817] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web" [0137.817] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\*.*") returned="*.*" [0137.817] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\", lpString2="05387ba47ebb9d0793765a558ca58058" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058" [0137.818] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.818] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\*.*") returned="*.*" [0137.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\" [0137.818] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\") returned="" [0137.818] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\HOW TO DECRYPT FILES.txt" [0137.818] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web\\05387ba47ebb9d0793765a558ca58058\\how to decrypt files.txt")) returned 0xffffffff [0137.818] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web\\05387ba47ebb9d0793765a558ca58058\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.821] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.822] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\System.Web.ni.dll") returned="System.Web.ni.dll" [0137.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\" [0137.822] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\") returned="" [0137.822] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\HOW TO DECRYPT FILES.txt" [0137.822] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web\\05387ba47ebb9d0793765a558ca58058\\how to decrypt files.txt")) returned 0x20 [0137.822] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\", lpString2="System.Web.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\System.Web.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\05387ba47ebb9d0793765a558ca58058\\System.Web.ni.dll.aux" [0137.822] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0137.822] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.28b9ef5a#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#" [0137.823] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\*.*") returned="*.*" [0137.823] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\", lpString2="daef46db05fdfd879471e55b7b9d9049" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049" [0137.825] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.825] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\") returned="" [0137.825] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\HOW TO DECRYPT FILES.txt" [0137.825] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\how to decrypt files.txt")) returned 0xffffffff [0137.825] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.827] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.827] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\") returned="" [0137.827] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\HOW TO DECRYPT FILES.txt" [0137.827] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\how to decrypt files.txt")) returned 0x20 [0137.827] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\", lpString2="System.Web.Extensions.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\System.Web.Extensions.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\daef46db05fdfd879471e55b7b9d9049\\System.Web.Extensions.ni.dll.aux" [0137.831] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.831] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\") returned="" [0137.831] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\HOW TO DECRYPT FILES.txt" [0137.831] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\how to decrypt files.txt")) returned 0xffffffff [0137.832] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.833] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.833] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\") returned="" [0137.833] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\HOW TO DECRYPT FILES.txt" [0137.834] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\how to decrypt files.txt")) returned 0x20 [0137.834] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\", lpString2="System.Web.RegularExpressions.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\System.Web.RegularExpressions.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\f96968b3d7f737267f9a461529b928b7\\System.Web.RegularExpressions.ni.dll.aux" [0137.850] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.850] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\") returned="" [0137.850] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\HOW TO DECRYPT FILES.txt" [0137.850] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\how to decrypt files.txt")) returned 0xffffffff [0137.850] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.852] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.852] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\") returned="" [0137.852] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\HOW TO DECRYPT FILES.txt" [0137.853] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\how to decrypt files.txt")) returned 0x20 [0137.853] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\", lpString2="System.Web.ApplicationServices.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\System.Web.ApplicationServices.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\7dec37845eff5ff168f840a0273ed369\\System.Web.ApplicationServices.ni.dll.aux" [0137.854] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.854] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\") returned="" [0137.854] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\HOW TO DECRYPT FILES.txt" [0137.854] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.services\\b2c1389c03bfa264524ee1d0b259cb84\\how to decrypt files.txt")) returned 0xffffffff [0137.854] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.services\\b2c1389c03bfa264524ee1d0b259cb84\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.859] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.859] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\") returned="" [0137.859] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\HOW TO DECRYPT FILES.txt" [0137.859] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.services\\b2c1389c03bfa264524ee1d0b259cb84\\how to decrypt files.txt")) returned 0x20 [0137.859] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\", lpString2="System.Web.Services.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\System.Web.Services.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\b2c1389c03bfa264524ee1d0b259cb84\\System.Web.Services.ni.dll.aux" [0137.860] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.860] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\") returned="" [0137.860] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\HOW TO DECRYPT FILES.txt" [0137.860] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\233fe621c3116f082f851238b5735555\\how to decrypt files.txt")) returned 0xffffffff [0137.860] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\233fe621c3116f082f851238b5735555\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.863] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.863] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\") returned="" [0137.863] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\HOW TO DECRYPT FILES.txt" [0137.863] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\233fe621c3116f082f851238b5735555\\how to decrypt files.txt")) returned 0x20 [0137.863] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\", lpString2="System.Windows.Forms.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\System.Windows.Forms.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\233fe621c3116f082f851238b5735555\\System.Windows.Forms.ni.dll.aux" [0137.865] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.865] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\") returned="" [0137.865] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\HOW TO DECRYPT FILES.txt" [0137.865] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\how to decrypt files.txt")) returned 0xffffffff [0137.865] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.868] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.868] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\") returned="" [0137.868] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\HOW TO DECRYPT FILES.txt" [0137.868] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\how to decrypt files.txt")) returned 0x20 [0137.869] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\", lpString2="System.Xaml.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\System.Xaml.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\84f5eae683be3e8c5e9b99c4f0bdb637\\System.Xaml.ni.dll.aux" [0137.869] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.869] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\") returned="" [0137.869] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\HOW TO DECRYPT FILES.txt" [0137.869] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xaml.hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\how to decrypt files.txt")) returned 0xffffffff [0137.870] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xaml.hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.875] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.875] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\") returned="" [0137.876] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\HOW TO DECRYPT FILES.txt" [0137.876] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xaml.hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\how to decrypt files.txt")) returned 0x20 [0137.876] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\", lpString2="System.Xaml.Hosting.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\System.Xaml.Hosting.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\39d1e9405a4cec62f9ec7a5ba314fd94\\System.Xaml.Hosting.ni.dll.aux" [0137.876] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.876] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\") returned="" [0137.876] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\HOW TO DECRYPT FILES.txt" [0137.876] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\ab2c1a1a863747d54686a793011e677b\\how to decrypt files.txt")) returned 0xffffffff [0137.876] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\ab2c1a1a863747d54686a793011e677b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.880] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.880] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\") returned="" [0137.880] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\HOW TO DECRYPT FILES.txt" [0137.880] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\ab2c1a1a863747d54686a793011e677b\\how to decrypt files.txt")) returned 0x20 [0137.880] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\", lpString2="System.Xml.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\System.Xml.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\ab2c1a1a863747d54686a793011e677b\\System.Xml.ni.dll.aux" [0137.881] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.881] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\") returned="" [0137.881] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\HOW TO DECRYPT FILES.txt" [0137.881] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml.linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\how to decrypt files.txt")) returned 0xffffffff [0137.881] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml.linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.884] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.884] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\") returned="" [0137.884] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\HOW TO DECRYPT FILES.txt" [0137.884] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml.linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\how to decrypt files.txt")) returned 0x20 [0137.885] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\", lpString2="System.Xml.Linq.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\System.Xml.Linq.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\50584d3c03fcf17b3f3cdfb4b38b8b11\\System.Xml.Linq.ni.dll.aux" [0137.885] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.885] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\") returned="" [0137.885] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\HOW TO DECRYPT FILES.txt" [0137.885] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\taskscheduler\\465470a3673b07d6cef9635e8e7b6f4b\\how to decrypt files.txt")) returned 0xffffffff [0137.885] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\taskscheduler\\465470a3673b07d6cef9635e8e7b6f4b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.923] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.923] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\") returned="" [0137.923] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\HOW TO DECRYPT FILES.txt" [0137.923] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\taskscheduler\\465470a3673b07d6cef9635e8e7b6f4b\\how to decrypt files.txt")) returned 0x20 [0137.923] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\", lpString2="TaskScheduler.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\TaskScheduler.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\TaskScheduler\\465470a3673b07d6cef9635e8e7b6f4b\\TaskScheduler.ni.dll.aux" [0137.931] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.931] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\") returned="" [0137.931] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\HOW TO DECRYPT FILES.txt" [0137.931] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windows.app640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\how to decrypt files.txt")) returned 0xffffffff [0137.931] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windows.app640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.934] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.934] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\") returned="" [0137.934] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\HOW TO DECRYPT FILES.txt" [0137.934] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windows.app640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\how to decrypt files.txt")) returned 0x20 [0137.934] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\", lpString2="Windows.ApplicationModel.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\Windows.ApplicationModel.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.App640a3541#\\90cd8fb3f1ec0384ccb474da0825c0b8\\Windows.ApplicationModel.ni.dll.aux" [0137.935] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.935] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\") returned="" [0137.935] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\HOW TO DECRYPT FILES.txt" [0137.935] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windows.foundation\\085d600c9b46044fdf1ed47b30c52cce\\how to decrypt files.txt")) returned 0xffffffff [0137.936] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windows.foundation\\085d600c9b46044fdf1ed47b30c52cce\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.939] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.939] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\") returned="" [0137.939] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\HOW TO DECRYPT FILES.txt" [0137.939] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windows.foundation\\085d600c9b46044fdf1ed47b30c52cce\\how to decrypt files.txt")) returned 0x20 [0137.939] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\", lpString2="Windows.Foundation.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\Windows.Foundation.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Foundation\\085d600c9b46044fdf1ed47b30c52cce\\Windows.Foundation.ni.dll.aux" [0137.940] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.940] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\") returned="" [0137.940] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\HOW TO DECRYPT FILES.txt" [0137.940] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windows.management\\ea4628d31f00713ba555fcb87b85e973\\how to decrypt files.txt")) returned 0xffffffff [0137.940] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windows.management\\ea4628d31f00713ba555fcb87b85e973\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.943] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.943] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\") returned="" [0137.943] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\HOW TO DECRYPT FILES.txt" [0137.943] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windows.management\\ea4628d31f00713ba555fcb87b85e973\\how to decrypt files.txt")) returned 0x20 [0137.943] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\", lpString2="Windows.Management.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\Windows.Management.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.Management\\ea4628d31f00713ba555fcb87b85e973\\Windows.Management.ni.dll.aux" [0137.944] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.944] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\") returned="" [0137.944] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\HOW TO DECRYPT FILES.txt" [0137.944] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windows.system\\4895ae5b57c4104220b341492a989cb7\\how to decrypt files.txt")) returned 0xffffffff [0137.944] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windows.system\\4895ae5b57c4104220b341492a989cb7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.947] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.947] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\") returned="" [0137.947] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\HOW TO DECRYPT FILES.txt" [0137.947] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windows.system\\4895ae5b57c4104220b341492a989cb7\\how to decrypt files.txt")) returned 0x20 [0137.947] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\", lpString2="Windows.System.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\Windows.System.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Windows.System\\4895ae5b57c4104220b341492a989cb7\\Windows.System.ni.dll.aux" [0137.948] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.948] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\") returned="" [0137.948] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\HOW TO DECRYPT FILES.txt" [0137.948] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windowsbase\\44cd50bccb122e084b7156a0caf91d11\\how to decrypt files.txt")) returned 0xffffffff [0137.948] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windowsbase\\44cd50bccb122e084b7156a0caf91d11\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.952] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0137.952] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\") returned="" [0137.952] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\HOW TO DECRYPT FILES.txt" [0137.952] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windowsbase\\44cd50bccb122e084b7156a0caf91d11\\how to decrypt files.txt")) returned 0x20 [0137.953] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\", lpString2="WindowsBase.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\WindowsBase.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\44cd50bccb122e084b7156a0caf91d11\\WindowsBase.ni.dll.aux" [0137.953] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.953] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\" | out: pszPath="C:\\Windows\\assembly\\") returned="" [0137.953] lstrcatA (in: lpString1="C:\\Windows\\assembly\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt" [0137.953] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\how to decrypt files.txt")) returned 0xffffffff [0137.953] CreateFileA (lpFileName="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0137.955] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.955] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\" | out: pszPath="C:\\Windows\\assembly\\") returned="" [0137.955] lstrcatA (in: lpString1="C:\\Windows\\assembly\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt" [0137.955] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\how to decrypt files.txt")) returned 0x20 [0137.955] lstrcatA (in: lpString1="C:\\Windows\\assembly\\", lpString2="pubpol120.dat" | out: lpString1="C:\\Windows\\assembly\\pubpol120.dat") returned="C:\\Windows\\assembly\\pubpol120.dat" [0137.956] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.956] PathAddBackslashA (in: pszPath="C:\\Windows\\bcastdvr\\" | out: pszPath="C:\\Windows\\bcastdvr\\") returned="" [0137.957] lstrcatA (in: lpString1="C:\\Windows\\bcastdvr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\bcastdvr\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\bcastdvr\\HOW TO DECRYPT FILES.txt" [0137.957] GetFileAttributesA (lpFileName="C:\\Windows\\bcastdvr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\bcastdvr\\how to decrypt files.txt")) returned 0xffffffff [0137.957] CreateFileA (lpFileName="C:\\Windows\\bcastdvr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\bcastdvr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0137.958] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.958] PathAddBackslashA (in: pszPath="C:\\Windows\\bcastdvr\\" | out: pszPath="C:\\Windows\\bcastdvr\\") returned="" [0137.958] lstrcatA (in: lpString1="C:\\Windows\\bcastdvr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\bcastdvr\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\bcastdvr\\HOW TO DECRYPT FILES.txt" [0137.958] GetFileAttributesA (lpFileName="C:\\Windows\\bcastdvr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\bcastdvr\\how to decrypt files.txt")) returned 0x20 [0137.959] lstrcatA (in: lpString1="C:\\Windows\\bcastdvr\\", lpString2="KnownGameList.bin" | out: lpString1="C:\\Windows\\bcastdvr\\KnownGameList.bin") returned="C:\\Windows\\bcastdvr\\KnownGameList.bin" [0137.959] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0137.959] PathAddBackslashA (in: pszPath="C:\\Windows\\" | out: pszPath="C:\\Windows\\") returned="" [0137.959] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\HOW TO DECRYPT FILES.txt" [0137.959] GetFileAttributesA (lpFileName="C:\\Windows\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\how to decrypt files.txt")) returned 0xffffffff [0137.959] CreateFileA (lpFileName="C:\\Windows\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0137.977] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.977] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0137.977] lstrcatA (in: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" [0137.977] GetFileAttributesA (lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\how to decrypt files.txt")) returned 0xffffffff [0137.977] CreateFileA (lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0137.979] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.979] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0137.979] lstrcatA (in: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" [0137.979] GetFileAttributesA (lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\how to decrypt files.txt")) returned 0x20 [0137.979] lstrcatA (in: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\", lpString2="autorun.inf" | out: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\autorun.inf") returned="C:\\Windows\\BitLockerDiscoveryVolumeContents\\autorun.inf" [0137.980] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.980] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0137.980] lstrcatA (in: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" [0137.980] GetFileAttributesA (lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\how to decrypt files.txt")) returned 0x20 [0137.980] lstrcatA (in: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\", lpString2="bg-BG_BitLockerToGo.exe.mui" | out: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\bg-BG_BitLockerToGo.exe.mui") returned="C:\\Windows\\BitLockerDiscoveryVolumeContents\\bg-BG_BitLockerToGo.exe.mui" [0137.980] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.980] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0137.980] lstrcatA (in: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" [0137.980] GetFileAttributesA (lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\how to decrypt files.txt")) returned 0x20 [0137.981] lstrcatA (in: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\", lpString2="BitLockerToGo.exe" | out: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\BitLockerToGo.exe") returned="C:\\Windows\\BitLockerDiscoveryVolumeContents\\BitLockerToGo.exe" [0137.981] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.981] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0137.981] lstrcatA (in: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" [0137.981] GetFileAttributesA (lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\how to decrypt files.txt")) returned 0x20 [0137.981] lstrcatA (in: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\", lpString2="cs-CZ_BitLockerToGo.exe.mui" | out: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\cs-CZ_BitLockerToGo.exe.mui") returned="C:\\Windows\\BitLockerDiscoveryVolumeContents\\cs-CZ_BitLockerToGo.exe.mui" [0137.981] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.981] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0137.981] lstrcatA (in: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" [0137.981] GetFileAttributesA (lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\how to decrypt files.txt")) returned 0x20 [0137.981] lstrcatA (in: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\", lpString2="da-DK_BitLockerToGo.exe.mui" | out: lpString1="C:\\Windows\\BitLockerDiscoveryVolumeContents\\da-DK_BitLockerToGo.exe.mui") returned="C:\\Windows\\BitLockerDiscoveryVolumeContents\\da-DK_BitLockerToGo.exe.mui" [0137.981] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.981] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0137.982] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.982] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0137.982] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.982] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0137.982] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.982] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0137.982] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.982] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0137.982] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0137.982] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0137.982] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.033] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.033] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.033] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.034] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.034] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.034] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.034] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.034] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.034] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.034] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.034] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.034] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.034] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.034] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.034] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.035] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.035] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.035] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.035] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.035] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.035] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.035] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.035] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.035] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.035] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.035] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.035] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.036] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.036] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.036] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.036] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.036] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.036] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.036] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.036] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.036] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.036] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.036] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.036] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.037] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.037] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.037] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.037] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.037] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.037] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.037] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.037] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.037] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.037] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.037] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.037] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.038] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.038] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.038] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.038] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.038] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.038] PathAddBackslashA (in: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\" | out: pszPath="C:\\Windows\\BitLockerDiscoveryVolumeContents\\") returned="" [0138.040] PeekMessageA (in: lpMsg=0x19fb6c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fb6c) returned 0 [0138.040] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\" | out: pszPath="C:\\Windows\\Boot\\") returned="" [0138.042] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.042] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\") returned="" [0138.042] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.042] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\") returned="" [0138.043] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0138.043] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\") returned="" [0138.044] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0138.044] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\") returned="" [0138.044] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.044] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\") returned="" [0138.044] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.044] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\") returned="" [0138.045] PeekMessageA (in: lpMsg=0x19f77c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f77c) returned 0 [0138.045] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\") returned="" [0138.045] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.045] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\") returned="" [0138.048] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.048] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\bg-BG\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\bg-BG\\") returned="" [0138.048] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.048] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\bg-BG\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\bg-BG\\") returned="" [0138.048] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.049] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\") returned="" [0138.049] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.049] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\") returned="" [0138.049] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.049] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\") returned="" [0138.049] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.049] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\") returned="" [0138.049] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.049] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\cs-CZ\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\cs-CZ\\") returned="" [0138.050] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.050] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\cs-CZ\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\cs-CZ\\") returned="" [0138.050] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.050] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\cs-CZ\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\cs-CZ\\") returned="" [0138.050] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.050] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\da-DK\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\da-DK\\") returned="" [0138.050] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.051] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\da-DK\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\da-DK\\") returned="" [0138.051] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.051] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\da-DK\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\da-DK\\") returned="" [0138.051] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.051] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\de-DE\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\de-DE\\") returned="" [0138.052] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.052] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\de-DE\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\de-DE\\") returned="" [0138.052] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.052] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\de-DE\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\de-DE\\") returned="" [0138.052] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.052] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\el-GR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\el-GR\\") returned="" [0138.053] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.053] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\el-GR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\el-GR\\") returned="" [0138.053] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.053] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\el-GR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\el-GR\\") returned="" [0138.053] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.053] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\en-GB\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\en-GB\\") returned="" [0138.053] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.053] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\en-GB\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\en-GB\\") returned="" [0138.054] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.054] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\en-US\\") returned="" [0138.054] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.054] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\en-US\\") returned="" [0138.054] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.054] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\en-US\\") returned="" [0138.055] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.055] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\es-ES\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\es-ES\\") returned="" [0138.055] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.055] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\es-ES\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\es-ES\\") returned="" [0138.056] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.056] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\es-ES\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\es-ES\\") returned="" [0138.056] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.056] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\es-MX\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\es-MX\\") returned="" [0138.056] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.056] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\es-MX\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\es-MX\\") returned="" [0138.056] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.056] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\et-EE\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\et-EE\\") returned="" [0138.057] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.057] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\et-EE\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\et-EE\\") returned="" [0138.057] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.057] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\fi-FI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\fi-FI\\") returned="" [0138.057] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.057] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\fi-FI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\fi-FI\\") returned="" [0138.058] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.058] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\fi-FI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\fi-FI\\") returned="" [0138.070] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.070] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\fr-CA\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\fr-CA\\") returned="" [0138.071] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.071] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\fr-CA\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\fr-CA\\") returned="" [0138.071] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.071] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\fr-FR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\fr-FR\\") returned="" [0138.071] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.071] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\fr-FR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\fr-FR\\") returned="" [0138.071] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.071] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\fr-FR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\fr-FR\\") returned="" [0138.072] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.072] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\hr-HR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\hr-HR\\") returned="" [0138.072] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.072] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\hr-HR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\hr-HR\\") returned="" [0138.072] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.072] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\hu-HU\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\hu-HU\\") returned="" [0138.073] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.073] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\hu-HU\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\hu-HU\\") returned="" [0138.073] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.073] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\hu-HU\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\hu-HU\\") returned="" [0138.074] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.074] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\it-IT\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\it-IT\\") returned="" [0138.074] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.074] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\it-IT\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\it-IT\\") returned="" [0138.075] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.075] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\it-IT\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\it-IT\\") returned="" [0138.075] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.075] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ja-JP\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ja-JP\\") returned="" [0138.075] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.075] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ja-JP\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ja-JP\\") returned="" [0138.075] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.075] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ja-JP\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ja-JP\\") returned="" [0138.076] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.076] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ko-KR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ko-KR\\") returned="" [0138.076] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.076] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ko-KR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ko-KR\\") returned="" [0138.076] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.076] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ko-KR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ko-KR\\") returned="" [0138.077] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.077] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\lt-LT\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\lt-LT\\") returned="" [0138.077] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.077] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\lt-LT\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\lt-LT\\") returned="" [0138.078] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.078] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\lv-LV\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\lv-LV\\") returned="" [0138.078] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.078] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\lv-LV\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\lv-LV\\") returned="" [0138.078] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.078] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\") returned="" [0138.078] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.078] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\nb-NO\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\nb-NO\\") returned="" [0138.079] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.079] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\nb-NO\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\nb-NO\\") returned="" [0138.079] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.079] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\nb-NO\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\nb-NO\\") returned="" [0138.079] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.079] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\nl-NL\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\nl-NL\\") returned="" [0138.080] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.080] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\nl-NL\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\nl-NL\\") returned="" [0138.080] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.156] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\nl-NL\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\nl-NL\\") returned="" [0138.157] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.157] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pl-PL\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pl-PL\\") returned="" [0138.157] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.157] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pl-PL\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pl-PL\\") returned="" [0138.157] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.157] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pl-PL\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pl-PL\\") returned="" [0138.158] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.158] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pt-BR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pt-BR\\") returned="" [0138.158] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.158] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pt-BR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pt-BR\\") returned="" [0138.158] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.159] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pt-BR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pt-BR\\") returned="" [0138.159] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.159] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pt-PT\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pt-PT\\") returned="" [0138.159] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.159] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pt-PT\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pt-PT\\") returned="" [0138.159] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.159] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pt-PT\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pt-PT\\") returned="" [0138.160] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.160] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\qps-ploc\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\qps-ploc\\") returned="" [0138.160] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.160] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ro-RO\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ro-RO\\") returned="" [0138.160] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.160] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ro-RO\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ro-RO\\") returned="" [0138.161] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.161] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ru-RU\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ru-RU\\") returned="" [0138.162] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.162] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ru-RU\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ru-RU\\") returned="" [0138.162] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.162] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ru-RU\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ru-RU\\") returned="" [0138.162] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.162] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\sk-SK\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\sk-SK\\") returned="" [0138.163] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.163] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\sk-SK\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\sk-SK\\") returned="" [0138.163] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.163] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\sl-SI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\sl-SI\\") returned="" [0138.163] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.163] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\sl-SI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\sl-SI\\") returned="" [0138.164] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.164] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\sr-Latn-RS\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\sr-Latn-RS\\") returned="" [0138.164] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.164] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\sr-Latn-RS\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\sr-Latn-RS\\") returned="" [0138.166] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.166] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\sv-SE\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\sv-SE\\") returned="" [0138.166] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.166] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\sv-SE\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\sv-SE\\") returned="" [0138.166] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.167] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\sv-SE\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\sv-SE\\") returned="" [0138.167] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.167] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\tr-TR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\tr-TR\\") returned="" [0138.167] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.167] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\tr-TR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\tr-TR\\") returned="" [0138.167] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.167] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\tr-TR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\tr-TR\\") returned="" [0138.168] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.168] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\uk-UA\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\uk-UA\\") returned="" [0138.168] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.169] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\uk-UA\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\uk-UA\\") returned="" [0138.169] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.169] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\") returned="" [0138.169] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.169] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\") returned="" [0138.169] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.169] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\zh-CN\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\zh-CN\\") returned="" [0138.169] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.170] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\zh-CN\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\zh-CN\\") returned="" [0138.170] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.170] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\zh-CN\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\zh-CN\\") returned="" [0138.171] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.171] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\zh-TW\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\zh-TW\\") returned="" [0138.171] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.171] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\zh-TW\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\zh-TW\\") returned="" [0138.171] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.171] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\zh-TW\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\zh-TW\\") returned="" [0138.173] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.173] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.173] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.174] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.174] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.174] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.174] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.174] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.174] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.174] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.174] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.174] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.174] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.174] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.175] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.175] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.175] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.175] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.175] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.175] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.175] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.175] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.175] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.175] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.175] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.175] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.176] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.176] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.176] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.176] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.176] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.176] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0138.179] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.179] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\bg-BG\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\bg-BG\\") returned="" [0138.180] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.180] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\") returned="" [0138.180] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.180] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\") returned="" [0138.180] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.180] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\") returned="" [0138.180] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.180] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\") returned="" [0138.181] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.181] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\cs-CZ\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\cs-CZ\\") returned="" [0138.181] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.181] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\cs-CZ\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\cs-CZ\\") returned="" [0138.181] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.181] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\da-DK\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\da-DK\\") returned="" [0138.182] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.182] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\da-DK\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\da-DK\\") returned="" [0138.182] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.182] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\de-DE\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\de-DE\\") returned="" [0138.182] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.182] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\de-DE\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\de-DE\\") returned="" [0138.182] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.183] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\el-GR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\el-GR\\") returned="" [0138.183] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.183] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\el-GR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\el-GR\\") returned="" [0138.184] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.184] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\en-GB\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\en-GB\\") returned="" [0138.185] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.185] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\en-US\\") returned="" [0138.185] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.185] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\en-US\\") returned="" [0138.185] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.185] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\es-ES\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\es-ES\\") returned="" [0138.186] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.186] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\es-ES\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\es-ES\\") returned="" [0138.186] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.186] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\es-MX\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\es-MX\\") returned="" [0138.187] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.187] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\et-EE\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\et-EE\\") returned="" [0138.187] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.187] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\fi-FI\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\fi-FI\\") returned="" [0138.188] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.188] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\fi-FI\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\fi-FI\\") returned="" [0138.188] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.188] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\fr-CA\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\fr-CA\\") returned="" [0138.188] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.188] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\fr-FR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\fr-FR\\") returned="" [0138.189] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.189] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\fr-FR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\fr-FR\\") returned="" [0138.189] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.189] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\hr-HR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\hr-HR\\") returned="" [0138.190] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.190] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\hu-HU\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\hu-HU\\") returned="" [0138.190] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.190] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\hu-HU\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\hu-HU\\") returned="" [0138.190] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.190] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\it-IT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\it-IT\\") returned="" [0138.191] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.191] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\it-IT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\it-IT\\") returned="" [0138.191] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.191] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\ja-JP\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\ja-JP\\") returned="" [0138.191] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.191] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\ja-JP\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\ja-JP\\") returned="" [0138.192] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.192] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\ko-KR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\ko-KR\\") returned="" [0138.192] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.192] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\ko-KR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\ko-KR\\") returned="" [0138.193] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.193] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\lt-LT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\lt-LT\\") returned="" [0138.193] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.193] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\lv-LV\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\lv-LV\\") returned="" [0138.193] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.193] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\") returned="" [0138.194] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.194] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\nb-NO\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\nb-NO\\") returned="" [0138.194] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.194] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\nb-NO\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\nb-NO\\") returned="" [0138.198] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.198] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\nl-NL\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\nl-NL\\") returned="" [0138.199] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.199] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\nl-NL\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\nl-NL\\") returned="" [0138.202] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.202] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\pl-PL\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\pl-PL\\") returned="" [0138.202] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.202] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\pl-PL\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\pl-PL\\") returned="" [0138.203] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.203] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\pt-BR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\pt-BR\\") returned="" [0138.203] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.203] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\pt-BR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\pt-BR\\") returned="" [0138.203] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.213] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\pt-PT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\pt-PT\\") returned="" [0138.213] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.213] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\pt-PT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\pt-PT\\") returned="" [0138.214] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.221] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\qps-ploc\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\qps-ploc\\") returned="" [0138.221] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.221] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\qps-ploc\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\qps-ploc\\") returned="" [0138.221] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.222] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\ro-RO\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\ro-RO\\") returned="" [0138.222] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.222] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\ru-RU\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\ru-RU\\") returned="" [0138.222] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.222] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\ru-RU\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\ru-RU\\") returned="" [0138.223] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.223] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\sk-SK\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\sk-SK\\") returned="" [0138.224] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.224] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\sl-SI\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\sl-SI\\") returned="" [0138.224] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.224] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\sr-Latn-RS\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\sr-Latn-RS\\") returned="" [0138.225] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.225] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\sv-SE\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\sv-SE\\") returned="" [0138.225] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.225] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\sv-SE\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\sv-SE\\") returned="" [0138.225] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.225] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\tr-TR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\tr-TR\\") returned="" [0138.226] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.226] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\tr-TR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\tr-TR\\") returned="" [0138.226] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.226] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\uk-UA\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\uk-UA\\") returned="" [0138.227] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.227] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\") returned="" [0138.227] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.227] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\zh-CN\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\zh-CN\\") returned="" [0138.227] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.227] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\zh-CN\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\zh-CN\\") returned="" [0138.228] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.228] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\zh-TW\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\zh-TW\\") returned="" [0138.228] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.228] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\zh-TW\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\zh-TW\\") returned="" [0138.228] PeekMessageA (in: lpMsg=0x19fa1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fa1c) returned 0 [0138.228] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Resources\\" | out: pszPath="C:\\Windows\\Boot\\Resources\\") returned="" [0138.229] PeekMessageA (in: lpMsg=0x19f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f8cc) returned 0 [0138.229] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Resources\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\Resources\\en-US\\") returned="" [0138.229] PeekMessageA (in: lpMsg=0x19fcbc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19fcbc) returned 0 [0138.229] PathAddBackslashA (in: pszPath="C:\\Windows\\" | out: pszPath="C:\\Windows\\") returned="" [0151.397] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif.enciphered")) returned 1 [0151.404] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.enciphered")) returned 1 [0151.406] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif.enciphered")) returned 1 [0151.409] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif.enciphered")) returned 1 [0151.412] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.enciphered")) returned 1 [0151.414] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.enciphered")) returned 1 [0151.423] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif.enciphered")) returned 1 [0151.425] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif.enciphered")) returned 1 [0151.426] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.enciphered")) returned 1 [0151.430] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif.enciphered")) returned 1 [0151.433] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg.enciphered")) returned 1 [0151.436] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif.enciphered")) returned 1 [0151.439] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif.enciphered")) returned 1 [0151.443] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif.enciphered")) returned 1 [0151.444] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif.enciphered")) returned 1 [0151.445] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg.enciphered")) returned 1 [0151.446] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.enciphered")) returned 1 [0151.449] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.enciphered")) returned 1 [0151.450] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.enciphered")) returned 1 [0151.453] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.enciphered")) returned 1 [0151.454] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.enciphered")) returned 1 [0151.456] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.enciphered")) returned 1 [0151.459] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif.enciphered")) returned 1 [0151.647] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif.enciphered")) returned 1 [0151.653] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.enciphered")) returned 1 [0151.658] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif.enciphered")) returned 1 [0151.663] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif.enciphered")) returned 1 [0151.667] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.enciphered")) returned 1 [0151.670] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.enciphered")) returned 1 [0151.675] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif.enciphered")) returned 1 [0151.678] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif.enciphered")) returned 1 [0151.680] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.enciphered")) returned 1 [0151.683] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif.enciphered")) returned 1 [0151.688] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.enciphered")) returned 1 [0151.691] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif.enciphered")) returned 1 [0151.695] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif.enciphered")) returned 1 [0151.698] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif.enciphered")) returned 1 [0151.703] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif.enciphered")) returned 1 [0151.705] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.enciphered")) returned 1 [0151.706] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.enciphered")) returned 1 [0151.708] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.enciphered")) returned 1 [0151.709] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.enciphered")) returned 1 [0151.722] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.enciphered")) returned 1 [0151.725] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.enciphered")) returned 1 [0151.727] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.enciphered")) returned 1 [0151.732] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif.enciphered")) returned 1 [0152.337] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif.enciphered")) returned 1 [0152.340] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_sml.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_sml.gif.enciphered")) returned 1 [0152.344] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.enciphered")) returned 1 [0152.345] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif.enciphered")) returned 1 [0152.354] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif.enciphered")) returned 1 [0152.358] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.enciphered")) returned 1 [0152.360] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.enciphered")) returned 1 [0152.363] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif.enciphered")) returned 1 [0152.372] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif.enciphered")) returned 1 [0152.374] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.enciphered")) returned 1 [0152.377] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif.enciphered")) returned 1 [0152.380] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg.enciphered")) returned 1 [0152.384] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif.enciphered")) returned 1 [0152.387] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif.enciphered")) returned 1 [0152.390] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif.enciphered")) returned 1 [0152.393] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif.enciphered")) returned 1 [0152.397] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg.enciphered")) returned 1 [0152.398] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.enciphered")) returned 1 [0152.400] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.enciphered")) returned 1 [0152.401] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.enciphered")) returned 1 [0152.409] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.enciphered")) returned 1 [0152.410] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.enciphered")) returned 1 [0152.412] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.enciphered")) returned 1 [0152.416] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif.enciphered")) returned 1 [0153.354] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif.enciphered")) returned 1 [0153.367] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_sml.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_sml.gif.enciphered")) returned 1 [0153.376] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.enciphered")) returned 1 [0153.379] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif.enciphered")) returned 1 [0153.423] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif.enciphered")) returned 1 [0153.430] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.enciphered")) returned 1 [0153.433] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.enciphered")) returned 1 [0153.439] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif.enciphered")) returned 1 [0153.441] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif.enciphered")) returned 1 [0153.444] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.enciphered")) returned 1 [0153.446] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif.enciphered")) returned 1 [0153.450] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.enciphered")) returned 1 [0153.457] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif.enciphered")) returned 1 [0153.460] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif.enciphered")) returned 1 [0153.487] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif.enciphered")) returned 1 [0153.490] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif.enciphered")) returned 1 [0153.492] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.enciphered")) returned 1 [0153.493] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.enciphered")) returned 1 [0153.495] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.enciphered")) returned 1 [0153.497] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.enciphered")) returned 1 [0153.503] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.enciphered")) returned 1 [0153.505] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.enciphered")) returned 1 [0153.507] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.enciphered")) returned 1 [0153.515] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.EnCiPhErEd" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif.enciphered")) returned 1 [0154.435] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.enciphered")) returned 1 [0154.450] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.enciphered")) returned 1 [0154.467] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.enciphered")) returned 1 [0154.475] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.enciphered")) returned 1 [0154.483] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.enciphered")) returned 1 [0154.537] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.enciphered")) returned 1 [0154.556] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.enciphered")) returned 1 [0154.590] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.enciphered")) returned 1 [0154.594] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.enciphered")) returned 1 [0154.601] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.enciphered")) returned 1 [0154.613] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.enciphered")) returned 1 [0154.629] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.enciphered")) returned 1 [0154.635] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk.enciphered")) returned 1 [0154.639] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.enciphered")) returned 1 [0154.679] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk.enciphered")) returned 1 [0154.683] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.enciphered")) returned 1 [0154.687] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk.enciphered")) returned 1 [0154.770] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.enciphered")) returned 1 [0154.778] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk.enciphered")) returned 1 [0154.820] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.enciphered")) returned 1 [0154.826] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.enciphered")) returned 1 [0154.877] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.enciphered")) returned 1 [0154.901] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.enciphered")) returned 1 [0154.905] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.enciphered")) returned 1 [0154.945] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.enciphered")) returned 1 [0154.953] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.enciphered")) returned 1 [0154.988] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.enciphered")) returned 1 [0154.991] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.enciphered")) returned 1 [0154.994] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.enciphered")) returned 1 [0155.002] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.enciphered")) returned 1 [0155.007] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.enciphered")) returned 1 [0155.043] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.enciphered")) returned 1 [0155.048] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.enciphered")) returned 1 [0155.066] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.enciphered")) returned 1 [0155.264] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.enciphered")) returned 1 [0155.286] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.enciphered")) returned 1 [0155.294] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.enciphered")) returned 1 [0155.298] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.enciphered")) returned 1 [0155.308] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.enciphered")) returned 1 [0155.326] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.enciphered")) returned 1 [0155.330] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.enciphered")) returned 1 [0155.337] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.enciphered")) returned 1 [0155.340] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.enciphered")) returned 1 [0155.343] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.enciphered")) returned 1 [0155.347] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.enciphered")) returned 1 [0155.363] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.enciphered")) returned 1 [0155.367] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.enciphered")) returned 1 [0155.371] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk.enciphered")) returned 1 [0155.375] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.enciphered")) returned 1 [0155.378] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk.enciphered")) returned 1 [0155.382] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.enciphered")) returned 1 [0155.386] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk.enciphered")) returned 1 [0155.389] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.enciphered")) returned 1 [0155.392] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk.enciphered")) returned 1 [0155.407] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.enciphered")) returned 1 [0155.411] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.enciphered")) returned 1 [0155.420] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.enciphered")) returned 1 [0155.432] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.enciphered")) returned 1 [0155.437] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.enciphered")) returned 1 [0155.440] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.enciphered")) returned 1 [0155.445] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.enciphered")) returned 1 [0155.529] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.enciphered")) returned 1 [0155.532] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.enciphered")) returned 1 [0155.534] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.enciphered")) returned 1 [0155.743] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.enciphered")) returned 1 [0155.746] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.enciphered")) returned 1 [0155.753] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.enciphered")) returned 1 [0155.757] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.enciphered")) returned 1 [0155.759] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.enciphered")) returned 1 [0155.762] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.enciphered")) returned 1 [0157.321] GetFileAttributesA (lpFileName="C:\\Windows\\servicing\\Packages\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\servicing\\packages\\how to decrypt files.txt")) returned 0xffffffff [0157.329] CreateFileA (lpFileName="C:\\Windows\\servicing\\Packages\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\servicing\\packages\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.330] CloseHandle (hObject=0xffffffff) returned 1 [0162.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Speech_OneCore\\Common\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Speech_OneCore\\Common\\en-US\\") returned="C:\\Windows\\System32\\Speech_OneCore\\Common\\en-US\\" [0169.662] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0169.662] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0169.662] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0169.937] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_eventviewersettings_31bf3856ad364e35_10.0.15063.0_none_060bb1403c81dd6a\\Event Viewer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_eventviewersettings_31bf3856ad364e35_10.0.15063.0_none_060bb1403c81dd6a\\event viewer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_eventviewersettings_31bf3856ad364e35_10.0.15063.0_none_060bb1403c81dd6a\\Event Viewer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_eventviewersettings_31bf3856ad364e35_10.0.15063.0_none_060bb1403c81dd6a\\event viewer.lnk.enciphered")) returned 0 [0171.510] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.15063.0_none_ec056a6583c87c56\\Steps Recorder.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.15063.0_none_ec056a6583c87c56\\steps recorder.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.15063.0_none_ec056a6583c87c56\\Steps Recorder.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.15063.0_none_ec056a6583c87c56\\steps recorder.lnk.enciphered")) returned 0 [0171.723] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_bffab419244e0aae\\Task Manager.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_bffab419244e0aae\\task manager.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_bffab419244e0aae\\Task Manager.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_bffab419244e0aae\\task manager.lnk.enciphered")) returned 0 [0174.342] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.15063.0_none_e3a62b031347d52f\\Component Services.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.15063.0_none_e3a62b031347d52f\\component services.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.15063.0_none_e3a62b031347d52f\\Component Services.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.15063.0_none_e3a62b031347d52f\\component services.lnk.enciphered")) returned 0 [0174.619] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.0_none_5c29f964af25b39d\\Computer Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.0_none_5c29f964af25b39d\\computer management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.0_none_5c29f964af25b39d\\Computer Management.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.0_none_5c29f964af25b39d\\computer management.lnk.enciphered")) returned 0 [0174.622] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.608_none_e05ae487dc8303b1\\Computer Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.608_none_e05ae487dc8303b1\\computer management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.608_none_e05ae487dc8303b1\\Computer Management.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.15063.608_none_e05ae487dc8303b1\\computer management.lnk.enciphered")) returned 0 [0174.867] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.15063.0_none_036d9697dd29e050\\Character Map.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.15063.0_none_036d9697dd29e050\\character map.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.15063.0_none_036d9697dd29e050\\Character Map.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.15063.0_none_036d9697dd29e050\\character map.lnk.enciphered")) returned 0 [0174.899] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.15063.0_none_7e580f9a965a8a9b\\Disk Cleanup.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.15063.0_none_7e580f9a965a8a9b\\disk cleanup.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.15063.0_none_7e580f9a965a8a9b\\Disk Cleanup.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.15063.0_none_7e580f9a965a8a9b\\disk cleanup.lnk.enciphered")) returned 0 [0175.080] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.15063.0_none_4ad22eda27de7766\\Command Prompt.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.15063.0_none_4ad22eda27de7766\\command prompt.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.15063.0_none_4ad22eda27de7766\\Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.15063.0_none_4ad22eda27de7766\\command prompt.lnk.enciphered")) returned 0 [0175.775] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_aa29e7f7c913acd1\\dfrgui.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_aa29e7f7c913acd1\\dfrgui.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_aa29e7f7c913acd1\\dfrgui.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_aa29e7f7c913acd1\\dfrgui.lnk.enciphered")) returned 0 [0176.361] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - Command Prompt.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - command prompt.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - command prompt.lnk.enciphered")) returned 0 [0176.364] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - File Explorer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - file explorer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - File Explorer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01 - file explorer.lnk.enciphered")) returned 0 [0176.366] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01a - Windows PowerShell.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01a - Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\01a - windows powershell.lnk.enciphered")) returned 0 [0176.368] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02 - Command Prompt.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02 - command prompt.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02 - Command Prompt.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02 - command prompt.lnk.enciphered")) returned 0 [0176.370] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02a - Windows PowerShell.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02a - windows powershell.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02a - Windows PowerShell.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\02a - windows powershell.lnk.enciphered")) returned 0 [0176.372] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - Computer Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - computer management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - Computer Management.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - computer management.lnk.enciphered")) returned 0 [0176.374] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - Documents.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - documents.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - Documents.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\03 - documents.lnk.enciphered")) returned 0 [0176.376] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - Disk Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - disk management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - Disk Management.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - disk management.lnk.enciphered")) returned 0 [0176.378] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - Downloads.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - downloads.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - Downloads.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04 - downloads.lnk.enciphered")) returned 0 [0176.380] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04-1 - NetworkStatus.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04-1 - networkstatus.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04-1 - NetworkStatus.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\04-1 - networkstatus.lnk.enciphered")) returned 0 [0176.382] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - Device Manager.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - device manager.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - Device Manager.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - device manager.lnk.enciphered")) returned 0 [0176.384] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - Music.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - music.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - Music.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\05 - music.lnk.enciphered")) returned 0 [0176.385] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - Pictures.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - pictures.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - Pictures.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - pictures.lnk.enciphered")) returned 0 [0176.387] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - SystemAbout.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - systemabout.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - SystemAbout.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\06 - systemabout.lnk.enciphered")) returned 0 [0176.389] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - Event Viewer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - event viewer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - Event Viewer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - event viewer.lnk.enciphered")) returned 0 [0176.391] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - Videos.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - videos.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - Videos.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\07 - videos.lnk.enciphered")) returned 0 [0176.393] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - Homegroup.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - homegroup.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - Homegroup.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - homegroup.lnk.enciphered")) returned 0 [0176.398] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - PowerAndSleep.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - powerandsleep.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - PowerAndSleep.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\08 - powerandsleep.lnk.enciphered")) returned 0 [0176.400] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - Mobility Center.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - mobility center.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - Mobility Center.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - mobility center.lnk.enciphered")) returned 0 [0176.402] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - Network.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - network.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - Network.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\09 - network.lnk.enciphered")) returned 0 [0176.405] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - Desktop.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - desktop.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - Desktop.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - desktop.lnk.enciphered")) returned 0 [0176.408] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - Run.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - run.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - Run.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\1 - run.lnk.enciphered")) returned 0 [0176.410] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - AppsAndFeatures.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - appsandfeatures.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - AppsAndFeatures.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - appsandfeatures.lnk.enciphered")) returned 0 [0176.412] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - UserProfile.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - userprofile.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - UserProfile.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\10 - userprofile.lnk.enciphered")) returned 0 [0176.414] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\2 - Search.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\2 - search.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\2 - Search.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\2 - search.lnk.enciphered")) returned 0 [0176.416] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\3 - Windows Explorer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\3 - windows explorer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\3 - Windows Explorer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\3 - windows explorer.lnk.enciphered")) returned 0 [0176.417] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\4 - Control Panel.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\4 - control panel.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\4 - Control Panel.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\4 - control panel.lnk.enciphered")) returned 0 [0176.419] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\5 - Task Manager.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\5 - task manager.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\5 - Task Manager.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\5 - task manager.lnk.enciphered")) returned 0 [0176.421] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\computer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\computer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\computer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\computer.lnk.enciphered")) returned 0 [0176.423] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Control Panel.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\control panel.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Control Panel.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\control panel.lnk.enciphered")) returned 0 [0176.425] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\File Explorer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\file explorer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\File Explorer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\file explorer.lnk.enciphered")) returned 0 [0176.427] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Run.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\run.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Run.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\run.lnk.enciphered")) returned 0 [0176.429] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Shows Desktop.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\shows desktop.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Shows Desktop.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\shows desktop.lnk.enciphered")) returned 0 [0176.431] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Window Switcher.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\window switcher.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\Window Switcher.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.15063.0_none_c8cbc32f49bac819\\window switcher.lnk.enciphered")) returned 0 [0176.470] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\Fax Recipient.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\fax recipient.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\Fax Recipient.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\fax recipient.lnk.enciphered")) returned 0 [0176.474] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\Windows Fax and Scan.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\windows fax and scan.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\Windows Fax and Scan.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\\windows fax and scan.lnk.enciphered")) returned 0 [0178.377] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.15063.0_none_e8ff03ea94e0988c\\iSCSI Initiator.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.15063.0_none_e8ff03ea94e0988c\\iscsi initiator.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.15063.0_none_e8ff03ea94e0988c\\iSCSI Initiator.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.15063.0_none_e8ff03ea94e0988c\\iscsi initiator.lnk.enciphered")) returned 0 [0178.584] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5563c0977685c595\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5563c0977685c595\\odbc data sources (64-bit).lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5563c0977685c595\\ODBC Data Sources (64-bit).lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5563c0977685c595\\odbc data sources (64-bit).lnk.enciphered")) returned 0 [0178.736] FindFirstFileA (in: lpFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..ac-sql-cliconfg-dll_31bf3856ad364e35_10.0.15063.0_none_7b93313d9325119e\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44978111, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x19cdbcef, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x44978111, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759d90 [0178.738] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0178.829] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.15063.0_none_a4ea7575b2863db1\\Memory Diagnostics Tool.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.15063.0_none_a4ea7575b2863db1\\memory diagnostics tool.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.15063.0_none_a4ea7575b2863db1\\Memory Diagnostics Tool.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.15063.0_none_a4ea7575b2863db1\\memory diagnostics tool.lnk.enciphered")) returned 0 [0179.549] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.15063.0_none_7f41b0a5d17e992b\\Magnify.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.15063.0_none_7f41b0a5d17e992b\\magnify.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.15063.0_none_7f41b0a5d17e992b\\Magnify.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.15063.0_none_7f41b0a5d17e992b\\magnify.lnk.enciphered")) returned 0 [0179.710] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.15063.0_none_bfe54b7d868416ee\\Windows Media Player.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.15063.0_none_bfe54b7d868416ee\\windows media player.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.15063.0_none_bfe54b7d868416ee\\Windows Media Player.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.15063.0_none_bfe54b7d868416ee\\windows media player.lnk.enciphered")) returned 0 [0182.859] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.15063.0_none_eb8e17bcd68ec9f9\\System Configuration.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.15063.0_none_eb8e17bcd68ec9f9\\system configuration.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.15063.0_none_eb8e17bcd68ec9f9\\System Configuration.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.15063.0_none_eb8e17bcd68ec9f9\\system configuration.lnk.enciphered")) returned 0 [0182.943] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.0_none_bcf04010327d02a0\\System Information.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.0_none_bcf04010327d02a0\\system information.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.0_none_bcf04010327d02a0\\System Information.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.0_none_bcf04010327d02a0\\system information.lnk.enciphered")) returned 0 [0182.946] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.483_none_40c5a695601fb93b\\System Information.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.483_none_40c5a695601fb93b\\system information.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.483_none_40c5a695601fb93b\\System Information.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.483_none_40c5a695601fb93b\\system information.lnk.enciphered")) returned 0 [0183.023] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.0_none_9f315fde27607282\\Paint.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.0_none_9f315fde27607282\\paint.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.0_none_9f315fde27607282\\Paint.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.0_none_9f315fde27607282\\paint.lnk.enciphered")) returned 0 [0183.025] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.413_none_235275d754ca6586\\Paint.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.413_none_235275d754ca6586\\paint.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.413_none_235275d754ca6586\\Paint.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.413_none_235275d754ca6586\\paint.lnk.enciphered")) returned 0 [0183.340] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.0_none_cf31b229dc87b1a1\\Narrator.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.0_none_cf31b229dc87b1a1\\narrator.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.0_none_cf31b229dc87b1a1\\Narrator.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.0_none_cf31b229dc87b1a1\\narrator.lnk.enciphered")) returned 0 [0183.342] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.447_none_533659870a065dd4\\Narrator.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.447_none_533659870a065dd4\\narrator.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.447_none_533659870a065dd4\\Narrator.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.447_none_533659870a065dd4\\narrator.lnk.enciphered")) returned 0 [0183.785] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.15063.0_none_802e66b4a8ce74db\\Notepad.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.15063.0_none_802e66b4a8ce74db\\notepad.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.15063.0_none_802e66b4a8ce74db\\Notepad.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.15063.0_none_802e66b4a8ce74db\\notepad.lnk.enciphered")) returned 0 [0183.950] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.15063.0_none_bbd0aca592bd6ae9\\On-Screen Keyboard.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.15063.0_none_bbd0aca592bd6ae9\\on-screen keyboard.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.15063.0_none_bbd0aca592bd6ae9\\On-Screen Keyboard.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.15063.0_none_bbd0aca592bd6ae9\\on-screen keyboard.lnk.enciphered")) returned 0 [0184.033] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.15063.0_none_1c7c1b25b9805ef0\\Print Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.15063.0_none_1c7c1b25b9805ef0\\print management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.15063.0_none_1c7c1b25b9805ef0\\Print Management.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.15063.0_none_1c7c1b25b9805ef0\\print management.lnk.enciphered")) returned 0 [0184.367] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\Performance Monitor.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\performance monitor.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\Performance Monitor.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\performance monitor.lnk.enciphered")) returned 0 [0184.370] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\Resource Monitor.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\resource monitor.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\Resource Monitor.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\\resource monitor.lnk.enciphered")) returned 0 [0184.382] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\Performance Monitor.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\performance monitor.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\Performance Monitor.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\performance monitor.lnk.enciphered")) returned 0 [0184.401] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\Resource Monitor.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\resource monitor.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\Resource Monitor.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.483_none_30f2fdea07656013\\resource monitor.lnk.enciphered")) returned 0 [0184.461] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\Windows PowerShell ISE (x86).lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\windows powershell ise (x86).lnk.enciphered")) returned 0 [0184.464] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\Windows PowerShell ISE.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\windows powershell ise.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\Windows PowerShell ISE.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.15063.0_none_79f996cb3b264dfd\\windows powershell ise.lnk.enciphered")) returned 0 [0184.691] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.15063.0_none_0f14a5b4a7919f86\\Quick Assist.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.15063.0_none_0f14a5b4a7919f86\\quick assist.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.15063.0_none_0f14a5b4a7919f86\\Quick Assist.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.15063.0_none_0f14a5b4a7919f86\\quick assist.lnk.enciphered")) returned 0 [0185.425] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.15063.0_none_6a732ed779e4583b\\Security Configuration Management.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.15063.0_none_6a732ed779e4583b\\security configuration management.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.15063.0_none_6a732ed779e4583b\\Security Configuration Management.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.15063.0_none_6a732ed779e4583b\\security configuration management.lnk.enciphered")) returned 0 [0186.394] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.15063.0_none_e077bbdd7e899e4b\\services.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.15063.0_none_e077bbdd7e899e4b\\services.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.15063.0_none_e077bbdd7e899e4b\\services.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.15063.0_none_e077bbdd7e899e4b\\services.lnk.enciphered")) returned 0 [0186.865] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.15063.0_none_aad7db68c271ad4a\\Snipping Tool.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.15063.0_none_aad7db68c271ad4a\\snipping tool.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.15063.0_none_aad7db68c271ad4a\\Snipping Tool.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.15063.0_none_aad7db68c271ad4a\\snipping tool.lnk.enciphered")) returned 0 [0186.975] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.15063.0_none_2d1dc944849b5924\\Speech Recognition.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.15063.0_none_2d1dc944849b5924\\speech recognition.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.15063.0_none_2d1dc944849b5924\\Speech Recognition.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.15063.0_none_2d1dc944849b5924\\speech recognition.lnk.enciphered")) returned 0 [0187.212] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.15063.0_none_dbb55c5189ba2ad8\\Math Input Panel.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.15063.0_none_dbb55c5189ba2ad8\\math input panel.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.15063.0_none_dbb55c5189ba2ad8\\Math Input Panel.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.15063.0_none_dbb55c5189ba2ad8\\math input panel.lnk.enciphered")) returned 0 [0187.357] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.15063.0_none_5ef026ce59e64966\\Remote Desktop Connection.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.15063.0_none_5ef026ce59e64966\\remote desktop connection.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.15063.0_none_5ef026ce59e64966\\Remote Desktop Connection.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.15063.0_none_5ef026ce59e64966\\remote desktop connection.lnk.enciphered")) returned 0 [0189.222] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.0_none_3ece526ca5b43e29\\Wordpad.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.0_none_3ece526ca5b43e29\\wordpad.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.0_none_3ece526ca5b43e29\\Wordpad.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.0_none_3ece526ca5b43e29\\wordpad.lnk.enciphered")) returned 0 [0189.233] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.483_none_c2a3b8f1d356f4c4\\Wordpad.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.483_none_c2a3b8f1d356f4c4\\wordpad.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.483_none_c2a3b8f1d356f4c4\\Wordpad.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.483_none_c2a3b8f1d356f4c4\\wordpad.lnk.enciphered")) returned 0 [0189.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.15063.0_none_223cc5e3ff986bcd\\" | out: lpString1="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.15063.0_none_223cc5e3ff986bcd\\") returned="C:\\Windows\\WinSxS\\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.15063.0_none_223cc5e3ff986bcd\\" [0189.475] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.15063.0_none_262f2cb987063af6\\XPS Viewer.lnk" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.15063.0_none_262f2cb987063af6\\xps viewer.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.15063.0_none_262f2cb987063af6\\XPS Viewer.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.15063.0_none_262f2cb987063af6\\xps viewer.lnk.enciphered")) returned 0 [0191.495] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.15063.0_none_966ace434593e6ab\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\windows\\winsxs\\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.15063.0_none_966ace434593e6ab\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.15063.0_none_966ace434593e6ab\\Windows Firewall with Advanced Security.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.15063.0_none_966ace434593e6ab\\windows firewall with advanced security.lnk.enciphered")) returned 0 [0193.024] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\amd64_taskschedulersettings_31bf3856ad364e35_10.0.15063.0_none_5bfedd033d2b9dee\\Task Scheduler.lnk" (normalized: "c:\\windows\\winsxs\\amd64_taskschedulersettings_31bf3856ad364e35_10.0.15063.0_none_5bfedd033d2b9dee\\task scheduler.lnk"), lpNewFileName="C:\\Windows\\WinSxS\\amd64_taskschedulersettings_31bf3856ad364e35_10.0.15063.0_none_5bfedd033d2b9dee\\Task Scheduler.lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\amd64_taskschedulersettings_31bf3856ad364e35_10.0.15063.0_none_5bfedd033d2b9dee\\task scheduler.lnk.enciphered")) returned 0 [0217.592] MoveFileA (lpExistingFileName="C:\\Windows\\WinSxS\\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5fb86ae9aae68790\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\windows\\winsxs\\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5fb86ae9aae68790\\odbc data sources (32-bit).lnk"), lpNewFileName="C:\\Windows\\WinSxS\\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5fb86ae9aae68790\\ODBC Data Sources (32-bit).lnk.EnCiPhErEd" (normalized: "c:\\windows\\winsxs\\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5fb86ae9aae68790\\odbc data sources (32-bit).lnk.enciphered")) returned 0 [0219.644] FindFirstFileA (in: lpFileName="C:\\Windows\\WinSxS\\wow64_microsoft-windows-w..itomi-dll.resources_31bf3856ad364e35_10.0.15063.0_en-us_772b6491e7e4c4c9\\*.*", lpFindFileData=0x19fa40 | out: lpFindFileData=0x19fa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b9339f8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x41e5b762, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x7b9339f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x759ed0 [0219.645] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0224.251] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt.enciphered")) returned 1 [0224.255] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt.enciphered")) returned 1 [0224.276] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt.enciphered")) returned 1 [0224.289] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt.enciphered")) returned 1 [0224.293] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt.enciphered")) returned 1 [0224.301] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png.enciphered")) returned 1 [0224.305] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png.enciphered")) returned 1 [0224.308] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png.enciphered")) returned 1 [0224.312] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm.enciphered")) returned 1 [0224.317] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm.enciphered")) returned 1 [0224.321] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm.enciphered")) returned 1 [0224.334] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm.enciphered")) returned 1 [0224.340] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm.enciphered")) returned 1 [0224.344] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm.enciphered")) returned 1 [0224.349] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm.enciphered")) returned 1 [0224.354] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm.enciphered")) returned 1 [0224.362] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm.enciphered")) returned 1 [0224.366] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm.enciphered")) returned 1 [0224.371] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm.enciphered")) returned 1 [0224.375] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm.enciphered")) returned 1 [0224.379] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm.enciphered")) returned 1 [0224.384] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm.enciphered")) returned 1 [0224.388] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm.enciphered")) returned 1 [0224.395] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm.enciphered")) returned 1 [0224.399] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm.enciphered")) returned 1 [0224.417] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm.enciphered")) returned 1 [0224.423] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm.enciphered")) returned 1 [0224.427] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm.enciphered")) returned 1 [0224.432] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm.enciphered")) returned 1 [0224.439] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm.enciphered")) returned 1 [0224.454] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm.enciphered")) returned 1 [0224.459] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm.enciphered")) returned 1 [0224.464] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm.enciphered")) returned 1 [0224.468] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm.enciphered")) returned 1 [0224.473] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm.enciphered")) returned 1 [0224.477] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm.enciphered")) returned 1 [0224.483] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm.enciphered")) returned 1 [0224.488] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm.enciphered")) returned 1 [0224.492] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm.enciphered")) returned 1 [0224.585] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm.enciphered")) returned 1 [0224.590] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm.enciphered")) returned 1 [0224.595] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm.enciphered")) returned 1 [0224.600] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm.enciphered")) returned 1 [0224.616] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm.enciphered")) returned 1 [0224.623] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm.enciphered")) returned 1 [0224.627] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm.enciphered")) returned 1 [0224.641] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm.enciphered")) returned 1 [0224.691] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm.enciphered")) returned 1 [0224.722] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm.enciphered")) returned 1 [0224.792] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm.enciphered")) returned 1 [0224.797] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png.enciphered")) returned 1 [0224.801] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png.enciphered")) returned 1 [0224.811] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif.enciphered")) returned 1 [0224.816] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png.enciphered")) returned 1 [0224.855] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png.enciphered")) returned 1 [0224.859] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png.enciphered")) returned 1 [0224.884] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png.enciphered")) returned 1 [0224.889] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png.enciphered")) returned 1 [0224.937] MoveFileA (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.EnCiPhErEd" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png.enciphered")) returned 1 [0224.940] SHGetSpecialFolderPathA (in: hwnd=0x0, pszPath=0x405250, csidl=16, fCreate=1 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0224.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\FD1HVy\\Desktop" | out: lpString1="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0224.962] MessageBoxA (hWnd=0x0, lpText="Attention! All your files are encrypted!\r\nTo restore your files and access them,\r\nplease send an SMS with the text 19283 to +86 17192175113 number.\r\n\r\nYou have 5 attempts to enter the code.\r\nWhen that number has been exceeded,\r\nall the data irreversibly is destroyed.\r\nBe careful when you enter the code!\r\n", lpCaption=0x0, uType=0x10) returned 1 [0225.937] FindResourceA (hModule=0x0, lpName="pussylicker", lpType=0x2) returned 0x42c0a0 [0225.937] SizeofResource (hModule=0x0, hResInfo=0x42c0a0) returned 0x20c46 [0225.937] LoadResource (hModule=0x0, hResInfo=0x42c0a0) returned 0x408194 [0225.937] LockResource (hResData=0x408194) returned 0x408194 [0225.937] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\flagmcioejpekagm.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\flagmcioejpekagm.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0225.939] SetFilePointer (in: hFile=0x2d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.939] WriteFile (in: hFile=0x2d4, lpBuffer=0x408194*, nNumberOfBytesToWrite=0x20c46, lpNumberOfBytesWritten=0x19ff60, lpOverlapped=0x0 | out: lpBuffer=0x408194*, lpNumberOfBytesWritten=0x19ff60*=0x20c46, lpOverlapped=0x0) returned 1 [0225.943] SetFileTime (hFile=0x2d4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0225.943] CloseHandle (hObject=0x2d4) returned 1 [0225.955] SystemParametersInfoA (in: uiAction=0x14, uiParam=0x0, pvParam="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\flagmcioejpekagm.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\flagmcioejpekagm.bmp"), fWinIni=0x3 | out: pvParam=0x406e19) returned 1 [0226.715] FreeResource (hResData=0x408194) returned 0 [0226.726] ExitProcess (uExitCode=0x0) Thread: id = 22 os_tid = 0x1094 Thread: id = 23 os_tid = 0x13ac